Question

使用Microsoft Graph API时遇到问题。每当我尝试获取日历时，都会收到以下错误消息：

抛出异常：'Microsoft.Graph.ServiceException' System.Private.CoreLib.dll：'代码：BadRequest消息：当前经过身份验证的上下文对此请求无效

起初，我认为它类似于this帖子，但我的用户已经过身份验证，所以我认为情况并非如此。

这是我的代码：

EventController.cs

public async Task<Calendar> GetEventInfoAsync()
    {
        var accessToken = await getAcessTokenAsync();
        DelegateAuthenticationProvider delegateAuthenticationProvider = new DelegateAuthenticationProvider(
            (requestMessage) => 
            {
                requestMessage.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
                return Task.FromResult(0);
            }
        );
        GraphServiceClient graphClient = new GraphServiceClient(delegateAuthenticationProvider);
        var calendar = await graphClient.Me.Calendar.Request().GetAsync();
        return calendar;
    }

这就是我获取访问令牌的方式：

public async Task<string> getAcessTokenAsync()
    {
        if(User.Identity.IsAuthenticated)
        {
            var userId = User.FindFirst("MicrosoftUserId")?.Value;
            ConfidentialClientApplication cca =
                new ConfidentialClientApplication( Configuration["MicrosoftAuth:ClientId"],
                                                    String.Format(System.Globalization.CultureInfo.InvariantCulture, "https://login.microsoftonline.com/{0}{1}", "common", "/v2.0"),
                                                    Configuration["MicrosoftAuth:RedirectUri"]+ "signin-oidc", 
                                                    new Microsoft.Identity.Client.ClientCredential(Configuration["MicrosoftAuth:ClientSecret"]),
                                                    new SessionTokenCache(userId,_memoryCache).GetCacheInstance(),
                                                    null);               
            var token = await cca.AcquireTokenForClientAsync(new string[]{"https://graph.microsoft.com/.default"});
            return token.AccessToken;
        }
        else
            throw new Exception("User is not autenticated");
    }

最后，这是验证选项在启动文件中的外观。

services.AddAuthentication().AddOpenIdConnect(openIdOptions => 
        {
            openIdOptions.ResponseType = OpenIdConnectResponseType.CodeIdToken;
            openIdOptions.Authority = String.Format(CultureInfo.InvariantCulture, "https://login.microsoftonline.com/{0}{1}", "common", "/v2.0");
            openIdOptions.ClientId = Configuration["MicrosoftAuth:ClientId"];
            openIdOptions.ClientSecret = Configuration["MicrosoftAuth:ClientSecret"];
            openIdOptions.SaveTokens = true;
            openIdOptions.TokenValidationParameters = new TokenValidationParameters{
                ValidateIssuer = false
            };
            var scopes = Configuration["MicrosoftAuth:Scopes"].Split(' ');
                foreach (string scope in scopes){
                    openIdOptions.Scope.Add(scope);
            }
            openIdOptions.Events = new OpenIdConnectEvents{
                OnAuthorizationCodeReceived = async (context) =>
                {   
                    var userId = context.Principal.Claims.First(item => item.Type == ObjectIdentifierType).Value;
                    IMemoryCache memoryCache = context.HttpContext.RequestServices.GetRequiredService<IMemoryCache>();
                    ConfidentialClientApplication cca =
                        new ConfidentialClientApplication( Configuration["MicrosoftAuth:ClientId"],
                                                            String.Format(CultureInfo.InvariantCulture, "https://login.microsoftonline.com/{0}{1}{2}", "common", "/v2.0", "/adminconsent"),
                                                            Configuration["MicrosoftAuth:RedirectUri"]+ "signin-oidc", 
                                                            new Microsoft.Identity.Client.ClientCredential(Configuration["MicrosoftAuth:ClientSecret"]),
                                                            new SessionTokenCache(userId,memoryCache).GetCacheInstance(),
                                                            null);
                    var code = context.ProtocolMessage.Code;                        
                    var result = await cca.AcquireTokenByAuthorizationCodeAsync(code,new string[]{"User.Read.All", "Calendars.ReadWrite"});
                    context.HandleCodeRedemption(result.AccessToken, result.IdToken);
                },
            };
        });

我的应用程序已在Microsoft应用程序注册门户中注册，当我请求时，我确实收到了令牌，因此我不确定可能导致问题的原因。

Answer 1

预览帖子的问题相同。 Azure AD发布了两种令牌，代表使用或应用。您获得的令牌是使用客户端凭据流程，该流程是应用程序的委托。当您请求使用此类令牌时，没有me上下文（请参阅Get access on behalf of a user和Get access without a user了解差异）。

要将Microsoft Graph与Web应用集成并委派用户调用Microsoft Graph，您需要在{{{{ 1}}文件。

Microsoft.Graph.ServiceException'代码：BadRequest消息：当前经过身份验证的上下文对此请求无效

1 个答案: