c# - .NET Core : Calling DownstreamApi.CallApiForUserAsync with non-default authentication scheme - Stack Overflow

admin管理员组

文章数量:1245119

I am adding Entra ID authentication to an existing ASP.NET Core web app and Web API with standard identity authentication.

Authentication is working. Calling a method on my API using DownstreamApi.CallApiForUserAsync is also working, but only if I set OpenId Connect as the default auth scheme.

When it is not the default auth scheme, then I get an error

Cannot determine the cloud Instance. The provided authentication scheme was ''. Microsoft.Identity.Web inferred 'Identity.Application' as the authentication scheme.

How do I specify the authentication scheme?

Relevant code (with variable and method names changed) - Startup:

builder.Services.AddAuthentication(/*OpenIdConnectDefaults.AuthenticationScheme*/)      
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"))
    .EnableTokenAcquisitionToCallDownstreamApi(         
        builder.Configuration.GetSection("X:Scopes").Get<string[]>()
    )
    .AddInMemoryTokenCaches()
    .AddDownstreamApi("X", builder.Configuration.GetSection("X"));

Controller method calling API:

[Authorize(AuthenticationSchemes = OpenIdConnectDefaults.AuthenticationScheme)]
[AuthorizeForScopes(ScopeKeySection = "X:Scopes")]
public async Task<string> GetSomething()
{
    HttpResponseMessage response = await _downstreamApi.CallApiForUserAsync("X", options =>
    {
        options.RelativePath = "path/Something";
    }); 
    ...
}

If the parameter is provided in the call to AddAuthentication, it works, if not, I get the error mentioned above.

I am adding Entra ID authentication to an existing ASP.NET Core web app and Web API with standard identity authentication.

Authentication is working. Calling a method on my API using DownstreamApi.CallApiForUserAsync is also working, but only if I set OpenId Connect as the default auth scheme.

When it is not the default auth scheme, then I get an error

Cannot determine the cloud Instance. The provided authentication scheme was ''. Microsoft.Identity.Web inferred 'Identity.Application' as the authentication scheme.

How do I specify the authentication scheme?

Relevant code (with variable and method names changed) - Startup:

builder.Services.AddAuthentication(/*OpenIdConnectDefaults.AuthenticationScheme*/)      
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"))
    .EnableTokenAcquisitionToCallDownstreamApi(         
        builder.Configuration.GetSection("X:Scopes").Get<string[]>()
    )
    .AddInMemoryTokenCaches()
    .AddDownstreamApi("X", builder.Configuration.GetSection("X"));

Controller method calling API:

[Authorize(AuthenticationSchemes = OpenIdConnectDefaults.AuthenticationScheme)]
[AuthorizeForScopes(ScopeKeySection = "X:Scopes")]
public async Task<string> GetSomething()
{
    HttpResponseMessage response = await _downstreamApi.CallApiForUserAsync("X", options =>
    {
        options.RelativePath = "path/Something";
    }); 
    ...
}

If the parameter is provided in the call to AddAuthentication, it works, if not, I get the error mentioned above.

• c#
• asp-core
• authentication

Share Improve this question Follow edited Feb 17 at 16:51 marc_s 755k184184 gold badges1.4k1.4k silver badges1.5k1.5k bronze badges asked Feb 17 at 16:16 GregGreg 322 bronze badges New contributor Greg is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct. 2

• What does your appsettings.json look like? – Conrad Lotz Commented Feb 17 at 17:00
• The Microsoft.Identity.Web package is a Microsoft specific client built on top on the ASP.NET Core OpenID Connect client with some changes to the default client. Microsoft Entra ID is an implementation of OpenId Connect. Please see this link for more info on this package: learn.microsoft/en-us/aspnet/core/security/authentication/…. – SoftwareDveloper Commented Feb 17 at 19:14

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 0

You could read this document for Microsoft.Identity.Web it requires OpenIdConnectDefaults.AuthenticationScheme as parameter

services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)

If you want to specify the authentication scheme,you may try:

services.AddAuthentication("MyAuthenticationScheme")
              .AddMicrosoftIdentityWebApp(Configuration, 
                 openIdConnectAuthenticationScheme: "MyAuthenticationScheme");

本文标签： cNET CoreCalling DownstreamApiCallApiForUserAsync with nondefault authentication schemeStack Overflow