Azure AD图形-使用应用程序凭据流审批创建

Question

我正在使用azure AD Graph API在azure应用程序中创建一个新角色。我所做的是使用以下代码从azure获取访问令牌：

ClientCredential clientCredential = new ClientCredential(clientId, clientSecret);
AuthenticationContext authenticationContext = new AuthenticationContext(aadInstance + tenantID);
AuthenticationResult authenticationResult = await authenticationContext.AcquireTokenAsync(graphResourceID, clientCredential);
return authenticationResult.AccessToken;

并使用以下代码创建角色：

//Fetch application Data from azure AD
IApplication application = await activeDirectoryClient.Applications.GetByObjectId(RoleModel.ApplicationID).ExecuteAsync();
AppRole NewRole = new AppRole
{
    Id = CurrentRoleID,
    IsEnabled = true,
    AllowedMemberTypes = new List<string> { "User" },
    Description = RoleModel.RoleDescription,
    DisplayName = RoleModel.RoleName,
    Value = RoleModel.RoleName
 };
 application.AppRoles.Add(NewRole as AppRole);
 await application.UpdateAsync();

我还向Microsoft Graph API授予了所有应用程序权限，而不是从Azure portal委派的权限。但我得到了这个错误：

访问令牌：从ADzure AD返回的访问令牌

Answer 1

问题：那么，是否可以使用应用程序凭据流在应用程序中创建一个新的角色？如果是的话，我是不是漏了什么？

对您的一般问题的回答是肯定的，您可以使用Azure AD Graph API和客户机凭据流向应用程序的角色添加一个新角色。

工作代码

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using Microsoft.Azure.ActiveDirectory.GraphClient;
using Microsoft.IdentityModel.Clients.ActiveDirectory;

namespace AddAzureADApplicationRoles
{
    class Program
    {
        static void Main(string[] args)
        {
            ActiveDirectoryClient activeDirectoryClient = new ActiveDirectoryClient(new Uri("https://graph.windows.net/{myTenantId}"),
                async () => await GetTokenForApplication());

            //Fetch application Data from azure AD
            IApplication application = activeDirectoryClient.Applications.GetByObjectId("{MyAppObjectId}").ExecuteAsync().GetAwaiter().GetResult();

            AppRole NewRole = new AppRole
            {
                Id = Guid.NewGuid(),
                IsEnabled = true,
                AllowedMemberTypes = new List<string> {"User"},
                Description = "My Role Description..",
                DisplayName = "My Custom Role",
                Value = "MyCustomRole"
            };

            application.AppRoles.Add(NewRole as AppRole);
            application.UpdateAsync().GetAwaiter().GetResult();
        }

        public static async Task<string> GetTokenForApplication()
        {
            string TokenForApplication = "";

                AuthenticationContext authenticationContext = new AuthenticationContext(
                    "https://login.microsoftonline.com/{MyTenantId}",
                    false);

                // Configuration for OAuth client credentials 

                    ClientCredential clientCred = new ClientCredential("{AppId}",
                        "{AppSecret}"
                        );
                    AuthenticationResult authenticationResult =
                        await authenticationContext.AcquireTokenAsync("https://graph.windows.net", clientCred);
                    TokenForApplication = authenticationResult.AccessToken;                

            return TokenForApplication;
        }
    }
}

我认为您已经授予了Microsoft Graph API上的应用程序权限，而不是Azure AD Graph API所需的权限。

设置应用程序所需的权限时，请在“选择API”对话框中，确保选择“Windows Azure Active Directory”，而不是“Microsoft Graph”。接下来我会给出更多细节的截图。

授予所需权限的步骤