.net - 从 dotnet core 应用程序访问 Microsoft Graph 时出现禁止 403

Question

我正在尝试通过 microsoft graph 提取经过身份验证的 azure Active Directory 用户的办公位置，但不断收到 403 Forbidden 响应。

我能够进行身份验证，并且可以生成访问 token ，但 http 响应状态代码始终为 403。

这是我一直在使用的一些代码，但我感觉这可能是由于配置或权限所致，因此请让我知道您需要哪些其他信息。

public class AccountService : IAccountService
{
    private readonly AzureAd _adSettings;

    public AccountService(IOptions<AzureAd> adSettings)
    {
        _adSettings = adSettings.Value;
    }

    public async Task<string> GetStoreIdFromUser(string userId)
    {
        var storeId = string.Empty;

        string accessToken = await GetBearerAccesToken();

        using (var client = new HttpClient())
        {
            using (var request = new HttpRequestMessage(HttpMethod.Get, GetUserUrl(userId)))
            {
                request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);

                using (var response = await client.SendAsync(request))
                {
                    if (response.StatusCode == HttpStatusCode.OK)
                    {
                        var json = JObject.Parse(await response.Content.ReadAsStringAsync());
                        storeId = json?["physicalDeliveryOfficeName"]?.ToString();
                    }
                }
            }
        }

        return storeId;
    }

    #region private methods

    private string GetUserUrl(string userPrincipalName)
    {
        return string.Format("https://graph.windows.net/{0}/users/{1}?{2}", _adSettings.TenantId, userPrincipalName, "api-version=1.6");
    }

    private async Task<string> GetBearerAccesToken()
    {
        string result = string.Empty;

        // Get OAuth token using client credentials 
        string authString = "https://login.microsoftonline.com/" + _adSettings.TenantId;

        AuthenticationContext authenticationContext = new AuthenticationContext(authString, false);

        // Config for OAuth client credentials  
        ClientCredential clientCred = new ClientCredential(_adSettings.ClientId, _adSettings.AppKey);
        string resource = "https://graph.windows.net";

        AuthenticationResult authenticationResult = await authenticationContext.AcquireTokenAsync(resource, clientCred);
        result = authenticationResult.AccessToken;

        return result;
    }

    #endregion
}

Answer 1

观看 Barry Luijbregts 的精彩 Pluralsight 类(class)“使用 Azure PaaS 构建全局应用程序”后，我在 github 上获得了原始代码。

@juunas 在评论中为我指出了正确的方向。我使用了错误的 API。

这是工作代码:

public interface IAccountService
{
    Task<string> GetStoreIdFromUser(string userId);
}

public class AccountService : IAccountService
{
    private readonly AzureAd _adSettings;

    public AccountService(IOptions<AzureAd> adSettings)
    {
        _adSettings = adSettings.Value;
    }

    public async Task<string> GetStoreIdFromUser(string userId)
    {
        var storeId = string.Empty;

        string accessToken = await GetBearerAccesToken();

        using (var client = new HttpClient())
        {
            using (var request = new HttpRequestMessage(HttpMethod.Get, GetUserUrl(userId)))
            {
                request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);

                using (var response = await client.SendAsync(request))
                {
                    if (response.StatusCode == HttpStatusCode.OK)
                    {
                        var json = JObject.Parse(await response.Content.ReadAsStringAsync());
                        storeId = json?["officeLocation"]?.ToString();
                    }
                }
            }
        }

        return storeId;
    }

    #region private methods

    private string GetUserUrl(string userPrincipalName)
    {
        return string.Format("https://graph.microsoft.com/v1.0/users/{0}", userPrincipalName);
    }

    private async Task<string> GetBearerAccesToken()
    {
        string result = string.Empty;

        // Get OAuth token using client credentials 
        string authString = "https://login.microsoftonline.com/" + _adSettings.TenantId;

        AuthenticationContext authenticationContext = new AuthenticationContext(authString, false);

        // Config for OAuth client credentials  
        ClientCredential clientCred = new ClientCredential(_adSettings.ClientId, _adSettings.AppKey);
        string resource = "https://graph.microsoft.com";

        AuthenticationResult authenticationResult = await authenticationContext.AcquireTokenAsync(resource, clientCred);
        result = authenticationResult.AccessToken;

        return result;
    }

    #endregion
}