尝试激活图形 API 时无法解析类型“Microsoft.Identity.Web.ITokenAcquisition”的服务

Question

net core 2.2 项目。我正在为我的 api 实施基于组的授权。我按照https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/886f2ad2bf6add922c7998fb592e3d4088f9cf4e/5-WebApp-AuthZ/5-2-Groups来实现这一点。首先，我将https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/886f2ad2bf6add922c7998fb592e3d4088f9cf4e/Microsoft.Identity.Web添加到我的项目中。然后我开始在我的 startup.cs 中添加策略，如下所示。

services.AddAuthorization(options =>
            {
                options.AddPolicy("GroupsCheck", policy =>
                    policy.Requirements.Add(new GroupsCheckRequirement("2a39995a-8fd1-410e-99e2-11cf6046090d")));
            });

            services.AddScoped<IAuthorizationHandler, GroupsCheckHandler>();

然后我添加了 GroupsCheckHandler.cs

public class GroupsCheckHandler : AuthorizationHandler<GroupsCheckRequirement>
    {
        private readonly ITokenAcquisition tokenAcquisition;
        private readonly IMSGraphService graphService;

        public GroupsCheckHandler(ITokenAcquisition tokenAcquisition, IMSGraphService MSGraphService)
        {
            this.tokenAcquisition = tokenAcquisition;
            this.graphService = MSGraphService;
        }
        protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context,
                                                  GroupsCheckRequirement requirement)
        {
            string accessToken = await tokenAcquisition.GetAccessTokenOnBehalfOfUserAsync(new[] { Constants.ScopeUserRead, Constants.ScopeDirectoryReadAll });

            User me = await graphService.GetMeAsync(accessToken);

            IList<Group> groups = await graphService.GetMyMemberOfGroupsAsync(accessToken);

            var result = false;
            foreach (var group in groups)
            {
                if (requirement.groups.Equals(group.Id))
                {
                    result = true;
                }
            }

            if (result)
            {
                context.Succeed(requirement);
            }

        }
    }

然后我在 api 中添加了授权属性，如下所示。

[Authorize(Policy = "GroupsCheck")]
[Route("api/[controller]")]
[ApiController]

现在，每当我尝试访问任何 api 时，我都会遇到异常。

System.InvalidOperationException: Unable to resolve service for type 'Microsoft.Identity.Web.ITokenAcquisition' while attempting to activate 'LocationServicesAPI.Services.GroupsRequirements.GroupsCheckHandler'.

有人可以帮我找出这个问题的根本原因，或者如果我做错了或缺少任何配置，有人可以在这方面帮助我。任何帮助将不胜感激。谢谢

Answer 1

依赖注入正在尝试实例化 ITokenAcquisition 的实例并失败。这可能是因为 Startup.cs 中的配置存在问题。您需要确保在配置身份验证时调用EnableTokenAcquisitionToCallDownstreamApi和AddInMemoryTokenCaches。

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddMicrosoftIdentityWebApi(Configuration, "AzureAd")
                .EnableTokenAcquisitionToCallDownstreamApi()
                .AddInMemoryTokenCaches();

Answer 2

我在使用 Blazor 时遇到了几乎类似的错误，并通过将 services.AddScoped() 更改为 services.AddHttpClient() 解决了该错误