通过 Web API 而不是图形 API 重置 Azure AD 密码

Question

无法使用图表 API 更改密码

Unsupported end-user operations
    Any end user resetting their own password by using PowerShell version 1, version 2, or the Microsoft Graph API.

https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-writeback#unsupported-writeback-operations

在阅读以上内容之前，我尝试使用以下代码更改密码：

实例化 GraphServiceClient

string[] scopes = new string[] { "User.Read", "Directory.AccessAsUser.All", "User.Invite.All" };

IPublicClientApplication app = PublicClientApplicationBuilder.Create(clientId)
    .WithAuthority(authority)
    .WithTenantId(tenantId)
    .Build();

var securePassword = new SecureString();
foreach (char c in user.Password.ToCharArray())  // you should fetch the password
    securePassword.AppendChar(c);  // keystroke by keystroke

var tokens = app.AcquireTokenByUsernamePassword(scopes, user.UserName, securePassword).ExecuteAsync().Result;

graphClient = new GraphServiceClient(
    new DelegateAuthenticationProvider(x =>
    {
        x.Headers.Authorization = new AuthenticationHeaderValue(
            "Bearer", tokens.AccessToken);

        return Task.FromResult(0);
    }));

更改密码尝试：

public async Task<ActionResult> ResetPassword([FromBody] JObject data)
{
    try
    {
        await graphClient.Me
        .ChangePassword(data["currentPassword"].ToString(), data["newPassword"].ToString())
        .Request()
        .PostAsync();
...
}

允许用户重设密码的步骤是什么（programmatically/Azure 门户）？有没有其他方法可以在不使用 Graph 的情况下更改密码 API?

Answer 1

图api绝对可以重置密码：

POST https://graph.microsoft.com/v1.0/me/changePassword
Content-Type: application/json
{
  "currentPassword": "Test1234!",
  "newPassword": "Test5678!"
}

GraphServiceClient graphClient = new GraphServiceClient( authProvider );

var currentPassword = "{currentPassword}";

var newPassword = "{newPassword}";

await graphClient.Me
    .ChangePassword(currentPassword,newPassword)
    .Request()
    .PostAsync();

Answer 2

您可以使用 Graph API 重置密码。以下是要遵循的步骤。 1. 向具有适当权限的 AD 注册您的 Web 应用程序（例如，read/write 用户详细信息）。使用MFA 2.使用图形API到reset.https://docs.microsoft.com/en-us/previous-versions/azure/ad/graph/api/users-operations#ResetUserPassword.AD也可以使用passwordProfile资源类型代替。

Answer 3

我的解决方案是为 Azure AD Connect 配置帐户权限

我必须在 Azure AD Connect 中启用密码写回 ;-)

通过 Web API 而不是图形 API 重置 Azure AD 密码

Reset Azure AD password through Web API instead of Graph API

azure

asp.net-web-api

azure-active-directory

asp.net-core

microsoft-graph-api