Question

我正试图建立“空间”功能,用于布布布储存的档案。我想能够使用Microsoft Entra ID(旧称“AD”)认证,根据集团成员和博龙指数标的组合,控制博龙的进入。在试图通过储存REEST AP来获得博览会时,这项工作是值得称道的,但我希望能够简单地拥有一部URL,必要时即可启动认证,并使用户能够在浏览器中看到笔记(笔会是图像)。

一般做法基本上如下:。利用新的AAD出入控制网浏览器,通过URI获得一个博客。然而,该员额的解决方案是以早先的奥阿乌特/阿农发组织为基础,似乎不再适用于奥阿乌特2.0。

我拥有“Entra”认证的“功能”,这一功能——当我打过“URL”的职能时,我走过了“ au”的路,在我的职能守则中,我可以这样说:

var accessToken = req.Headers.FirstOrDefault(p => p.Key.Equals("x-ms-token-aad-access-token", StringComparison.OrdinalIgnoreCase));

However, when I present this token to the Storage API, I get the following error:

<Error>
<Code>InvalidAuthenticationInfo</Code>
<Message>Server failed to authenticate the request. Please refer to the information in the www-authenticate header. RequestId:20312ea0-c01e-003d-49f4-28d43b000000 Time:2023-12-07T10:04:34.9679103Z</Message>
<AuthenticationErrorDetail>Signature validation failed. Signature verification failed.</AuthenticationErrorDetail>
</Error>

The www-authenticate Header on the response contained:

Bearer authorization_uri=https://login.microsoftonline.com/<my app ID>/oauth2/authorize resource_id=https://storage.azure.com

But I m not sure what to do with this information.

我在我的申请登记上将用户储存许可编成配置。

我将以下内容组合起来,使相关身份提供者得以在环境中成为观众:

api://<my app id>,
https://storage.azure.com/.default
https://storage.azure.com
https://storage.azure.com/user_impersonation
https://stasepaimagespoc.blob.core.windows.net/user_impersonation

我曾试图如我前面提到的员额表1所述,在“资源管理员”的配对版中指定更多的记录仪表板,但这一差错是“由于该站点正在 au第2号”上运行,因此没有执行现场要求,我可以不看到任何类似情况。

我已用《维也纳条约法公约》对标注。 IO, and I see that the “aud” Value is “00000003-0000-c000-00000000-00000000000000000000. 0000000000000000, which based on a post I found on “Troublefireing signature Validation Errors” (link addressed as SO considers it sspiam) indicated this is agraph to which can be recognized by any other thangraph. 这个员额似乎说,我需要改变象征性请求的范围参数,但我不知道如何这样做。

没有人提出任何建议?

Answer 1

Lol - 我在把这个问题放在这里之后,提前了两天,然后又半小时,禁止我反对此事,我找到解决办法。借助 , 解决额外的LoginParams with auth v2, 提供关键信息。

What I needed to do to make this work was to add a scope specification to the login request, and the way you do that under oath2 is by adding a loginParameters element under properties.identityProviders.login for authsettingsV2 in Azure Resource Explorer, like so:

"login": {
  "loginParameters": [
    "scope=openid https://storage.azure.com/.default"
  ],
  "disableWWWAuthenticate": false
}

友情链接