Question

我目前正在构建一个托管在azure上的mvc5应用程序，它将通过WPF应用程序使用。

由于我需要检查用户组成员身份，因此我按照本文中的指导实施了图API：https://azure.microsoft.com/fr-fr/documentation/samples/active-directory-dotnet-graphapi-web/

它工作得很好但是在用户登录访问以下控制器后的某个时间引发访问被拒绝错误：

public async Task<ActionResult> Index()
    {

        string uID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value;
        ActiveDirectoryClient client = AuthenticationHelper.GetActiveDirectoryClient();
        IUser adUser = client.Users.Where(u => u.ObjectId == uID).ExecuteAsync().Result.CurrentPage.SingleOrDefault();

        IList<Group> groupMembership = new List<Group>();

        var userFetcher = (IUserFetcher)adUser;

        IPagedCollection<IDirectoryObject> pagedCollection = await userFetcher.MemberOf.ExecuteAsync();
        do
        {
            List<IDirectoryObject> directoryObjects = pagedCollection.CurrentPage.ToList();
            foreach (IDirectoryObject directoryObject in directoryObjects)
            {
                if (directoryObject is Group)
                {
                    var group = directoryObject as Group;
                    groupMembership.Add(group);
                }
            }
            pagedCollection = await pagedCollection.GetNextPageAsync();
        } while (pagedCollection != null);

        ViewBag.User = adUser.UserPrincipalName;
        ViewBag.UserDN = adUser.DisplayName;
        ViewBag.UserGN = adUser.GivenName;
        ViewBag.UserMail = adUser.Mail;
        ViewBag.UserSN = adUser.Surname;

        return View(groupMembership);
    }

GetActiveDirectoryClient（）引发异常，此方法的代码是链接中文章的严格复制/粘贴，如下所示：

internal class AuthenticationHelper
{
    public static string token;

    /// <summary>
    ///     Async task to acquire token for Application.
    /// </summary>
    /// <returns>Async Token for application.</returns>
    public static async Task<string> AcquireTokenAsync()
    {
        if (token == null || token.IsEmpty())
        {
            throw new Exception("Authorization Required. ");
        }
        return token;
    }

    /// <summary>
    ///     Get Active Directory Client for Application.
    /// </summary>
    /// <returns>ActiveDirectoryClient for Application.</returns>
    public static ActiveDirectoryClient GetActiveDirectoryClient()
    {
        Uri baseServiceUri = new Uri(Constants.ResourceUrl);
        ActiveDirectoryClient activeDirectoryClient =
            new ActiveDirectoryClient(new Uri(baseServiceUri, Constants.TenantId), async () => await AcquireTokenAsync());
        return activeDirectoryClient;

    }
}

此代码在用户登录后正常运行，但在某些时候令牌变为空，因此引发了异常。

我猜这与某些过期时间有关，那么有没有办法在令牌上设置一些自动刷新？

谢谢！

Answer 1

感谢您的回答，我还没有像我希望的那样设置[授权]标签作为Azure AD组成员资格，以授予对控制器的访问权限，而且还没有想出如何实现它：）

似乎将身份验证应用于authenticationHelper解决了这个问题：

public static ActiveDirectoryClient GetActiveDirectoryClient()
    {
        Uri baseServiceUri = new Uri(Constants.ResourceUrl);
        string userObjectID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value;
        AuthenticationContext authContext = new AuthenticationContext(Authority, new NaiveSessionCache(userObjectID));
        ClientCredential credential = new ClientCredential(clientId, appKey);

        ActiveDirectoryClient activeDirectoryClient = new ActiveDirectoryClient(new Uri(baseServiceUri, Constants.TenantId), async () =>
        {
            var result = await authContext.AcquireTokenSilentAsync(graphUrl, credential, new UserIdentifier(userObjectID, UserIdentifierType.UniqueId));

            return result.AccessToken;
        });

        return activeDirectoryClient;

    }

我不知道这是否是干净利落的方式，至少它是否有效。

mvc azure广告代码到期

1 个答案: