Question

我使用以下代码获取了访问令牌来获取图形客户端：

    string graphResourceID = "https://graph.windows.net";      
    string tenantID = ConfigurationManager.AppSettings["ida:Domain"];
    string aadInstance = "https://login.microsoftonline.com/" + tenantID + 
    "/oauth2/v2.0/token";

Microsoft.IdentityModel.Clients.ActiveDirectory.ClientCredential credential = new Microsoft.IdentityModel.Clients.ActiveDirectory.ClientCredential(clientId, appKey);
AuthenticationContext authenticationContext = new AuthenticationContext(aadInstance);
authenticationContext.TokenCache.Clear();

var authResult = await authenticationContext.AcquireTokenAsync(graphResourceID,clientcred);

然后尝试使用令牌通过AD图形api获取已登录用户的信息：

Uri servicePointUri = new Uri(graphResourceID);
Uri serviceRoot = new Uri(servicePointUri, tenantID);
ActiveDirectoryClient activeDirectoryClient = new ActiveDirectoryClient(serviceRoot,async () => await GetTokenForApplication());    
var result = await activeDirectoryClient.Users.Where(u => u.ObjectId.Equals(userObjectID)).ExecuteAsync();
IUser user = result.CurrentPage.ToList().First();

return View(user);

但是，这将返回以下错误：

"error": {
"code": "Authorization_IdentityNotFound",
"message": "The identity of the calling application could not be established.",
"innerError": {
"request-id": "2bdae8ff-d935-4e01-80a1-78cbc8acf4de",
"date": "2017-08-09T18:07:40"

我确保mu B2C应用程序对Windows Active Directory具有“读取和写入目录数据”权限：

有人可以帮忙吗？坚持了一段时间。 TIA

修改

我也尝试使用Microsoft.Graph，但最终遇到相同的错误。另外，对于B2C用户，我认为最好是暂时坚持使用Azure广告图api：https://dev.office.com/blogs/microsoft-graph-or-azure-ad-graph

Answer 1

似乎您使用Azure AD库来操作Graph API。我建议您可以使用Microsoft.Graph来做到这一点。请同时使用Microsoft Graph设置权限。

注意：请不要忘记单击[授予权限]按钮。

以下是演示代码。

string graphResourceId = "https://graph.microsoft.com/";
string authority = "https://login.microsoftonline.com/{0}";
string tenantId = "tenantId";
string clientId = "client Id";
string secretKey = "secret key"
var accessToken = authContext.AcquireTokenAsync(graphResourceId, new ClientCredential(clientId,secret)).Result.AccessToken;
var graphserviceClient = new GraphServiceClient(
                new DelegateAuthenticationProvider(
                    requestMessage =>
                    {
                        requestMessage.Headers.Authorization = new AuthenticationHeaderValue("bearer", accessToken);

                        return Task.FromResult(0);
                    }));
var user = graphserviceClient.Users.Request().GetAsync().Result.FirstOrDefault();

测试结果：

更新：

我还在Azure B2c上使用Azure AD图形API进行了测试，它也可以正常工作。我还分配了[读取和写入目录数据]，然后单击没有其他权限设置的[授予权限]。

以下是我用于测试的演示代码。

 string graphResourceID = "https://graph.windows.net";
 string tenantID = "tenant Id";
 Uri servicePointUri = new Uri(graphResourceID);
 Uri serviceRoot = new Uri(servicePointUri, tenantID);
 ActiveDirectoryClient activeDirectoryClient = new ActiveDirectoryClient(serviceRoot, async () => await GetAppTokenAsync());
 var result =  activeDirectoryClient.Users.ExecuteAsync().Result;
 IUser user = result.CurrentPage.ToList().First();



 private static async Task<string> GetAppTokenAsync()
 {
        string graphResourceID = "https://graph.windows.net";
        string tenantID = "tenant id ";
        //please remove v2 from the link
        string aadInstance = "https://login.microsoftonline.com/" + tenantID +"/oauth2/token";
        var clientId = "client Id";
        var appKey = "secret key";
        // Instantiate an AuthenticationContext for my directory (see authString above).
        AuthenticationContext authenticationContext = new AuthenticationContext(aadInstance, false);
        // Create a ClientCredential that will be used for authentication.
        // This is where the Client ID and Key/Secret from the Azure Management Portal is used.
        ClientCredential clientCred = new ClientCredential(clientId, appKey);
        // Acquire an access token from Azure AD to access the Azure AD Graph (the resource)
        // using the Client ID and Key/Secret as credentials.
        AuthenticationResult authenticationResult = await authenticationContext.AcquireTokenAsync(graphResourceID, clientCred); 
        // Return the access token.
        return authenticationResult.AccessToken;
   }

测试结果：

如果它仍然对您不起作用。建议您创建一个新的Azure AD应用程序，然后重试。

Packages.config：

<?xml version="1.0" encoding="utf-8"?>
<packages>
  <package id="Microsoft.Azure.ActiveDirectory.GraphClient" version="2.1.1" targetFramework="net471" />
  <package id="Microsoft.Data.Edm" version="5.6.4" targetFramework="net471" />
  <package id="Microsoft.Data.OData" version="5.6.4" targetFramework="net471" />
  <package id="Microsoft.Data.Services.Client" version="5.6.4" targetFramework="net471" />
  <package id="Microsoft.IdentityModel.Clients.ActiveDirectory" version="3.19.8" targetFramework="net471" />
  <package id="System.Spatial" version="5.6.4" targetFramework="net471" />
</packages>

Answer 2

谢谢大家，我好像在使用用于创建B2C目录的原始目录的租户ID。因此，代码找不到我的应用程序。我必须通过单击门户右上角的switch目录，使用注册B2C应用程序的Azure B2C目录的租户ID /域名。

Azure B2C无法访问图形API

2 个答案: