Question

我正在尝试使用ADAL4J库获取Active Directory的组和角色，我所指的示例项目是 GitHub AzureAD示例项目azure-activedirectory-library-for-java。

我得到的回复是具有以下内容的令牌：

{
  "aud": "https://graph.windows.net",
  "iss": "[redacted for stackoverflow post]",
  "iat": 1474924521,
  "nbf": 1474924521,
  "exp": 1474928421,
  "appid": "MyApplicationObjectId from AD",
  "appidacr": "1",
  "e_exp": 10800,
  "idp": "[redacted for stack overflow post]",
  "oid": "68467740-2af5-43ab-8bfb-362b494956c5",
  "roles": [
    "Device.ReadWrite.All",
    "Directory.Read.All",
    "Directory.ReadWrite.All",
    "Domain.ReadWrite.All"
  ],
  "sub": "68467740-2af5-43ab-8bfb-362b494956c5",
  "tid": "e536c1ed-4822-4b88-8c01-9f14c1c583e3",
  "ver": "1.0"
}

但是，我期待访问令牌中的以下声明：

"groups": [
    "8c335044-b534-4cfa-a816-c62588ca169e",
    "68ff7ec2-db1b-45cc-afb4-785723f9a2db",
    "a79ed389-c46f-4782-9752-90f4871e4b15",
    "657b2f05-15f2-4849-a831-c42ecdf7db13"
  ],
"roles": [
    "add-or-view-org-admin"
  ],

由于我的用户尝试访问的应用程序是Web应用程序，因此我在请求中发送客户端密码，如下所示：

private static AuthenticationResult getAccessTokenFromUserCredentials(
    String username, String password) throws Exception
{
    AuthenticationContext context = null;
    AuthenticationResult result = null;
    ExecutorService service = null;
    try {
        service = Executors.newFixedThreadPool(1);
        context = new AuthenticationContext(AUTHORITY, true, service);
        ClientCredential clientCred = new ClientCredential(
            CLIENT_ID, "Client Key for my Application from Active Directory");
        Future<AuthenticationResult> future = context.acquireToken(
            "https://graph.windows.net", clientCred, null);
        result = future.get();
    } finally {
        service.shutdown();
    }
    if (result == null) {
        throw new ServiceUnavailableException(
                "authentication result was null");
    }
    return result;
}

有没有人能够使用这样的Java客户端做到这一点？

我需要使用Java，因为我需要运行相同的集成测试。

感谢任何帮助。

Answer 1

配置集成测试以获取用于访问Azure Active Directory中配置的Web应用程序的访问令牌

从https://github.com/Azure-Samples/active-directory-java-native-headless
按照README.md中的步骤操作，并允许Native Application为在AAD中配置的Web应用程序请求令牌。
单击“添加应用程序”，选择“显示所有应用程序”，单击“确定”按钮（显示勾号）并选择已注册的应用程序。
为此应用程序授予权限。（＆＃34;访问库存洞察＆＃34;）保存更改
在PublicClient.java

private final static String AUTHORITY =＆＃34; https://login.microsoftonline.com/common＆＃34;;

private final static String CLIENT_ID =＆＃34; 675a9f3e-c78a-48cc-9151-59d14ac2205b＆＃34 ;;

未来＆lt; AuthenticationResult＆GT; future = context.acquireToken （＆＃34;应用程序用户的客户端ID正在尝试访问。＆＃34;，CLIENT_ID，用户名，密码，null）;

用于访问令牌的ADAL java库不返回组和角色

1 个答案: