iOS客户端：我可以让用户登录到Active Directory，但如何访问MS Graph API？

Question

我正在开发一个iOS应用程序，需要从MS Azure Active Directory读取用户数据。

我已经成功地从MS Azure文档中学习了iOS应用程序的一些示例，并成功地打开了它们的身份验证页面，让用户登录。我得到的是一些AdUserInformation对象形式的用户数据。

    NSString *authority = @"https://login.microsoftonline.com/a5960f61-0bf9-4bf6-96cd-98c61d30XXXX/federationmetadata/2007-06/federationmetadata.xml";

    NSString *resourceId    = @"74cd2559-0389-4871-9904-bc767d71XXXX"; // (server)

    NSString *clientId      = @"c8a956a7-84b7-4050-875c-896aab6bXXXX";   //ios-client (us)

    NSURL *redirectUri = [[NSURL alloc]initWithString:@"https://XXXXevents.azurewebsites.net/.auth/login/done"];

    ADAuthenticationError *error;

    ADAuthenticationContext * authContext = [ADAuthenticationContext authenticationContextWithAuthority:authority error:&error];

    //authContext.parentController = parent;

    [ADAuthenticationSettings sharedInstance].enableFullScreen = YES;

    [authContext acquireTokenWithResource:resourceId
                                 clientId:clientId
                              redirectUri:redirectUri
                          completionBlock:^(ADAuthenticationResult *result) {

          if (result.status != AD_SUCCEEDED) {
              NSLog(@"%@", result);
              return;
          }
          else {

              //save all of this information into core data

              NSDictionary * payload = @{@"access_token" : result.tokenCacheItem.accessToken};
              NSLog(@"%@", payload);

              //@"aad"
              //@"windowsazureactivedirectory"

              [[QSActivityService defaultService].client loginWithProvider:     @"aad"
                                                                     token:     payload
                                                                completion:     ^(MSUser * _Nullable user, NSError * _Nullable error) {

                                                                NSLog(@"loginWithProvider-------");
                  if(!error) {
                      NSLog(@"YAY! %s - user: %@ ", __FUNCTION__, user.userId);

                      ADUserInformation * temp = result.tokenCacheItem.userInformation;

                                           [[CoreDataStack defaultStack] updateUserDetailFamilyName:temp.allClaims[@"family_name"]
                                                                           version:temp.allClaims[@"ver"]
                                                                             email:temp.allClaims[@"email"]
                                                                               nbf:temp.allClaims[@"nbf"]
                                                                               exp:temp.allClaims[@"exp"]
                                                                         givenName:temp.allClaims[@"given_name"]
                                                                               idp:temp.allClaims[@"idp"]
                                                                            ipaddr:temp.allClaims[@"ipaddr"]
                                                                               iss:temp.allClaims[@"iss"]
                                                                               oid:temp.allClaims[@"oid"]
                                                                               typ:temp.allClaims[@"typ"]
                                                                               sub:temp.allClaims[@"sub"]
                                                                               amr:temp.allClaims[@"amr"]
                                                                               aud:temp.allClaims[@"aud"]
                                                                               alg:temp.allClaims[@"alg"]
                                                                               iat:temp.allClaims[@"iat"]
                                                                               tid:temp.allClaims[@"tid"]
                                                                              name:temp.allClaims[@"name"]
                                                                        uniqueName:temp.allClaims[@"unique_name"]];

    //other code, no problems here

然而，我想访问个人资料图像，和所有其他数据。我已经读过MS Graph API提供了它，但我不确定如何以及在哪里放置令牌。

是否使用Result.TokenCacheItem.AccesStoken中的令牌？如果是，在标题中？还是尸体？

或者我只需点击graph.windows.com两次。第一次获取身份验证令牌，第二次获取数据？

-(void)getUsersUsingAccessToken:(NSDictionary*)token completion:(void (^)    (void))completion {

    NSString * tenant = @"a5960f61-0bf9-4bf6-96cd-98c61d306f12";

    NSString * accessToken = token[@"access_token"];

    NSString * urlString = [NSString stringWithFormat: @"https://graph.windows.net/%@/tenantDetails?api-version=1.6", tenant];

    NSString * httpVerb = @"POST";

    //build an info object and convert to json
    NSDictionary * bodyFormDict

    = [NSDictionary dictionaryWithObjectsAndKeys:
     @"client_credentials",                              @"grant_type",
     @"https://graph.windows.net",                       @"resource",
     @"c8a956a7-84b7-4050-875c-896aab6xxxx",            @"client_id",
     @"XLlZl69aUKiQTo4dpeiprItm+LYbDtpt6e9dn0bxxxx",    @"client_secret",
     nil];

    NSError *error = nil;

    //1st step
    NSData * jsonInputData = [NSJSONSerialization dataWithJSONObject:bodyFormDict
                                                             options:NSJSONWritingPrettyPrinted
                                                               error:&error];

    //2nd step
    NSString * httpBodyString = [[NSString alloc]
                                 initWithData:jsonInputData
                                 encoding:NSUTF8StringEncoding];


    NSURLSessionConfiguration *sessionConfiguration = [NSURLSessionConfiguration defaultSessionConfiguration];
    sessionConfiguration.allowsCellularAccess = YES;

    self.session = [NSURLSession sessionWithConfiguration:sessionConfiguration];

    NSMutableURLRequest * request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:urlString]];
    request.HTTPMethod = httpVerb;

    [request setValue:  @"application/json; charset=utf-8" forHTTPHeaderField:@"Content-Type"];
    [request setValue:  accessToken forHTTPHeaderField:@"Authorization: Bearer"];

    [request setHTTPBody:[httpBodyString dataUsingEncoding:NSUTF8StringEncoding]];

    //asynchronous
    NSURLSessionDataTask * getDataTask = [self.session dataTaskWithRequest:request
                                                         completionHandler:^(NSData * _Nullable data,
                                                                             NSURLResponse * _Nullable response,
                                                                             NSError * _Nullable error) {

    //other code

}

感谢您抽出时间！

Answer 1

我认为您遇到的问题是http头字段设置不正确。试试这个-

    NSString *authValue = [NSString stringWithFormat:@"Bearer %@", accessToken];
    [request setValue:authValue forHTTPHeaderField:@"Authorization"];