c# - 如何从 Azure AD 获取用户属性

Question

我正在使用 MS library 中的标准片段从我的azure AD获取用户及其属性。但不幸的是，我发现这个代码片段并没有获取用户拥有的所有属性，而只获取他们的显示名称、全名、姓氏，仅此而已，其他属性为 null，但我需要获取所有属性用户有。我已经在 google 上搜索过这个问题很多次，只找到了不适合我的 LDAP 解决方案。

用户属性的 JSON 输出图像:

[{"Properties":{},"Id":null,"Display":null,"Department":null,"GivenName":"Example","Surname":"Example","UserPrincipalName":"<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="62271a030f120e0722271a030f120e074c010d0f" rel="noreferrer noopener nofollow">[email protected]</a>"},{"Properties":{},"Id":null,"Display":null,"Department":null,"GivenName":"Example","Surname":"Example","UserPrincipalName":"<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="a8edd0c9c5d8c4cde8edd0c9c5d8c4cd86cbc7c5" rel="noreferrer noopener nofollow">[email protected]</a>"},{"Properties":{},"Id":null,"Display":null,"Department":null,"GivenName":"Example","Surname":"Example","UserPrincipalName":"<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="ffba879e928f939abfba879e928f939ad19c9092" rel="noreferrer noopener nofollow">[email protected]</a>"},{"Properties":{},"Id":null,"Display":null,"Department":null,"GivenName":"Example","Surname":"Example","UserPrincipalName":"<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="c287baa3afb2aea78287baa3afb2aea7eca1adaf" rel="noreferrer noopener nofollow">[email protected]</a>"},{"Properties":{},"Id":null,"Display":null,"Department":null,"GivenName":"Example","Surname":"Example","UserPrincipalName":"<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="d693aeb7bba6bab39693aeb7bba6bab3f8b5b9bb" rel="noreferrer noopener nofollow">[email protected]</a>"},{"Properties":{},"Id":null,"Display":null,"Department":null,"GivenName":"Example","Surname":"Example","UserPrincipalName":"<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="8dc8f5ece0fde1e8cdc8f5ece0fde1e8a3eee2e0" rel="noreferrer noopener nofollow">[email protected]</a>"},

所以问题是，如何使用 C# 从 Azure AD 获取所有用户属性？

我的用户模型:

 public async Task<List<ResultsItem>> GetUsers(GraphServiceClient graphClient)
    {
        List<ResultsItem> items = new List<ResultsItem>();

        // Get users.
        IGraphServiceUsersCollectionPage users = await graphClient.Users.Request().GetAsync();

        // Populate the view model.
        if (users?.Count > 0)
        {
            foreach (User user in users)
            {

                // Filter out conference rooms.
                string displayName = user.DisplayName ?? "";
                if (!displayName.StartsWith("Conf Room"))
                {

                    // Get user properties.
                    items.Add(new ResultsItem
                    {
                        Mail = user.Mail,
                        Display = user.DisplayName,
                        Id = user.Id,
                        Department = user.Department,
                        GivenName = user.GivenName,
                        Surname = user.Surname,
                        UserPrincipalName = user.UserPrincipalName                           
                    });
                }
            }
        }
      var jsonEmployees = JsonConvert.SerializeObject(items); // Convert to JSON
      return items;
    }

Answer 1

根据您的描述，我注册了 AD v2.0 应用程序，并使用 MSAL 通过 User.Read 和 User.ReadBasic.All 检索访问 token 范围。使用fiddler捕获获取用户时的网络痕迹，我可以得到如下响应:

作为 Microsoft Graph List users规定如下:

By default, only a limited set of properties are returned ( businessPhones, displayName, givenName, id, jobTitle, mail, mobilePhone, officeLocation, preferredLanguage, surname, userPrincipalName ).

To return an alternative property set, you must specify the desired set of user properties using the OData $select query parameter. For example, to return displayName, givenName, and postalCode, you would use the add the following to your query $select=displayName,givenName,postalCode

为了一个简单的方法，我只使用 Microsoft Graph Explorer并访问 https://graph.microsoft.com/v1.0/users?$select=Department,Mail,Display,Id,GivenName,Surname,UserPrincipleName，如下所示:

使用客户端库时，可以使用以下代码:

var users = await graphClient.Users.Request().Select("Department,Mail,Display,Id,GivenName,Surname,UserPrincipleName").GetAsync();

详细信息您可以按照Microsoft Graph .NET Client Library Overview下的查询选项部分进行操作。 .

此外，您需要检查是否还有更多记录并通过以下代码片段检索所有用户:

var userList = new List<User>();
IGraphServiceUsersCollectionPage pagedCollection = await graphClient.Users.Request().Select("Department,Mail,Display,Id,GivenName,Surname,UserPrincipleName").GetAsync();
if (pagedCollection != null)
{
    do
    {
        List<User> usersList = pagedCollection.CurrentPage.ToList();
        foreach (var user in usersList)
        {
            userList.Add(user);
        }
        pagedCollection = await pagedCollection.NextPageRequest.GetAsync();
    } while (pagedCollection != null);
}

更新:

我利用了 Microsoft Graph Snippets Sample for ASP.NET 4.6示例并注册了我的 AD V2.0 应用程序，并替换了 web.config 文件下的 ida:AppId 和 ida:AppSecret 设置。它可以在我这边工作，如下所示:

使用 fiddler，我可以捕获 https://graph.microsoft.com/v1.0/users 的网络跟踪，并且它可以正确返回用户属性。我建议您调试应用程序并在调用 await graphClient.Users.Request().GetAsync(); 后检查结果，同时检查 user 实例的属性您迭代 users 集合。