排查自定义身份验证扩展问题

1. For local development and testing purposes, open local.settings.json and replace the code with the following JSON:

   {
     "IsEncrypted": false,
     "Values": {
       "AzureWebJobsStorage": "",
       "AzureWebJobsSecretStorageType": "files",
       "FUNCTIONS_WORKER_RUNTIME": "dotnet",
       "AuthenticationEvents__BypassTokenValidation" : false
     }
   }
   

   Note

   If you used the Microsoft.Azure.WebJobs.Extensions.AuthenticationEvents NuGet package, be sure to set "AuthenticationEvents__BypassTokenValidation" : true for local testing purposes.

2. Using your preferred API testing tool, create a new HTTP request and set the HTTP method to POST.

3. 使用以下 JSON 正文来模仿 Microsoft Entra ID 发送到 REST API 的请求。

   {
       "type": "microsoft.graph.authenticationEvent.tokenIssuanceStart",
       "source": "/tenants/aaaabbbb-0000-cccc-1111-dddd2222eeee/applications/00001111-aaaa-2222-bbbb-3333cccc4444",
       "data": {
           "@odata.type": "microsoft.graph.onTokenIssuanceStartCalloutData",
           "tenantId": "aaaabbbb-0000-cccc-1111-dddd2222eeee",
           "authenticationEventListenerId": "11112222-bbbb-3333-cccc-4444dddd5555",
           "customAuthenticationExtensionId": "22223333-cccc-4444-dddd-5555eeee6666",
           "authenticationContext": {
               "correlationId": "aaaa0000-bb11-2222-33cc-444444dddddd",
               "client": {
                   "ip": "127.0.0.1",
                   "locale": "en-us",
                   "market": "en-us"
               },
               "protocol": "OAUTH2.0",
               "clientServicePrincipal": {
                   "id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb",
                   "appId": "00001111-aaaa-2222-bbbb-3333cccc4444",
                   "appDisplayName": "My Test application",
                   "displayName": "My Test application"
               },
               "resourceServicePrincipal": {
                   "id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb",
                   "appId": "00001111-aaaa-2222-bbbb-3333cccc4444",
                   "appDisplayName": "My Test application",
                   "displayName": "My Test application"
               },
               "user": {
                   "companyName": "Casey Jensen",
                   "createdDateTime": "2023-08-16T00:00:00Z",
                   "displayName": "Casey Jensen",
                   "givenName": "Casey",
                   "id": "00aa00aa-bb11-cc22-dd33-44ee44ee44ee",
                   "mail": "casey@contoso.com",
                   "onPremisesSamAccountName": "Casey Jensen",
                   "onPremisesSecurityIdentifier": "<Enter Security Identifier>",
                   "onPremisesUserPrincipalName": "Casey Jensen",
                   "preferredLanguage": "en-us",
                   "surname": "Jensen",
                   "userPrincipalName": "casey@contoso.com",
                   "userType": "Member"
               }
           }
       }
   }
   

   Tip

   If you're using an access token obtained from Microsoft Entra ID, select Authorization and then select Bearer token, then paste the access token you received from Microsoft Entra ID.

4. Select Send, and you should receive a JSON response similar to the following:

   {
       "data": {
           "@odata.type": "microsoft.graph.onTokenIssuanceStartResponseData",
           "actions": [
               {
                   "@odata.type": "microsoft.graph.tokenIssuanceStart.provideClaimsForToken",
                   "claims": {
                       "customClaim1": "customClaimValue1",
                       "customClaim2": [
                           "customClaimString1",
                           "customClaimString2" 
                       ]
                   }
               }
   
           ]
       }
   }
   

获取访问令牌后，向其传递 HTTP Authorization 标头。 若要获取访问令牌，请执行以下步骤：

1. 至少以云应用程序管理员身份登录到 Microsoft Entra 管理中心。

2. Browse to Entra ID>App registrations.

3. 选择“Azure Functions 身份验证事件 API”应用注册（之前在配置令牌颁发事件的自定义声明提供程序中配置）。

4. Copy the application ID.

5. 如果尚未创建应用机密，请执行以下步骤：

   1. 选择证书和机密>客户端密码>新建客户端密码。
   2. 添加客户端机密的说明。
   3. 选择密码的过期时间，或指定自定义的生存期。
   4. Select Add.
   5. Record the secret's value for use in your client application code. 退出此页面后，此密码值永不再显示。

6. 从菜单中选择公开 API，并复制应用程序 ID URI 的值。 例如，api://contoso.azurewebsites.net/aaaabbbb-0000-cccc-1111-dddd2222eeee。

7. 打开首选的 API 测试工具并创建新的 HTTP 查询。

8. Change the HTTP method to POST.

9. 输入以下 URL。 将 {tenantID} 替换为租户 ID。

   https://login.microsoftonline.com/{tenantID}/oauth2/v2.0/token
   

10. Under the Body, select form-data and add the following keys:

    Key	Value
    grant_type	client_credentials
    client_id	The Client ID of your application.
    client_secret	The Client Secret of your application.
    scope	应用程序的应用程序 ID URI，然后添加 。.default 例如： api://contoso.azurewebsites.net/aaaabbbb-0000-cccc-1111-dddd2222eeee/.default

11. 运行 HTTP 查询，并将 access_token 复制到 https://jwt.ms Web 应用中。

12. 将 iss 与在 API 中配置的颁发者名称进行比较。

13. 将 aud 与在 API 中配置的客户端 ID 进行比较。