c#-不支持通过/ common或/ consumers端点的应用程序错误

我希望任何人都能帮助我解决这个问题

我试图从Microsoft Graph Api获得与公司特定的应用程序一起工作的代码示例之一.在我的租户登录屏幕上登录后,我将重定向到应用程序,并出现以下错误.

AADSTS90130: Application ‘{application id}’
(aad name) is not supported over the /common or /consumers
endpoints. Please use the /organizations or tenant-specific endpoint.

在我的启动课程中,我有以下代码：

    // The graphScopes are the Microsoft Graph permission scopes that are used by this sample: User.Read Mail.Send
    private static string appId = ConfigurationManager.AppSettings["ida:AppId"];
    private static string appSecret = ConfigurationManager.AppSettings["ida:AppSecret"];
    private static string redirectUri = ConfigurationManager.AppSettings["ida:RedirectUri"];
    private static string graphScopes = ConfigurationManager.AppSettings["ida:GraphScopes"];

    public void ConfigureAuth(IAppBuilder app)
    {
        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

        app.UseCookieAuthentication(new CookieAuthenticationOptions());

        app.UseOpenIdConnectAuthentication(
            new OpenIdConnectAuthenticationOptions
            {

                // The `Authority` represents the Microsoft v2.0 authentication and authorization service.
                // The `Scope` describes the permissions that your app will need. See https://azure.microsoft.com/documentation/articles/active-directory-v2-scopes/                    
                ClientId = appId,
                Authority = "https://login.microsoftonline.com/{tenantid}",
                PostLogoutRedirectUri = redirectUri,
                RedirectUri = redirectUri,
                Scope = "openid email profile offline_access " + graphScopes,
                TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = false,
                    // In a real application you would use IssuerValidator for additional checks, 
                    // like making sure the user's organization has signed up for your app.
                    //     IssuerValidator = (issuer, token, tvp) =>
                    //     {
                    //         if (MyCustomTenantValidation(issuer)) 
                    //             return issuer;
                    //         else
                    //             throw new SecurityTokenInvalidIssuerException("Invalid issuer");
                    //     },
                },
                Notifications = new OpenIdConnectAuthenticationNotifications
                {
                    AuthorizationCodeReceived = async (context) =>
                    {
                        var code = context.Code;
                        string signedInUserID = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.NameIdentifier).Value;

                        TokenCache userTokenCache = new SessionTokenCache(signedInUserID,
                            context.OwinContext.Environment["System.Web.HttpContextBase"] as HttpContextBase).GetMsalCacheInstance();
                        ConfidentialClientApplication cca = new ConfidentialClientApplication(
                            appId, 
                            redirectUri,
                            new ClientCredential(appSecret),
                            userTokenCache,
                            null);
                        string[] scopes = graphScopes.Split(new char[] { ' ' });

                        AuthenticationResult result = await cca.AcquireTokenByAuthorizationCodeAsync(code, scopes);
                    },
                    AuthenticationFailed = (context) =>
                    {
                        context.HandleResponse();
                        context.Response.Redirect("/Error?message=" + context.Exception.Message);
                        return Task.FromResult(0);
                    }
                }
            });
    }
}

在此代码中,我在登录url中具有特定于租户的ID,该ID适用于具有相同登录样式的另一个应用程序.

我不确定出什么问题了,所以我希望有人可以帮助我.我在这里查看了相关的问题,但似乎没有一个与此问题相关.

解决方法:

您正在使用v1端点通过Azure门户注册应用程序,并将“多租户”设置为false.这会将您的应用程序限制为仅来自其注册用户的AAD用户.

如果要接受任何AAD用户,则需要启用多个租户.这将使AAD报告租户可以识别您的应用程序并允许用户进行身份验证.

如果要同时接受AAD和MSA用户,则需要在https://apps.dev.microsoft.com处注册您的应用程序.您还需要重构身份验证代码以使用v2端点.

标签：microsoft-graph,azure-active-directory,asp-net,c
来源： https://codeday.me/bug/20191109/2011529.html