c# - 使用Graph API获取用户信息

Question

当我尝试通过访问 token 获取用户信息时，出现以下错误。我的 Angular 应用程序具有以下流程(调用 Web API 的 Web API)

Angular 应用程序 --> 传递 autorizecode --> API(生成访问 token )---> Graph API(用户 api)

One or more errors occurred. (OnBehalfOfCredential authenticationfailed: AADSTS50013: Assertion failed signature validation. [Reason -Key was found, but use of the key to verify the signature failed.,Thumbprint of key used by client:'F8A23743D9CD47B6D1A1FXXXXXXA17A9B1D919EC', Found key'Start=10/02/2022 18:06:49, End=10/02/2027 18:06:49']. Trace ID:1d326676-f8a5-4410-b4cf-SSS1a9b64800 Correlation ID:79ca8aec-bb73-48f9-b0d2-XXXb4226e625 Timestamp: 2023-03-10 10:22:27Z)

应用程序在 Azure 中的范围如下

 "openid", "profile", "User.Read.All"

                var tenantId= "tenantid";
                var clientId= "clientid";
                var clientSecret = "secret";

                // using Azure.Identity;
                var options = new OnBehalfOfCredentialOptions
                {
                    AuthorityHost = AzureAuthorityHosts.AzurePublicCloud
                };

                // This is the incoming token to exchange using on-behalf-of flow
                var oboToken = accessToken;

                var onBehalfOfCredential = new OnBehalfOfCredential(tenantId, clientId, clientSecret, oboToken, options);
                
                GraphServiceClient graphClient = new GraphServiceClient(onBehalfOfCredential, scopes);
                
                var result = graphClient.Users.GetAsync((requestConfiguration) =>
                {
                    requestConfiguration.QueryParameters.Count = true;
                    requestConfiguration.QueryParameters.Search = "\"displayName:rock\"";
                    requestConfiguration.QueryParameters.Orderby = new string[] { "displayName" };
                    requestConfiguration.QueryParameters.Select = new string[] { "id", "displayName", "mail" };
                    requestConfiguration.Headers.Add("ConsistencyLevel", "eventual");

                }).Result;

Answer 1

我尝试通过 Postman 在我的环境中重现相同的内容，并得到了如下相同的错误:

如果您在生成访问 token 时传递无效断言，通常会发生此错误。

• 检查您传递的范围是否有效。
• 确保访问 token (断言)未过期。

要解决该错误，请尝试以下操作:

例如，我创建了服务器 Azure AD 应用程序并公开了 API，添加了授权客户端应用程序:

现在，在 Client 应用程序中，我添加了如下 API 权限:

现在我生成了访问 token 以使用授权代码流传入断言，如下所示:

https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id: <client_app_ID>
grant_type:authorization_code
scope: api://<API_app_ID>/test.read
code: code
redirect_uri: https://jwt.ms
client_secret: <secret> 

现在，我使用 on-behalf-of 流生成访问 token ，使用 scope 作为 https://graph.microsoft .com/User.Read.All

https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id: <API_app_ID>
client_secret: <API_app_secret>
scope: https://graph.microsoft.com/User.Read.All
grant_type: urn:ietf:params:oauth:grant-type:jwt-bearer
assertion: <paste_token_from_above_request>
requested_token_use: on_behalf_of

注意:要获取用户个人资料，aud 应为 https://graph.microsoft.com.

当我解码 token 时，aud 是 Microsoft Graph，如下所示:

当我使用上面生成的访问 token 时，我能够成功获取用户个人资料，如下所示:

GET https://graph.microsoft.com/v1.0/users/UserID

您还可以在代表生成访问 token 时使用https://graph.microsoft.com/.default范围-of 流程。

要解决该错误，请对代码进行如下更改:

var scopes = new[] { "https://graph.microsoft.com/User.Read.All" };
var tenantId = "TenantID";
var clientId = "ClientID";
var clientSecret = "ClientSecret";

var options = new OnBehalfOfCredentialOptions
{
    AuthorityHost = AzureAuthorityHosts.AzurePublicCloud
};
var oboToken = "JWTToken";
var onBehalfOfCredential = new OnBehalfOfCredential(tenantId, clientId, clientSecret, oboToken, options);
var graphClient = new GraphServiceClient(onBehalfOfCredential,scopes);

var result = graphClient.Users.GetAsync((requestConfiguration) =>
{                requestConfiguration.QueryParameters.Count = true; 
                 requestConfiguration.QueryParameters.Search = "\"displayName:rock\"";  
                 requestConfiguration.QueryParameters.Orderby = new string[] { "displayName" };  
                 requestConfiguration.QueryParameters.Select = new string[] { "id", "displayName", "mail" };    
                 requestConfiguration.Headers.Add("ConsistencyLevel", "eventual");
}).Result;

并确保生成访问 token ，以便将其作为具有适当范围的断言传递。

引用文献:

Choose-authentication-providers.md at main · microsoftgraph · GitHub作者:安德鲁伊斯特曼

GitHub Web API calling a downstream API on behalf of the user作者:neha-bhargava