无法使用EnableTokenAcquisitionToCallDownstreamApi和AddMicrosoftId

Question

这在startup.cs:中编译

string[] initialScopes = Configuration.GetValue<string>("GraphApi:Scopes")?.Split(' ');
services.AddMicrosoftIdentityWebAppAuthentication(Configuration)
.EnableTokenAcquisitionToCallDownstreamApi(initialScopes)
.AddMicrosoftGraph();

然而，由于我只在API控制器上工作，而不是在web应用程序上工作，所以我想改为：

string[] initialScopes = Configuration.GetValue<string>("GraphApi:Scopes")?.Split(' ');
services.AddMicrosoftIdentityWebApiAuthentication(Configuration)
.EnableTokenAcquisitionToCallDownstreamApi(initialScopes)
.AddMicrosoftGraph();

但是，这不会编译。至少Microsoft.Identity.Webv1.0没有。Intellisense告诉我string[] is not assignable to parameter type ConfidentialClientApplicationOptions。

不同之处在于，AddMicrosoftIdentityWebApiAuthentication返回MicrosoftIdentityWebApiAuthenticationBuilder，而前者返回`MicrosoftIdentityAppCallsWebApiAuthenticationBuilder。

这附近有工作吗？

我试图实现的是确保在请求Graph访问令牌时正确设置作用域。目前，情况似乎并非如此，因为我在尝试调用Graph时遇到了这样的错误，例如await graphServiceClient.Applications.Request().GetAsync();。

---> Microsoft.Identity.Web.MicrosoftIdentityWebChallengeUserException: IDW10502: An MsalUiRequiredException was thrown due to a challenge for the user. See https://aka.ms/ms-id-web/ca_incremental-consent. 
---> MSAL.NetCore.4.18.0.0.MsalUiRequiredException: 
ErrorCode: user_null
Microsoft.Identity.Client.MsalUiRequiredException: No account or login hint was 

换句话说，我需要的是一个应用程序访问令牌，它看起来像这样：

[...more json]
{
"aud": "https://graph.microsoft.com",
"iss": "https://sts.windows.net/{tenant id}/",
"iat": 1602055659,
"nbf": 1602055659,
"exp": 1602059559,
"aio": "[...]",
"app_displayname": "My app",
"appid": "{App id guid}",
"appidacr": "1",
"idp": "https://sts.windows.net/{tenant id}/",
"idtyp": "app",
"oid": "{guid}",
"rh": "[...]",
"roles": [
"Application.ReadWrite.All",
"Directory.ReadWrite.All",
"Directory.Read.All",
"Application.Read.All"
],
"sub": "{guid}",
"tenant_region_scope": "EU",
"tid": "{tenant id}",
"uti": "[...]",
"ver": "1.0",
"xms_tcdt": 1597308440
}.[Signature]

我可以用Postman手动生成上面的内容，如果我使用它，它就可以工作了。确认Azure AD中应用程序的配置正确。

Answer 1

使用

.AddMicrosoftGraph(Configuration.GetSection("GraphAPI"))

并确保appsettings.json包含以下内容(使用您想要的用空格分隔的范围(：

"GraphAPI": {
"BaseUrl": "https://graph.microsoft.com/v1.0",
"Scopes": "user.read mail.read",
"DefaultScope": "https://graph.microsoft.com/.default"
}

Answer 2

显然，目前还不支持使用应用程序访问令牌。

IDW10502:由于用户#667 遇到挑战，引发MsalUiRequiredException