英文:
Include Azure AD B2C aud claim in call to custom claim REST API
问题
TL;DR: {OIDC:ClientId} 始终是调用应用程序。我还需要知道“受众”应用程序。是否有一个用于此目的的声明解析器？
In more detail:
这里的问题：
- 应用程序 A 和应用程序 B 都在同一个 Azure AD B2C 租户中注册。
- 单独的 REST API（我们将其称为“声明 API”）将自定义声明注入 Azure AD B2C 令牌中。这些声明必须根据使用令牌的应用程序而变化。
- 我使用 {OIDC:ClientId} 声明解析器将请求应用程序的 clientId 发送到声明 API，就像在 此答案 中所示。
- 当应用程序 A 请求为应用程序 B 获取访问令牌时，声明 API 收到应用程序 A 的客户端 ID。然而，我需要加载应用程序 B 的声明，因为那是实际消费令牌的应用程序。所以问题是，如何获取目标应用程序的客户端 ID 以及请求应用程序的客户端 ID？
我考虑过使用 {OIDC:scopes} 声明解析器来解决此问题。这可能有效，但似乎有点像一种权宜之计。是否有更好的选择？
英文:
TL;DR: {OIDC:ClientId} is always the calling Application. I also need to know the "audience" application. Is there a claim resolver for this?
In more detail:
Here's the problem:
- Application A and Application B are both registered in the same Azure AD B2C tenant.
- A separate REST API (we'll call it "claims API") feeds custom claims into Azure AD B2C tokens. These claims must vary dependent on the application that consumes the token.
- I use the {OIDC:ClientId} claims resolver to send the clientId of the requesting application to the claims API, like in this answer.
- When Application A requests an access token for Application B, the Claims API receives the client ID for application A. However, I need to load claims for Application B, since that's the application that will actually consume the token. So the question is, how can I get the clientID for the target application as well as the requesting application?
I have considered using the {OIDC:scopes} claim resolver to solve this issue. That might work, but it seems a little like a hack. Are there any better options?
答案1
得分: 0
根据此文档，似乎{OIDC:scopes} 是唯一可用的选项。经过进一步思考，这是有道理的，因为可能会请求一些超出当前租户范围的范围（例如 Microsoft Graph API）。在这种情况下，无法为目标应用程序提供 clientId。
{OIDC:scopes} 是一个由所有请求的范围组成的单个字符串，以空格分隔。要检测是否正在为与当前应用程序不同的应用程序生成访问令牌，只需在范围字段上进行简单的字符串搜索即可。如果应用程序的 App ID URI 出现在范围字符串中，就表示正在请求该应用程序的访问令牌。
英文:
Per this document, it appears that {OIDC:scopes} is the only available option for this. And with some further thought, that makes sense, since some scopes might be requested that are outside the current tenant (Microsoft Graph API, for instance). In that case, it would not be possible to supply a clientId for the target application.
{OIDC:scopes} is a single string with all of the requested scopes separated by spaces. To detect when an access token is being generated for a different application than the current one, a simple string search on the scopes field is sufficient. If the App ID URI of an application is present in the scopes string, an access token is being requested for that application.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论