InvalidAuthenticationTokenAudience – Logic Apps的身份验证

huangapple
go评论66阅读模式
英文:

InvalidAuthenticationTokenAudience - Authentication for Logic Apps

问题

经过几天的努力，我将尝试在这里寻求一些帮助。我有几个逻辑应用 - 其中一些具有HTTP触发器，另一些具有SQL触发器（当创建项目时，当修改项目时触发）。它们每隔X小时运行一次，但客户要求在他的自定义Web应用程序中也可以通过按钮点击手动运行逻辑应用。

为了能够运行逻辑应用（调用触发器），我正在尝试获取授权的Bearer令牌并运行逻辑应用。我按照以下步骤进行操作：https://www.serverlessnotes.com/docs/securing-azure-logic-app-http-triggers-with-azure-ad#。

简而言之，我创建了两个应用程序注册（客户端和服务端），包括角色应用程序和API权限。然后，在逻辑应用的授权部分，我添加了发行者（https://login.windows.net/{tenantid}/oauth2/token/）和受众（服务应用程序注册的ClientId） - 这是链接中的第5步。

但我发现我在这里缺乏一些理解。因为现在当我测试它（如链接中所描述），我遇到了以下错误。

首先获取令牌：

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

然后尝试使用该令牌执行逻辑应用触发器：

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

访问令牌已获得错误的受众或资源 'XXX'。它应该与允许的受众之一完全匹配 'https://management.core.windows.net/'，'https://management.core.windows.net'，'https://management.azure.com/'，'https://management.azure.com'。

POST请求的链接是逻辑应用的触发器，如下所示：
https://management.azure.com/subscriptions/{id}/resourceGroups/{ResourceGroup}/providers/Microsoft.Logic/workflows/{LogicAppName}/triggers/When_an_item_is_created/run?api-version=2016-06-01

我知道这个链接有效，因为如果我尝试输入我的个人数据（电子邮件和密码），它会成功。但为了避免在代码中使用用户名和密码数据，我希望使用这个令牌来解决问题。但我不知道在哪里需要修复它以使受众匹配 - 是在逻辑应用中还是在这些应用程序注册中？对于任何帮助，我将非常感激。

英文:

After a couple of days of struggling, I will try to get some help here. I have several logic apps - some with HTTP triggers and some with SQL triggers (when an item is created, when an item is modified). They are running every X of hours, but the client requested to have the possibility to run the logic apps also manually through a button click in his custom web application.

To be able to run the logic apps (call the triggers), I am trying to get a Bearer token for authorization and run the logic app. I followed all these steps https://www.serverlessnotes.com/docs/securing-azure-logic-app-http-triggers-with-azure-ad#.
Shortly said, I created two app registrations (client and service) including role app and API permissions. Then I added into a LogicApp under Authorization the Issuer (https://login.windows.net/{tenantid}/oauth2/token/) and the Audience (the ClientId of the Service App registration) - that is Step 5 from the link.

But I see I am missing some understanding here. Because now when I test it (as described in the link), I have the following error.

First getting the token:

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

And then try to execute the LogicApp Trigger with that token:

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

The access token has been obtained for wrong audience or resource 'XXX'. It should exactly match with one of the allowed audiences 'https://management.core.windows.net/','https://management.core.windows.net','https://management.azure.com/','https://management.azure.com'.

The link of the POST request is the trigger of the LogicApp like:
https://management.azure.com/subscriptions/{id}/resourceGroups/{ResourceGroup}/providers/Microsoft.Logic/workflows/{LogicAppName}/triggers/When_an_item_is_created/run?api-version=2016-06-01

I know that this link works because if I try to enter my personal data (email and password), it succeeds. But to avoid username and password data in the code, I wanted to solve this with this token. But I do not know where I need to fix it so the audience matches - in the logic app or in those app registrations? I would be very thankful for any help.

答案1

得分: 2

我尝试在我的环境中复制相同的操作，并获得了以下结果：

我注册了 Azure AD 应用程序，与您一样，并添加了以下 API 权限：

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

现在，我使用以下参数通过 Postman 生成了 访问令牌：

GET https://login.microsoftonline.com/<tenantID>/oauth2/token
grant_type:client_credentials
client_id:<client appID>
client_secret: <secret>
resource: api://<service appID>

响应：

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

当我使用上述令牌执行 LogicApp 触发器时，我得到了与您相同的错误，如下所示：

POST https://management.azure.com/subscriptions/<subID>/resourceGroups/<ResourceGroup>/providers/Microsoft.Logic/workflows/<LogicAppName>/triggers/manual/run?api-version=2016-06-01

响应：

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

要 解决 此错误，您需要更改请求 URL，通过传递不带 SAS 密钥的 Logic App URL。

当我像这样更改请求 URL 时，LogicApp 成功触发，并获得以下响应：

POST <Logic Apps URL without SAS key>

响应：

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

如果您想使用 管理 REST API 触发 Logic App，则需要使用不同的 resource 生成访问令牌，如下所示：

GET https://login.microsoftonline.com/<tenantID>/oauth2/token
grant_type:client_credentials
client_id:<client appID>
client_secret: <secret>
resource: https://management.azure.com

响应：

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

当我使用上述令牌触发 LogicApp 时，通过 Management API 调用，我得到了 Status: 202 Accepted 的 响应，如下所示：

POST https://management.azure.com/subscriptions/<subID>/resourceGroups/<ResourceGroup>/providers/Microsoft.Logic/workflows/<LogicAppName>/triggers/manual/run?api-version=2016-06-01

响应：

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

在生成访问令牌之前，请根据您的需求为服务主体分配适当的 角色。

在我的情况下，我为 LogicApp 的服务主体分配了 Contributor 角色，如下所示：

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

英文:

I tried to reproduce the same in my environment and got below results:

I registered Azure AD applications same as you and added API permissions as below:

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

Now I generated access token via Postman with below parameters:

GET https://login.microsoftonline.com/&lt;tenantID&gt;/oauth2/token
grant_type:client_credentials
client_id:&lt;client appID&gt;
client_secret: &lt;secret&gt;
resource: api://&lt;service appID&gt;

Response:

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

When I used the above token to execute LogicApp Trigger, I got same error as you like below:

POST https://management.azure.com/subscriptions/&lt;subID&gt;/resourceGroups/&lt;ResourceGroup&gt;/providers/Microsoft.Logic/workflows/&lt;LogicAppName&gt;/triggers/manual/run?api-version=2016-06-01

Response:

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

To resolve the error, you need to change your request URL by passing your Logic App URL without SAS key.

When I changed the request URL like that, LogicApp triggered sucessfully with below response:

POST &lt;Logic Apps URL without SAS key&gt;

Response:

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

If you want to trigger logic app with Management REST API, then you need to generate access token with different resource like this:

GET https://login.microsoftonline.com/&lt;tenantID&gt;/oauth2/token
grant_type:client_credentials
client_id:&lt;client appID&gt;
client_secret: &lt;secret&gt;
resource: https://management.azure.com

Response:

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

When I used the above token to trigger LogicApp with Management API call, I got response with Status: 202 Accepted like below:

POST https://management.azure.com/subscriptions/&lt;subID&gt;/resourceGroups/&lt;ResourceGroup&gt;/providers/Microsoft.Logic/workflows/&lt;LogicAppName&gt;/triggers/manual/run?api-version=2016-06-01

Response:

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

Make sure to assign proper role to the service principal based on your requirement, before generating access token.

In my case, I assigned Contributor role to service principal under LogicApp like this:

InvalidAuthenticationTokenAudience – Logic Apps的身份验证

huangapple
  • 本文由 发表于 2023年2月24日 09:22:33
  • 转载请务必保留本文链接：https://go.coder-hub.com/75551840.html
  • azure
  • azure-authentication
  • azure-logic-apps
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定