应用程序“”未配置为多租户应用程序

我正在尝试开发单租户应用程序，但登录时收到以下错误消息：

“应用程序“（应用程序 ID）”未配置为多租户应用程序。“2018 年 10 月 15 日”之后创建的此类应用程序不支持使用 /common 端点。使用特定于租户的端点或配置应用程序成为多租户。”

1. 我在 Azure AD 门户中的“应用程序注册”=>“身份验证”=>“支持的帐户类型”部分下验证了“仅限此组织目录中的帐户（仅限###### - 单个租户）”选项已被选择。

2. 然后我在我的代码中确定了 'https://login.microsoftonline.com/ https://login.microsoftonline.com/{tenantID}'端点正在使用中。换句话说，代码中的任何地方都没有提到“/common”端点。

    Private Shared appId As String = ConfigurationManager.AppSettings("ida:ClientId")
    Private Shared appSecret As String = ConfigurationManager.AppSettings("ida:ClientSecret")
    Private Shared redirectUri As String = ConfigurationManager.AppSettings("ida:PostLogoutRedirectUri")
    Private Shared graphScopes As String = ConfigurationManager.AppSettings("ida:AppScopes")
    Private Shared sAzureAdInstance As String = "https://login.microsoftonline.com/"
    Private Shared sTenant As String = ConfigurationManager.AppSettings("ida:TenantId")
    Private Shared sAuthority As String = sAzureAdInstance & sTenant

    Public Sub ConfigureAuth(ByVal app As IAppBuilder)
app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType)
        app.UseCookieAuthentication(New CookieAuthenticationOptions())
        app.UseOpenIdConnectAuthentication(New OpenIdConnectAuthenticationOptions With {
            .ClientId = appId,
            .Scope = $"openid email profile offline_access {graphScopes}",
**            .Authority = sAuthority, **
            .RedirectUri = redirectUri,
            .PostLogoutRedirectUri = redirectUri,
            .TokenValidationParameters = New TokenValidationParameters With {
                .ValidateIssuer = False
            },
            .Notifications = New OpenIdConnectAuthenticationNotifications With {
                .AuthenticationFailed = AddressOf OnAuthenticationFailedAsync,
                .AuthorizationCodeReceived = AddressOf OnAuthorizationCodeReceivedAsync,
            }
        })

    End Sub

我希望我的应用程序能够在单租户模式下运行。我无法找到与此问题相关的有意义的文档。

EDIT:

我已经在代码中隔离了错误的方法，以下代码片段显示了其上下文：

Dim signedInUser = New ClaimsPrincipal(notification.AuthenticationTicket.Identity)
Dim idClient As IConfidentialClientApplication = ConfidentialClientApplicationBuilder.Create(appId).WithRedirectUri(redirectUri).WithClientSecret(appSecret).Build()
Dim scopes As String() = graphScopes.Split(" "c)
'NOTE:  The scopes string array contains the following two values: User.Read and Calendars.Read.
Dim authResult = Await idClient.AcquireTokenByAuthorizationCode(scopes, notification.Code).ExecuteAsync()
'EXECUTION HALTS HERE

我无法辨别之间的相关性通过授权代码获取令牌()方法和错误信息。我不太清楚可能出了什么问题。

非常感谢任何帮助。

我对vb不是很熟悉，但是参考c#代码，可以手动指定Authority：

app.UseOpenIdConnectAuthentication(
    new OpenIdConnectAuthenticationOptions
    {
        // The `Authority` represents the v2.0 endpoint - https://login.microsoftonline.com/common/v2.0
        Authority = Globals.Authority,
        ClientId = Globals.ClientId,
        RedirectUri = Globals.RedirectUri,
        PostLogoutRedirectUri = Globals.RedirectUri,
        Scope = Globals.BasicSignInScopes + " Mail.Read", // a basic set of permissions for user sign in & profile access "openid profile offline_access"
        TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = false,
            // In a real application you would use IssuerValidator for additional checks, like making sure the user's organization has signed up for your app.
            //     IssuerValidator = (issuer, token, tvp) =>
            //     {
            //        //if(MyCustomTenantValidation(issuer))
            //        return issuer;
            //        //else
            //        //    throw new SecurityTokenInvalidIssuerException("Invalid issuer");
            //    },
            //NameClaimType = "name",
        },
        Notifications = new OpenIdConnectAuthenticationNotifications()
        {
            AuthorizationCodeReceived = OnAuthorizationCodeReceived,
            AuthenticationFailed = OnAuthenticationFailed,
        }
    });

看起来https://login.microsoftonline.com/common/v2.0将默认使用。所以你可以将值更改为https://login.microsoftonline.com/{your_tenant}/v2.0

Update:

您可以创建一个新的 vb Web 项目，并选择使用 Azure AD 单租户身份验证。

然后你会得到一个可行的样本：

Partial Public Class Startup
    Private Shared clientId As String = ConfigurationManager.AppSettings("ida:ClientId")
    Private Shared aadInstance As String = EnsureTrailingSlash(ConfigurationManager.AppSettings("ida:AADInstance"))
    Private Shared tenantId As String = ConfigurationManager.AppSettings("ida:TenantId")
    Private Shared postLogoutRedirectUri As String = ConfigurationManager.AppSettings("ida:PostLogoutRedirectUri")
    Private Shared authority As String = aadInstance & tenantId

    Public Sub ConfigureAuth(app As IAppBuilder)
        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType)

        app.UseCookieAuthentication(New CookieAuthenticationOptions())

        app.UseOpenIdConnectAuthentication(New OpenIdConnectAuthenticationOptions() With {
            .ClientId = clientId,
            .Authority = authority,
            .PostLogoutRedirectUri = postLogoutRedirectUri
        })
    End Sub
*
*
End Class

还支持指定权限。并且可以看到已经设置为aadInstance&tenantId

如果要使用 Azure AD v2，则需要使用 v2.0 终结点。