Question

我想要的是能够从Hotmail检索电子邮件，我认为这很容易。

我已经研究过如何通过OAuth从Hotmail检索电子邮件，但是现在我走到了尽头。

这是我首选的体系结构：

我现在知道的是：

我需要使用Microsoft Graph来检索用户的电子邮件
我需要在WebApi项目中使用OBO（代表）流来获取访问令牌并执行操作

将有2个项目：

1个WebApi，用于处理从Hotmail，Gmail等中检索到的电子邮件。 1个用于Web UI的WebApp SPA（React.js）

我基本上浏览了所有相关的Microsoft文档（例如Microsoft Identity Platform，MSAL.NET），并找到了我认为与我的项目有关的以下两个演示项目：

在SPA上，当我运行其演示项目（已在配置中替换了Application ID）时，我发现该演示项目仅在Edge中有效（仅登录用户部件有效），甚至在Firefox。

我搜索了错误消息，但是没有运气。

我已经提出了解决方案的思路。

更新1：

我尝试使用此react + Asp.Net Core project作为示例。我同时运行了asp.net webapi runnint和Reactjs前端：但是reactjs应用程序始终显示以下内容：

这是Reactjs应用程序地址栏中的网址：

https://login.microsoftonline.com/02xxxxxxx/oauth2/authorize?response_type=id_token&client_id=02xxxx&redirect_uri=https%3A%2F%2Flocalhost%3A3000&state=3b3e49f5-3fff-4249-b3ee-e4f28a87b3dd&client-request-id=2063333f-7dab-4afe-9922-4fe2909ccf37&x-client-SKU=Js&x-client-Ver=1.0.17&nonce=51c7f91f-1c87-4d4b-808b-082433370b39

这是My Asp.Net Core WebApi（Papayee）和Reactjs客户端（PapayeeClient）的清单

收款人：

{
    "id": "22xxxx",
    "acceptMappedClaims": null,
    "accessTokenAcceptedVersion": 2,
    "addIns": [],
    "allowPublicClient": false,
    "appId": "28xxx12",
    "appRoles": [],
    "oauth2AllowUrlPathMatching": true,
    "createdDateTime": "2020-04-03T03:59:12Z",
    "groupMembershipClaims": null,
    "identifierUris": [
        "https://papayee008.onmicrosoft.com/papayee008"
    ],
    "informationalUrls": {
        "termsOfService": null,
        "support": null,
        "privacy": null,
        "marketing": null
    },
    "keyCredentials": [],
    "knownClientApplications": [],
    "logoUrl": null,
    "logoutUrl": "https://localhost:44321/signout-oidc",
    "name": "Papayee",
    "oauth2AllowIdTokenImplicitFlow": true,
    "oauth2AllowImplicitFlow": true,
    "oauth2Permissions": [
        {
            "adminConsentDescription": "Allow Papayee to access user's emails for filtering billing emails",
            "adminConsentDisplayName": "Papayee User Impersonation",
            "id": "20xxx7a",
            "isEnabled": true,
            "lang": null,
            "origin": "Application",
            "type": "User",
            "userConsentDescription": "Allow Papayee to access user's emails for filtering billing emails",
            "userConsentDisplayName": "Papayee",
            "value": "user_impersonation"
        },
        {
            "adminConsentDescription": "This is used to retrieve your emails and find your bills",
            "adminConsentDisplayName": "Access Papayee as a user",
            "id": "98xxx15a",
            "isEnabled": true,
            "lang": null,
            "origin": "Application",
            "type": "User",
            "userConsentDescription": "This is used to retrieve your emails and find your bills",
            "userConsentDisplayName": "Access Papayee as a user",
            "value": "access_as_user"
        }
    ],
    "oauth2RequirePostResponse": false,
    "optionalClaims": {
        "idToken": [],
        "accessToken": [],
        "saml2Token": []
    },
    "orgRestrictions": [],
    "parentalControlSettings": {
        "countriesBlockedForMinors": [],
        "legalAgeGroupRule": "Allow"
    },
    "passwordCredentials": [
        {
            "customKeyIdentifier": null,
            "endDate": "2021-04-03T06:44:48.449Z",
            "keyId": "c0xxx110",
            "startDate": "2020-04-03T06:45:01.778Z",
            "value": null,
            "createdOn": "2020-04-03T06:45:10.0053885Z",
            "hint": "7uu",
            "displayName": "papayee"
        }
    ],
    "preAuthorizedApplications": [],
    "publisherDomain": "papayee008.onmicrosoft.com",
    "replyUrlsWithType": [
        {
            "url": "https://localhost:3000",
            "type": "Web"
        },
        {
            "url": "https://localhost:44302/",
            "type": "Web"
        },
        {
            "url": "https://localhost:44302/signin-oidc",
            "type": "Web"
        },
        {
            "url": "https://localhost:44351",
            "type": "Web"
        },
        {
            "url": "http://localhost:5000/",
            "type": "Web"
        },
        {
            "url": "https://localhost:5001/",
            "type": "Web"
        },
        {
            "url": "https://localhost:8666",
            "type": "Web"
        },
        {
            "url": "https://localhost:44394/",
            "type": "InstalledClient"
        },
        {
            "url": "https://login.microsoftonline.com/common/oauth2/nativeclient",
            "type": "InstalledClient"
        },
        {
            "url": "https://localhost",
            "type": "Web"
        },
        {
            "url": "https://localhost:44394/signin-oidc",
            "type": "Web"
        },
        {
            "url": "https://localhost:44394",
            "type": "Web"
        }
    ],
    "requiredResourceAccess": [
        {
            "resourceAppId": "28xxxx12",
            "resourceAccess": [
                {
                    "id": "98xxxx5a",
                    "type": "Scope"
                },
                {
                    "id": "20xxxx7a",
                    "type": "Scope"
                }
            ]
        },
        {
            "resourceAppId": "0fxxxxa0",
            "resourceAccess": [
                {
                    "id": "1fxxx6a",
                    "type": "Scope"
                }
            ]
        },
        {
            "resourceAppId": "00xxx00",
            "resourceAccess": [
                {
                    "id": "18xxx10",
                    "type": "Scope"
                },
                {
                    "id": "3bxxxd5",
                    "type": "Scope"
                }
            ]
        },
        {
            "resourceAppId": "00xxx00",
            "resourceAccess": [
                {
                    "id": "64xxxd0",
                    "type": "Scope"
                },
                {
                    "id": "74xxx82",
                    "type": "Scope"
                },
                {
                    "id": "37xxx6e",
                    "type": "Scope"
                },
                {
                    "id": "14xxxc1",
                    "type": "Scope"
                },
                {
                    "id": "5cxxx65",
                    "type": "Scope"
                },
                {
                    "id": "57xxxca",
                    "type": "Scope"
                },
                {
                    "id": "02xxx73",
                    "type": "Scope"
                },
                {
                    "id": "e1xxxx3d",
                    "type": "Scope"
                },
                {
                    "id": "b4xxx4c",
                    "type": "Scope"
                }
            ]
        }
    ],
    "samlMetadataUrl": null,
    "signInUrl": null,
    "signInAudience": "AzureADandPersonalMicrosoftAccount",
    "tags": [],
    "tokenEncryptionKeyId": null
}

这是PapayeeClient的清单

{
    "id": "59xxxxe9",
    "acceptMappedClaims": null,
    "accessTokenAcceptedVersion": 2,
    "addIns": [],
    "allowPublicClient": null,
    "appId": "02xxx60",
    "appRoles": [],
    "oauth2AllowUrlPathMatching": false,
    "createdDateTime": "2020-04-13T22:34:14Z",
    "groupMembershipClaims": null,
    "identifierUris": [],
    "informationalUrls": {
        "termsOfService": null,
        "support": null,
        "privacy": null,
        "marketing": null
    },
    "keyCredentials": [],
    "knownClientApplications": [],
    "logoUrl": null,
    "logoutUrl": null,
    "name": "PapayeeClient",
    "oauth2AllowIdTokenImplicitFlow": true,
    "oauth2AllowImplicitFlow": true,
    "oauth2Permissions": [],
    "oauth2RequirePostResponse": false,
    "optionalClaims": null,
    "orgRestrictions": [],
    "parentalControlSettings": {
        "countriesBlockedForMinors": [],
        "legalAgeGroupRule": "Allow"
    },
    "passwordCredentials": [],
    "preAuthorizedApplications": [],
    "publisherDomain": "papayee008.onmicrosoft.com",
    "replyUrlsWithType": [
        {
            "url": "https://localhost:3000/",
            "type": "Web"
        },
        {
            "url": "https://localhost:8080/",
            "type": "Web"
        }
    ],
    "requiredResourceAccess": [
        {
            "resourceAppId": "28xxx12",
            "resourceAccess": [
                {
                    "id": "98xxx5a",
                    "type": "Scope"
                },
                {
                    "id": "20xxx7a",
                    "type": "Scope"
                }
            ]
        },
        {
            "resourceAppId": "00xxx00",
            "resourceAccess": [
                {
                    "id": "64xxxd0",
                    "type": "Scope"
                },
                {
                    "id": "74xxx82",
                    "type": "Scope"
                },
                {
                    "id": "37xxxx6e",
                    "type": "Scope"
                },
                {
                    "id": "14xxxc1",
                    "type": "Scope"
                },
                {
                    "id": "57xxxxca",
                    "type": "Scope"
                },
                {
                    "id": "02xxx73",
                    "type": "Scope"
                },
                {
                    "id": "e1xxxxx3d",
                    "type": "Scope"
                }
            ]
        }
    ],
    "samlMetadataUrl": null,
    "signInUrl": null,
    "signInAudience": "AzureADandPersonalMicrosoftAccount",
    "tags": [],
    "tokenEncryptionKeyId": null
}

Answer 1

您的体系结构是完全正确的。您的方案是客户端调用您的 webapi服务器-> webapi服务器调用 Microsoft Graph API 。

以下是对您的项目有帮助的示例：

A memo on how to implement Azure AD authentication using React and .NET Core

Call a downstream web API (Microsoft Graph) from a web API secured with the Microsoft identity platform (Azure Active Directory) using the On-Behalf-Of flow

使用Microsoft Identity Platform和MSAL.NET从Hotmail代表用户流检索电子邮件

1 个答案: