c# - 在 MVC Web App 中通过 ViewModel 调用 Graph API

Question

我正在尝试使用 Graph API 在我的网络应用程序的导航栏中创建我自己的“用户配置文件”部分。为此，我对 UserProfile Controller 的 GetUser 操作进行了 AJAX 调用:

        $.ajax({
        type: "GET",
        url: "@Url.Action("GetUser", "UserProfile", null)",
        dataType: "json",
        success: function (data, status, xhr) {
            console.log("in AJAX");
            $(".img-circle, .user-image").attr("src", data.Picture);
            $("#user-menu-expanded").text(data.User.DisplayName + " - " + data.User.JobTitle);
            $("#user-menu-spinner").remove();
            console.log(data);
        },
        error: function (ex) {
            console.log(ex);
            }
        });

Controller 将我的 UserProfileViewModel 作为 Json 返回，我用它来替换上述元素，如我的 AJAX 成功函数中所示。

用户配置文件 Controller :

    public JsonResult GetUser()
    {
        var model = new UserProfileViewModel();
        return Json(model, JsonRequestBehavior.AllowGet); 
    }

我的 UserProfileViewModel 看起来像这样:

    public UserProfileViewModel()
    { 
            var graphClient = GetAuthGraphClient();
            GetPicture(graphClient);
            GetUserProfile(graphClient); 
     }
    public GraphServiceClient GetAuthGraphClient()
    {
        string graphResourceID = "https://graph.microsoft.com/";

        return new GraphServiceClient(
            new DelegateAuthenticationProvider((requestMessage) =>
            {
                string accessToken =  GetTokenForApplication(graphResourceID);
                requestMessage.Headers.Authorization = new AuthenticationHeaderValue("bearer", accessToken);
                return Task.FromResult(0);
            }
            ));
    }
    public string GetTokenForApplication(string graphResourceID)
    {
        string signedInUserID = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
        string tenantID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value;
        string userObjectID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value;
        string authority = "https://login.microsoftonline.com/" + tenantID;

        try {
            ClientCredential clientcred = new ClientCredential(clientId, appKey);
            // initialize AuthenticationContext with the token cache of the currently signed in user, as kept in the app's database
            AuthenticationContext authenticationContext = new AuthenticationContext(authority);
            var token = authenticationContext.AcquireTokenAsync(graphResourceID, clientcred).Result.AccessToken;
            return token;
        }
        catch (Exception e)
        {
                // Capture error for handling outside of catch block
                ErrorMessage = e.Message;

            return null;
        }

    }
    public void GetPicture(GraphServiceClient graphClient)
    { 
        Stream photo = Task.Run(async () => { return await graphClient.Me.Photo.Content.Request().GetAsync(); }).Result;

        using (var memoryStream = new MemoryStream())
        {
            photo.CopyTo(memoryStream);
            var base64pic = Convert.ToBase64String(memoryStream.ToArray());
            this.Picture = "data:image;base64," + base64pic;
            HttpContext.Current.Cache.Add("Pic", this.Picture, null, DateTime.Now.AddHours(5), Cache.NoSlidingExpiration, CacheItemPriority.AboveNormal, null);
        }
    }

    public void GetUserProfile(GraphServiceClient graphClient)
    {       
        this.User = Task.Run(async () => { return await graphClient.Me.Request().GetAsync(); }).Result;
    }

我已成功获取访问 token ，但我的 AJAX 调用未返回任何数据。
Access Token from IIS Log Console Log

我有两个问题(可能是 3 个):

1. 我做错了什么？

2. 是否可以使用访问 token 从我的 Startup.Auth 创建一个经过身份验证的 Graph 客户端？如果是这样，我该怎么做呢？

       // This is the resource ID of the AAD Graph API.  We'll need this to request a token to call the Graph API.
       string graphResourceId = "https://graph.microsoft.com"; //https://graph.windows.net
   
       public void ConfigureAuth(IAppBuilder app)
       {
           ApplicationDbContext db = new ApplicationDbContext();
   
           app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
           app.UseKentorOwinCookieSaver();
           app.UseCookieAuthentication(new CookieAuthenticationOptions());
   
           app.UseOpenIdConnectAuthentication(
               new OpenIdConnectAuthenticationOptions
               {
                   ClientId = clientId,
                   Authority = Authority,
                   PostLogoutRedirectUri = postLogoutRedirectUri,
   
                   Notifications = new OpenIdConnectAuthenticationNotifications()
                   {
                       // If there is a code in the OpenID Connect response, redeem it for an access token and refresh token, and store those away.
                       AuthorizationCodeReceived = (context) =>
                       {
                           var code = context.Code;                            
                           ClientCredential credential = new ClientCredential(clientId, appKey);
                           string signedInUserID = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.NameIdentifier).Value;
                           AuthenticationContext authContext = new AuthenticationContext(Authority, new ADALTokenCache(signedInUserID));
                           AuthenticationResult result = authContext.AcquireTokenByAuthorizationCode(
                           code, new Uri(HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Path)), credential, graphResourceId);
                           HttpContext.Current.Cache.Add("Token", result.AccessToken, null, DateTime.Now.AddHours(5), Cache.NoSlidingExpiration, CacheItemPriority.AboveNormal, null);
   
                           return Task.FromResult(0);
                       }
                   }
               });
       }
   }
   

根据下方评论更新代码

    public string GetTokenForApplication(string graphResourceID)
    {
        string signedInUserID = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
        string tenantID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value;
        string userObjectID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value;
        string authority = "https://login.microsoftonline.com/" + tenantID;


        try {
            // get a token for the Graph without triggering any user interaction (from the cache, via multi-resource refresh token, etc)
            ClientCredential clientcred = new ClientCredential(clientId, appKey);
            // initialize AuthenticationContext with the token cache of the currently signed in user, as kept in the app's database
            AuthenticationContext authenticationContext = new AuthenticationContext(Startup.Authority, new ADALTokenCache(userObjectID));
            var result = authenticationContext.AcquireTokenSilent(graphResourceID, clientcred, new UserIdentifier(userObjectID, UserIdentifierType.UniqueId));
            return result.AccessToken;
        }
        catch (Exception e)
        {
                // Capture error for handling outside of catch block
                ErrorMessage = e.Message;

            return null;
        }

    }

更新 2:修复.. 有点

感谢@Fei Xue 我解决了这个问题..有点。这解决了我在本地运行时的问题，但在发布到我的阶段应用程序时我仍然无法静默获取 token 。当我第一次创建应用程序时，我包含了 Azure AD 的工作/学校身份验证。这创建了一个用于 ADAL token 缓存的本地数据库上下文。在开发应用程序时，我为我为应用程序创建的 Azure SQL 数据库创建了另一个数据库上下文。我必须更新我的 AdalTokenCache.cs 以反射(reflect)我的应用程序的数据库上下文和新模型。我更新了行:

private ApplicationDbContext db = new ApplicationDbContext();

使用我自己的上下文并将 UserTokenCache 模型更新为我的新上下文的 UserTokenCache 模型。在这种情况下，我改变了:

private UserTokenCache Cache;

到:

private UserTokenCach Cache;

然后我更新了 CS 的其余部分以匹配来自应用程序的数据库上下文的 UserTokenCach。

然后我只是使用 UserProfile Controller 中 OOB 中的 AcquireToken 方法来获取 token 。这就是它最终的样子(注意:我还将 startup.auth 中的字符串从私有(private)更新为公共(public)，以便我可以在我的 View 模型中使用它们):

    public string GetTokenForApplication(string graphResourceID)
    {
        string signedInUserID = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
        string tenantID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value;
        string userObjectID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value;
        string authority = "https://login.microsoftonline.com/" + tenantID;


        try {
            // get a token for the Graph without triggering any user interaction (from the cache, via multi-resource refresh token, etc)
            ClientCredential clientcred = new ClientCredential(Startup.clientId, Startup.appKey);
            // initialize AuthenticationContext with the token cache of the currently signed in user, as kept in the app's database
            AuthenticationContext authenticationContext = new AuthenticationContext(Startup.Authority, new ADALTokenCache(signedInUserID));
            var result = authenticationContext.AcquireTokenSilent(graphResourceID, clientcred, new UserIdentifier(userObjectID, UserIdentifierType.UniqueId));
            return result.AccessToken;
        }
        catch (Exception e)
        {
                // Capture error for handling outside of catch block
                ErrorMessage = e.Message;

            return null;
        }

    }

我会在玩更多游戏时进行更新。

Answer 1

Azure Active Directory 颁发了两种访问 token 。

第一个是delegate-token，用于委托(delegate)用户操作用户的资源。

另外一个是application token，通常用于对所有组织的资源执行操作，这个token中没有用户上下文。所以我们不应该使用这个 token 来执行需要用户上下文的资源作为me。

帖子中的代码是使用客户端凭据流获取访问 token ，即应用程序 token 。因此，当您使用这种基于用户上下文的 token 获取用户或图片时，您会出错。

在这种情况下，您应该在发布时使用 AuthorizationCodeReceived 事件获取访问 token 。此事件使用授权代码授予流程为用户获取delegate-token。然后在 Controller 中，您可以使用 AcquireTokenSilentAsync 方法获取 token ，该方法将从 catch 获取访问 token 。

下面的代码示例对于在 Web 应用中调用 Microsoft Graph 以委托(delegate)登录用户的场景非常有帮助:

active-directory-dotnet-graphapi-web