运行自动集成测试

设置 appsettings.json 文件

将之前创建的测试应用的客户端 ID、必需的范围以及密钥保管库 URI 添加到测试项目的 appsettings.json 文件中。

{
  "Authentication": {
    "AzureCloudInstance": "AzureChina", 
    "AadAuthorityAudience": "AzureAdMultipleOrgs",
    "ClientId": <your_client_ID>
  },

  "WebAPI": {
    "Scopes": [
      //For this Microsoft Graph example.  Your value(s) will be different depending on the API you're calling
      "https://microsoftgraph.chinacloudapi.cn/User.Read",
      //For this Microsoft Graph example.  Your value(s) will be different depending on the API you're calling
      "https://microsoftgraph.chinacloudapi.cn/User.ReadBasic.All"
    ]
  },

  "KeyVault": {
    "KeyVaultUri": "https://<your-unique-keyvault-name>.vault.azure.cn//"
  }
}

将客户端设置为在所有测试类中使用

使用 SecretClient() 从 Azure Key Vault 获取测试用户名和密码机密。 该代码会使用指数退避，以便在 Key Vault 受到限制的情况下进行重试。

DefaultAzureCredential() 通过从环境变量配置的服务主体获取的访问令牌或通过托管标识（如果代码在具有托管标识的 Azure 资源上运行）向 Azure Key Vault 进行身份验证。 如果代码在本地运行，DefaultAzureCredential 便会使用本地用户的凭据。 请在 Azure Identity 客户端库内容中了解详细信息。

使用 Microsoft 身份验证库 (MSAL) 来通过 ROPC 流进行身份验证并获取访问令牌。 访问令牌在 HTTP 请求中作为持有者令牌进行传递。

using Xunit;
using System.Threading.Tasks;
using Microsoft.Identity.Client;
using System.Security;
using System.Net;
using System.Net.Http;
using System.Net.Http.Headers;
using Microsoft.Extensions.Configuration;
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
using Azure.Core;
using System;

public class ClientFixture : IAsyncLifetime
{
    public HttpClient httpClient;

    public async Task InitializeAsync()
    {
        var builder = new ConfigurationBuilder().AddJsonFile("<path-to-json-file>");

        IConfigurationRoot Configuration = builder.Build();

        var PublicClientApplicationOptions = new PublicClientApplicationOptions();
        Configuration.Bind("Authentication", PublicClientApplicationOptions);
        var app = PublicClientApplicationBuilder.CreateWithApplicationOptions(PublicClientApplicationOptions)
            .Build();

        SecretClientOptions options = new SecretClientOptions()
        {
            Retry =
                {
                    Delay= TimeSpan.FromSeconds(2),
                    MaxDelay = TimeSpan.FromSeconds(16),
                    MaxRetries = 5,
                    Mode = RetryMode.Exponential
                 }
        };

        string keyVaultUri = Configuration.GetValue<string>("KeyVault:KeyVaultUri");
        var client = new SecretClient(new Uri(keyVaultUri), new DefaultAzureCredential(), options);

        KeyVaultSecret userNameSecret = client.GetSecret("TestUserName");
        KeyVaultSecret passwordSecret = client.GetSecret("TestPassword");

        string password = passwordSecret.Value;
        string username = userNameSecret.Value;
        string[] scopes = Configuration.GetSection("WebAPI:Scopes").Get<string[]>();
        SecureString securePassword = new NetworkCredential("", password).SecurePassword;

        AuthenticationResult result = null;
        httpClient = new HttpClient();

        try
        {
            result = await app.AcquireTokenByUsernamePassword(scopes, username, securePassword)
                .ExecuteAsync();
        }
        catch (MsalException) { }

        string accessToken = result.AccessToken;
        httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("bearer", accessToken);
    }

    public Task DisposeAsync() => Task.CompletedTask;
}

在测试类中使用

以下示例是调用 Microsoft Graph 的测试。 可将此测试替换为要在自己的应用程序或 API 上测试的任何内容。

public class ApiTests : IClassFixture<ClientFixture>
{
    ClientFixture clientFixture;

    public ApiTests(ClientFixture clientFixture)
    {
        this.clientFixture = clientFixture;
    }

    [Fact]
    public async Task GetRequestTest()
    {
        var testClient = clientFixture.httpClient;
        HttpResponseMessage response = await testClient.GetAsync("https://microsoftgraph.chinacloudapi.cn/v1.0/me");
        var responseCode = response.StatusCode.ToString();
        Assert.Equal("OK", responseCode);
    }
}

设置 authConfig.json 文件

将之前创建的测试应用的客户端 ID 和租户 ID、密钥保管库 URI 以及机密名称添加到测试项目的 authConfig.js 文件中。

export const msalConfig = {
    auth: {
        clientId: 'Enter_the_Application_Id_Here',
        authority: 'https://login.partner.microsoftonline.cn/Enter_the_Tenant_Id_Here',
    },
};

export const keyVaultConfig = {
    keyVaultUri: 'https://<your-unique-keyvault-name>.vault.azure.cn',
    secretName: 'Enter_the_Secret_Name',
};

初始化 MSAL.js 并从密钥保管库中提取用户凭据

通过实例化具有 Configuration 对象的 PublicClientApplication 来初始化 MSAL.js 身份验证上下文。 最少必须提供的配置属性是应用程序的 clientID。

使用 SecretClient() 从 Azure Key Vault 获取测试用户名和密码机密。

DefaultAzureCredential() 通过从环境变量配置的服务主体获取的访问令牌或通过托管标识（如果代码在具有托管标识的 Azure 资源上运行）向 Azure Key Vault 进行身份验证。 如果代码在本地运行，DefaultAzureCredential 便会使用本地用户的凭据。 请在 Azure Identity 客户端库内容中了解详细信息。

使用 Microsoft 身份验证库 (MSAL) 来通过 ROPC 流进行身份验证并获取访问令牌。 访问令牌在 HTTP 请求中作为持有者令牌进行传递。

import { test, expect } from '@playwright/test';
import { DefaultAzureCredential } from '@azure/identity';
import { SecretClient } from '@azure/keyvault-secrets';
import { PublicClientApplication, CacheKVStore } from '@azure/msal-node';
import { msalConfig, keyVaultConfig } from '../authConfig';

let tokenCache;
const KVUri = keyVaultConfig.keyVaultUri;
const secretName = keyVaultConfig.secretName;

async function getCredentials() {
    try {
        const credential = new DefaultAzureCredential();
        const secretClient = new SecretClient(KVUri, credential);
        const secret = await secretClient.getSecret(keyVaultConfig.secretName);
        const password = secret.value;
        return [secretName, password];
    } catch (error) {
        console.log(error);
    }
}

test.beforeAll(async () => {
    const pca = new PublicClientApplication(msalConfig);
    const [username, password] = await getCredentials();
    const usernamePasswordRequest = {
        scopes: ['https://microsoftgraph.chinacloudapi.cn/user.read', 'https://microsoftgraph.chinacloudapi.cn/User.ReadBasic.All'],
        username: username,
        password: password,
    };
    await pca.acquireTokenByUsernamePassword(usernamePasswordRequest);
    tokenCache = pca.getTokenCache().getKVStore();
});

运行测试套件

在同一文件中添加测试，如下所示：

/**
 * Stores the token in the session storage and reloads the page
 */
async function setSessionStorage(page, tokens) {
    const cacheKeys = Object.keys(tokens);
    for (let key of cacheKeys) {
        const value = JSON.stringify(tokenCache[key]);
        await page.context().addInitScript(
            (arr) => {
                window.sessionStorage.setItem(arr[0], arr[1]);
            },
            [key, value]
        );
    }
    await page.reload();
}

test.describe('Testing Authentication with MSAL.js ', () => {
    test('Test user has signed in successfully', async ({ page }) => {
        await page.goto('http://localhost:<port>/');
        let signInButton = page.getByRole('button', { name: /Sign In/i });
        let signOutButton = page.getByRole('button', { name: /Sign Out/i });
        let welcomeDev = page.getByTestId('WelcomeMessage');
        expect(await signInButton.count()).toBeGreaterThan(0);
        expect(await signOutButton.count()).toBeLessThanOrEqual(0);
        expect(await welcomeDev.innerHTML()).toEqual('Please sign-in to see your profile and read your mails');
        await setSessionStorage(page, tokenCache);
        expect(await signInButton.count()).toBeLessThanOrEqual(0);
        expect(await signOutButton.count()).toBeGreaterThan(0);
        expect(await welcomeDev.innerHTML()).toContain(`Welcome`);
    });
});

有关详细信息，请查看以下代码示例 MSAL.js 测试示例。