.net - 如何使用 Microsoft.Identity.Client.PublicClientApplication C# 验证 Azure 资源 API 的交互

Question

我有一个由 VS 的 Windows Template Studio 创建的应用程序。我已经进行了身份验证，并且可以使用与 Azure 门户(交互式)相同的凭据成功获取 token 。

using Microsoft.Identity.Client
...

private IPublicClientApplication _client;

_client = PublicClientApplicationBuilder.Create(_clientId)
                  .WithAuthority(AadAuthorityAudience.AzureAdMultipleOrgs)
                  .WithRedirectUri($"msal{_clientId}://auth")
                  .Build();

var accounts = await _client.GetAccountsAsync();  

_authenticationResult = await _client.AcquireTokenInteractive(_scopes)                                                     
                                     .WithAccount(accounts.FirstOrDefault())
                                     .ExecuteAsync();

如何将 token 与 Azure API 库一起使用，例如:

• Microsoft.Azure.Management.ResourceManager.Fluent

• Microsoft.Azure.Services.AppAuthentication

Answer 1

根据我的测试，我们可以使用访问 token 来管理Azure资源Microsoft.Azure.Management.ResourceManager.Fluent SDK。更多详情请引用Using authentication token in azure sdk fluent 。详细步骤如下。

1. 为您使用的 Azure AD 应用程序配置权限。

2. 代码

var client = PublicClientApplicationBuilder.Create(clientId)
                .WithAuthority(AadAuthorityAudience.AzureAdMultipleOrgs)
                .WithRedirectUri($"msal{clientId}://auth")
                .Build();

            var accounts = client.GetAccountsAsync().Result;
            string[] scopes = { "https://management.azure.com/user_impersonation" };
            var result = client.AcquireTokenInteractive(scopes)
                                      .WithAccount(accounts.FirstOrDefault())
                                      .ExecuteAsync().Result;

            string subscritionID = ""; // the subciption Id
            string tenantId= "";// the tenata contains the subscription you use
            TokenCredentials tokenCredentials = new TokenCredentials(result.AccessToken);
            var azureCredentials = new AzureCredentials(tokenCredentials, tokenCredentials, tenantId, AzureEnvironment.AzureGlobalCloud);
            var restClient = RestClient
            .Configure()
            .WithEnvironment(AzureEnvironment.AzureGlobalCloud)
            .WithLogLevel(HttpLoggingDelegatingHandler.Level.Basic)
            .WithCredentials(azureCredentials)
            .Build();
            var azure = Azure
                .Authenticate(restClient, tenantId)
                .WithSubscription(subscritionID);
            var sp = azure.ResourceGroups.List();
            foreach (var group in sp) {

                Console.WriteLine("group name :"+ group.Name);
            }

另外，关于sdk Microsoft.Azure.Services.AppAuthentication ，它还用于启用服务对 Azure 服务进行身份验证。换句话说，是另一种获取token的方式。但它仅支持 Azure MSI 的身份验证。