如何在WAAD保护的web API2中获取电子邮件

Question

我使用的MVC5客户端通过“UseOpenIdConnectUthEntication”进行安全保护，并在Claims对象中获取所有用户的详细信息，该客户端通过“承载”认证令牌调用WAAD安全Web Api。

我需要在web API中获取用户名或电子邮件。我试过不同的选择，但都没用。

我在identity.name中得到null，我得到的其他属性如nameidentifier、objectidentifier、tenanted等。

string signedInUserID = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
            string tenantID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value;
            ClientCredential clientcred = new ClientCredential(Startup.clientId, Startup.appKey);
            AuthenticationContext authenticationContext = new AuthenticationContext(Startup.aadInstance + Startup.tenantId, new ADALTokenCache(signedInUserID));
            AuthenticationResult authenticationResult = authenticationContext.AcquireToken(apiResourceId, clientcred);

            return authenticationResult.AccessToken;

app.UseOpenIdConnectAuthentication(
                new OpenIdConnectAuthenticationOptions
                {
                    ClientId = clientId,
                    Authority = Authority,
                    PostLogoutRedirectUri = postLogoutRedirectUri,
                    UseTokenLifetime = false,
                    Notifications = new OpenIdConnectAuthenticationNotifications()
                    {
                        // If there is a code in the OpenID Connect response, redeem it for an access token and refresh token, and store those away.
                        AuthorizationCodeReceived = (context) =>
                        {
                            var code = context.Code;
                            ClientCredential credential = new ClientCredential(clientId, appKey);
                            string signedInUserID = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.NameIdentifier).Value;
                            AuthenticationContext authContext = new AuthenticationContext(Authority, new ADALTokenCache(signedInUserID));
                            AuthenticationResult result = authContext.AcquireTokenByAuthorizationCode(
                            code, new Uri(HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Path)), credential, graphResourceId);
                            return Task.FromResult(0);

                        }

以下是令牌的详细信息：

Answer 1

您可以通过以下方式获取当前用户的upn：

var upn = ClaimsPrincipal.Current.FindFirst("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn").Value;

另一种方法是使用Microsoft Graph api获取用户的基本信息，请参考OAuth2.0的代表流，它服务于一个应用程序调用一个服务/Web api，而该应用程序又需要调用另一个服务/Web api的用例。请参阅协议说明和代码示例。

更新：

AuthenticationResult authenticationResult = authenticationContext.AcquireToken(apiResourceId, clientcred);

string userObjectID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value;
AuthenticationContext authContext = new AuthenticationContext(Startup.Authority, new NaiveSessionCache(userObjectID));
ClientCredential credential = new ClientCredential(clientId, appKey);
result = await authContext.AcquireTokenSilentAsync(todoListResourceId, credential, new UserIdentifier(userObjectID, UserIdentifierType.UniqueId));