我对 Azure 的一切都很陌生,并且正在使用 ASP.NET MVC 4 模板项目。
我的目标是将所有用户从 Azure AD 拉入一个可枚举列表,然后我可以稍后搜索该列表。
目前,我遇到以下错误:
Server Error in '/' Application
Object reference not set to an instance of an object
...
Exception Details: System.NullReferenceException: Object reference not set to an instance of an object.
或者这个,取决于哪个 .Where(...)
我注释掉的条款:
The token for accessing the Graph API has expired. Click here to sign-in and get a new access token.
单击链接会调用此 URL:
https://login.microsoftonline.com/<MY TENANT GUID>/oauth2/authorize?client_id=<MY APP ID>&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%<Bunch of alphanumeric gibberish>&nonce=<More alphanumeric gibberish>-client-SKU=ID_NET&x-client-ver=1.0.40306.1554
单击该链接会尝试执行某些操作,但只会让我回到同一页面并出现相同的错误,并且不会执行任何其他操作。
UserProfileController.cs
private ApplicationDbContext db = new ApplicationDbContext();
private string clientId = ConfigurationManager.AppSettings["ida:ClientId"];
private string appKey = ConfigurationManager.AppSettings["ida:ClientSecret"];
private string aadInstance = ConfigurationManager.AppSettings["ida:AADInstance"];
private string graphResourceID = "https://graph.windows.net";
public async Task<Collection<IUser>> GetAllUsers()
{
var userList = new Collection<IUser>();
try
{
string tenantID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value;
Uri servicePointUri = new Uri(graphResourceID);
Uri serviceRoot = new Uri(servicePointUri, tenantID);
ActiveDirectoryClient activeDirectoryClient = new ActiveDirectoryClient(serviceRoot,
async () => await GetTokenForApplication());
// use the token for querying the graph to get the user details
var result = await activeDirectoryClient.Users
//.Where(u => u.JobTitle.Equals("Cool Dudes")) // Works fine when uncommented, otherwise gives me a server error
.ExecuteAsync();
while (result.MorePagesAvailable)
{
userList = userList.Concat(result.CurrentPage.ToList()) as Collection<IUser>;
await result.GetNextPageAsync();
}
}
catch (Exception e)
{
if (Request.QueryString["reauth"] == "True")
{
// Send an OpenID Connect sign-on request to get a new set of tokens.
// If the user still has a valid session with Azure AD, they will not
// be prompted for their credentials.
// The OpenID Connect middleware will return to this controller after
// the sign-in response has been handled.
HttpContext.GetOwinContext()
.Authentication.Challenge(OpenIdConnectAuthenticationDefaults.AuthenticationType);
}
return userList;
}
return userList;
}
public async Task<ActionResult> Admin()
{
try
{
var user = await GetAllUsers();
return View(user
//.Where(u => u.JobTitle.Equals("Cool Dudes")) // When this is uncommented and the one in GetAllUsers is commented out, I get an error saying "The token for accessing the Graph API has expired. Click here to sign-in and get a new access token."
);
}
catch (AdalException)
{
// Return to error page.
return View("Error");
}
// if the above failed, the user needs to explicitly re-authenticate for the app to obtain the required token
catch (Exception)
{
return View("Relogin");
}
}
public void RefreshSession()
{
HttpContext.GetOwinContext().Authentication.Challenge(
new AuthenticationProperties { RedirectUri = "/UserProfile" },
OpenIdConnectAuthenticationDefaults.AuthenticationType);
}
public async Task<string> GetTokenForApplication()
{
string signedInUserID = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
string tenantID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value;
string userObjectID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value;
// get a token for the Graph without triggering any user interaction (from the cache, via multi-resource refresh token, etc)
ClientCredential clientcred = new ClientCredential(clientId, appKey);
// initialize AuthenticationContext with the token cache of the currently signed in user, as kept in the app's database
AuthenticationContext authenticationContext = new AuthenticationContext(aadInstance + tenantID, new ADALTokenCache(signedInUserID));
AuthenticationResult authenticationResult = await authenticationContext.AcquireTokenSilentAsync(graphResourceID, clientcred, new UserIdentifier(userObjectID, UserIdentifierType.UniqueId));
return authenticationResult.AccessToken;
}
Admin.cshtml
@using Microsoft.Azure.ActiveDirectory.GraphClient
@model IEnumerable<IUser>
@{
ViewBag.Title = "Admin";
}
<h2>@ViewBag.Title.</h2>
<table class="table table-bordered table-striped">
@foreach (var user in Model)
{
<tr>
<td>Display Name</td>
<td>@user.DisplayName</td>
<td>Job Title</td>
<td>@user.JobTitle</td>
</tr>
}
</table>
我在这里缺少什么?我的 while 循环逻辑错误吗?我是否可能使用现在已经过时的方式来阅读此信息?是权限问题吗?
编辑:
缩小范围:
- 何时
GetAllUsers
(以及可选的Admin
)有Where
条款,Admin
返回一个空页面,但没有错误 - 仅当
Admin
有Where
子句,返回图形错误 - 当两者都没有
Where
时子句,返回服务器错误
所以我认为GetAllUsers
未正确返回数据。
最佳答案
基于this blog post by Jonathan Huss ,我能够将这部分代码从项目中默认的 Azure AD Graph API
转换为较新的 Microsoft Graph API
在我的 Models 文件夹中(可能放在 Utility 文件夹或其他文件夹中)我添加以下代码:
AzureAuthenticationProvider.cs
using System.Configuration;
using System.Net.Http;
using System.Security.Claims;
using System.Threading.Tasks;
using Microsoft.Graph;
using Microsoft.IdentityModel.Clients.ActiveDirectory;
namespace <PROJECT_NAME>.Models
{
class AzureAuthenticationProvider : IAuthenticationProvider
{
private string clientId = ConfigurationManager.AppSettings["ida:ClientId"];
private string appKey = ConfigurationManager.AppSettings["ida:ClientSecret"];
private string aadInstance = ConfigurationManager.AppSettings["ida:AADInstance"];
public async Task AuthenticateRequestAsync(HttpRequestMessage request)
{
string signedInUserID = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
string tenantID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value;
// get a token for the Graph without triggering any user interaction (from the cache, via multi-resource refresh token, etc)
ClientCredential creds = new ClientCredential(clientId, appKey);
// initialize AuthenticationContext with the token cache of the currently signed in user, as kept in the app's database
AuthenticationContext authenticationContext = new AuthenticationContext(aadInstance + tenantID, new ADALTokenCache(signedInUserID));
AuthenticationResult authResult = await authenticationContext.AcquireTokenAsync("https://graph.microsoft.com/", creds);
request.Headers.Add("Authorization", "Bearer " + authResult.AccessToken);
}
}
}
回到UserProfileController.cs我们有:
using System;
using System.Collections.Generic;
using System.Collections.ObjectModel;
using System.Configuration;
using System.Linq;
using System.Security.Claims;
using System.Web;
using System.Web.Mvc;
using System.Threading.Tasks;
using Microsoft.Azure.ActiveDirectory.GraphClient; // Will eventually be removed
using Microsoft.IdentityModel.Clients.ActiveDirectory;
using Microsoft.Owin.Security;
using Microsoft.Owin.Security.OpenIdConnect;
using <PROJECT_NAME>.Models;
using Microsoft.Graph;
using User = Microsoft.Graph.User; // This is only here while I work on removing references to Microsoft.Azure.ActiveDirectory.GraphClient
namespace <PROJECT_NAME>.Controllers
{
[Authorize]
public class UserProfileController : Controller
{
public async Task<List<User>> GetAllUsers()
{
List<User> userResult = new List<User>();
GraphServiceClient graphClient = new GraphServiceClient(new AzureAuthenticationProvider());
IGraphServiceUsersCollectionPage users = await graphClient.Users.Request().Top(500).GetAsync(); // The hard coded Top(500) is what allows me to pull all the users, the blog post did this on a param passed in
userResult.AddRange(users);
while (users.NextPageRequest != null)
{
users = await users.NextPageRequest.GetAsync();
userResult.AddRange(users);
}
return userResult;
}
// Return all users from Azure AD as a proof of concept
public async Task<ActionResult> Admin()
{
try
{
var user = await GetAllUsers();
return View(user
);
}
catch (AdalException)
{
// Return to error page.
return View("Error");
}
// if the above failed, the user needs to explicitly re-authenticate for the app to obtain the required token
catch (Exception)
{
return View("Relogin");
}
}
}
}
我原来的帖子中的 RefreshSession
和 GetTokenForApplication
方法仍然存在,但很可能会被 AzureAuthenticationProvider
类取代,因为我修改代码
最后,对Admin.cshtml做了一个小改动,我改变了
@using Microsoft.Azure.ActiveDirectory.GraphClient
@model IEnumerable<IUser>
至
@using Microsoft.Graph
@model List<User>
关于c# - Azure AD - 将所有用户基本信息提取到列表中,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/45948837/