如何从 MS Graph 获取用户的基本信息 API

Question

我正在尝试使用 MS Graph API 获取用户的全名。在使用 User.Read.All

的 App 权限时，代码无法使用委派权限 User.ReadBasic.All

代码是：

public static async Task<string> GetAccessToken()
    {
        string authorityUri = $"https://login.microsoftonline.com/{tenantid}";
        AuthenticationContext authContext = new AuthenticationContext(authorityUri);

        string resourceUrl = "https://graph.microsoft.com";

        ClientCredential creds = new ClientCredential(ConfigHelper.ClientId, ConfigHelper.AppKey);
        AuthenticationResult authResult = await authContext.AcquireTokenAsync(resourceUrl, creds);

        return authResult.AccessToken;
    }

public static async Task<GraphServiceClient> GetGraphClient()
    {
        GraphServiceClient graphServiceClient = new GraphServiceClient(new DelegateAuthenticationProvider(
                                                    async (requestMessage) =>
                                                    {
                                                        string accessToken = await GetAccessToken();
                                                        if (!string.IsNullOrEmpty(accessToken))
                                                        {
                                                            requestMessage.Headers.Authorization = new AuthenticationHeaderValue("bearer", accessToken);
                                                        }
                                                    }));

        return graphServiceClient;
    }

错误是

Microsoft.Graph.ServiceException: Code: Authorization_RequestDenied Message: Insufficient privileges to complete the operation. Blockquote

我不确定为什么会这样。

已编辑：

private static async Task<string> GetAccessToken()
    {
        string signedInUserID = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
        string tenantID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value;
        string userObjectID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value;
        string resourceUrl = "https://graph.microsoft.com";

        //// get a token for the Graph without triggering any user interaction (from the cache, via multi-resource refresh token, etc)
        ClientCredential clientcred = new ClientCredential(ConfigHelper.ClientId, ConfigHelper.AppKey);
        //// initialize AuthenticationContext with the token cache of the currently signed in user, as kept in the app's database
        AuthenticationContext authenticationContext = new AuthenticationContext($"https://login.microsoftonline.com/{tenantid}") ;
        AuthenticationResult authenticationResult = await authenticationContext.AcquireTokenSilentAsync(resourceUrl, clientcred, new UserIdentifier(userObjectID, UserIdentifierType.UniqueId));
        return authenticationResult.AccessToken;
    }

Answer 1

好吧，您正在使用 Client Credentials Grant Flow，希望将委派权限应用于没有用户的场景。

您获得的令牌是针对纯粹作为自身运行的应用程序，这意味着只会应用应用程序权限。委派权限仅在存在用户上下文时应用。

您的选择：

使用应用程序权限
使用授权代码授予流程之类的流程来获取委托访问令牌
- 当您以这种方式获得令牌时，您也会获得一个刷新令牌，您可以随时使用它为该用户获取一个新的访问令牌（+一个新的刷新令牌）
- 尽管某些情况（例如用户重置密码）会导致刷新令牌被撤销

如何从 MS Graph 获取用户的基本信息 API

How to get user's basic details from MS Graph API

azure

azure-active-directory

adal

microsoft-graph-api