Azure 应用服务（移动应用）AAD 身份验证令牌刷新答案

【问题标题】：Azure App Services (Mobile Apps) AAD authentication token refreshAzure 应用服务（移动应用）AAD 身份验证令牌刷新
【发布时间】：2016-11-16 10:13:27
【问题描述】：

我正在尝试使用 Azure Active Directory 在我的 uwp 应用程序上执行登录功能。这成功发生，但是我无法让它在令牌过期时刷新令牌，并且总是收到错误“刷新失败，出现 403 禁止错误。刷新令牌已被撤销或过期。”所以我必须再次打开登录窗口。我正在使用 2.1.0 版本和以下代码进行身份验证：

private async Task<bool> AuthenticateAsync(bool forceRelogon = false)
    {
        //string message;
        bool success = false;

        // Use the PasswordVault to securely store and access credentials.
        PasswordVault vault = new PasswordVault();
        PasswordCredential credential = null;

        //Set the Auth provider
        MobileServiceAuthenticationProvider provider = MobileServiceAuthenticationProvider.WindowsAzureActiveDirectory;
        MobileServiceUser user = null;

        try
        {
            // Try to get an existing credential from the vault.
            var credentials = vault.FindAllByResource(provider.ToString());
            credential = credentials.FirstOrDefault();
        }
        catch (Exception ex)
        {
            // When there is no matching resource an error occurs, which we ignore.
            Debug.WriteLine(ex);
        }

        if (credential != null && !forceRelogon)
        {
            // Create a user from the stored credentials.
            user = new MobileServiceUser(credential.UserName);
            credential.RetrievePassword();
            user.MobileServiceAuthenticationToken = credential.Password;

            // Set the user from the stored credentials.
            App.MobileService.CurrentUser = user;
            //message = string.Format($"Cached credentials for user - {user.UserId}");

            // Consider adding a check to determine if the token is 
            // expired, as shown in this post: http://aka.ms/jww5vp.
            if (RedemptionApp.ExtensionMethods.TokenExtension.IsTokenExpired(App.MobileService))
            {
                try
                {
                    await App.MobileService.RefreshUserAsync();
                }
                catch (Exception ex)
                {
                    Debug.WriteLine(ex);
                }
            }

            success = true;
        }
        else
        {
            try
            {
                // Login with the identity provider.
                user = await App.MobileService
                    .LoginAsync(provider);

                // Create and store the user credentials.
                if (credential != null)
                vault.Remove(credential);

                credential = new PasswordCredential(provider.ToString(),
                    user.UserId, user.MobileServiceAuthenticationToken);
                vault.Add(credential);

                success = true;
                //message = string.Format($"You are now logged in - {user.UserId}");
            }
            catch (MobileServiceInvalidOperationException)
            {
                //message = "You must log in. Login Required";
            }
        }

        //var dialog = new MessageDialog(message);
        //dialog.Commands.Add(new UICommand("OK"));
        //await dialog.ShowAsync();

        return success;
    }

任何人都可以看到我正在做的事情有问题，或者需要在 AAD 服务提供商内做任何事情吗？

【问题讨论】：

标签： azure uwp azure-mobile-services azure-active-directory

【解决方案1】：

您可以通过查看服务器端应用程序日志获得更准确的信息。令牌刷新失败的详细信息将自动记录在那里。有关应用程序日志的更多详细信息，请参见：https://azure.microsoft.com/en-us/documentation/articles/web-sites-enable-diagnostic-log/。我建议将跟踪级别设置为信息或详细。

此外，如果您还没有这样做，Azure AD 需要一些额外的配置来启用刷新令牌。具体来说，您需要配置“客户端密码”并启用 OpenID Connect 混合流。更多详细信息可以在这篇博文中找到：https://cgillum.tech/2016/03/07/app-service-token-store/（向下滚动到刷新令牌部分，看看它在哪里描述了 AAD 的过程）。

【讨论】：

【解决方案2】：

除了关于移动应用配置的内容外，我可以发现这一点。

你有：

// Login with the identity provider.
user = await App.MobileService.LoginAsync(provider);

应该是：

user = await App.MobileService.LoginAsync(MobileServiceAuthenticationProvider.WindowsAzureActiveDirectory,    
          new Dictionary<string, string>() {{ "response_type", "code id_token" }});

也许这会有所帮助： https://azure.microsoft.com/en-us/blog/mobile-apps-easy-authentication-refresh-token-support/

【讨论】：