如何通过MSAL库在AADV2endpoint中使用户同意Web API访问MS Graph用户配置文件

Question

我试图构建一个客户端应用程序通过WebAPI层检索图资源的特性。该方案具有以下应用程序：

1. Angular5客户端应用程序
2. ASP.NET Core Web API

Angular5客户端应用程序使用MSAL对应用程序进行身份验证（通过apps.dev.microsoft.com注册应用程序作为聚合应用程序进行抵制；AAD v2endpoint）。身份验证流在登录或获取访问令牌时将Web API定义为作用域

constructor() {
   var logger = new Msal.Logger((logLevel, message, piiEnabled) =>
   {
     console.log(message);
   },
   { level: Msal.LogLevel.Verbose, correlationId: '12345' });
   this.app = new Msal.UserAgentApplication(
      CONFIGSETTINGS.clientId,
      null,
      this.authCallback,
      {
        redirectUri: window.location.origin,
        cacheLocation: 'localStorage', 
        logger: logger 
      }
   );
}

public getAPIAccessToken() {
return this.app.acquireTokenSilent(CONFIGSETTINGS.scopes).then(
    accessToken => {
      return accessToken;
    },
    error => {
      return this.app.acquireTokenSilent(CONFIGSETTINGS.scopes).then(
        accessToken => {
          return accessToken;
        },
        err => {
          console.error(err);
        }
      );
    }
  );

        public async Task<string> GetAccesToken(string resourceName)
        {
            var userAssertion = this.GetUserAssertion();
            string upn = GetLoggedInUpn();
            var userTokenCache = new SessionTokenCache(upn, new Microsoft.Extensions.Caching.Memory.MemoryCache(new MemoryCacheOptions())).GetCacheInstance();
            string msGraphScope = "https://graph.microsoft.com/User.Read";
            string authority = string.Format("https://login.microsoftonline.com/{0}/v2.0", this.authConfig.TenantId);
            ConfidentialClientApplication clientApplication = new ConfidentialClientApplication(this.authConfig.ClientId, authority, new ClientCredential(this.authConfig.AppKey), userTokenCache, null);

            var result = await clientApplication.AcquireTokenOnBehalfOfAsync(new string[] { msGraphScope }, userAssertion);
            return result != null ? result.AccessToken : null;
        }



        private UserAssertion GetUserAssertion()
        {
             string token = this.httpContextAccessor.HttpContext.Request.Headers["Authorization"];
            string upn = GetLoggedInUpn();
            if (token.StartsWith("Bearer", true, CultureInfo.InvariantCulture))
            {
                 token = token.Trim().Substring("Bearer".Length).Trim();
                return new UserAssertion(token, "urn:ietf:params:oauth:grant-type:jwt-bearer");
            }
            else
            {
               throw new Exception($"ApiAuthService.GetUserAssertion() failed: Invalid Authorization token");
             }
         }

Answer 1

我已经想了好几个星期了！我的解决方案不是很好（它要求用户再次通过Web API的同意过程），但我不确定这是完全出乎意料的。毕竟，要么管理员必须同意Web API为用户访问图形，要么用户必须同意。

无论如何，关键是获得用户的同意，当然，Web API不能这样做，因为它没有UI。但是，ConfidentialClientApplication将告诉您用户必须使用GetAuthorizationRequestURLASync访问的URL。

下面是我用来使其工作的代码片段（我省略了将url传播回webapp的所有细节，但您可以查看https://github.com/rlittletht/msal-S2s-ref获得一个工作示例）

async Task<string> GetAuthenticationUrlForConsent(ConfidentialClientApplication cca, string []graphScopes)
{
    // if this throws, just let it throw
    Uri uri = await cca.GetAuthorizationRequestUrlAsync(graphScopes, "", null);
    return uri.AbsoluteUri;
}

async Task<string> GetAccessTokenForGraph()
{
    // (be sure to use the redirectUri here that matches the Web platform
    // that you added to your WebApi
    ConfidentialClientApplication cca =
        new ConfidentialClientApplication(Startup.clientId,
            "http://localhost/webapisvc/auth.aspx",
            new ClientCredential(Startup.appKey), null, null);

    string[] graphScopes = {"https://graph.microsoft.com/.default"};

    UserAssertion userAssertion = GetUserAssertion();

    AuthenticationResult authResult = null;
    try
    {
        authResult = await cca.AcquireTokenOnBehalfOfAsync(graphScopes, userAssertion);
    }
    catch (Exception exc)
    {
        if (exc is Microsoft.Identity.Client.MsalUiRequiredException
            || exc.InnerException is Microsoft.Identity.Client.MsalUiRequiredException)
        {
            // We failed because we don't have consent from the user -- even
            // though they consented for the WebApp application to access
            // the graph, they also need to consent to this WebApi to grant permission
            string sUrl = await GetAuthenticationUrlForConsent(cca, graphScopes);

            // you will need to implement this exception and handle it in the callers
            throw new WebApiExceptionNeedConsent(sUrl, "WebApi does not have consent from the user to access the graph on behalf of the user", exc);
        }
        // otherwise, just rethrow
        throw;
    }
    return authResult.AccessToken;
}