azure - 通过 Web API 而不是 Graph API 重置 Azure AD 密码

Question

无法使用 Graph API 更改密码

Unsupported end-user operations
    Any end user resetting their own password by using PowerShell version 1, version 2, or the Microsoft Graph API.

https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-writeback#unsupported-writeback-operations

在阅读上述内容之前，我尝试使用以下代码更改密码:

实例化GraphServiceClient

string[] scopes = new string[] { "User.Read", "Directory.AccessAsUser.All", "User.Invite.All" };

IPublicClientApplication app = PublicClientApplicationBuilder.Create(clientId)
    .WithAuthority(authority)
    .WithTenantId(tenantId)
    .Build();

var securePassword = new SecureString();
foreach (char c in user.Password.ToCharArray())  // you should fetch the password
    securePassword.AppendChar(c);  // keystroke by keystroke

var tokens = app.AcquireTokenByUsernamePassword(scopes, user.UserName, securePassword).ExecuteAsync().Result;

graphClient = new GraphServiceClient(
    new DelegateAuthenticationProvider(x =>
    {
        x.Headers.Authorization = new AuthenticationHeaderValue(
            "Bearer", tokens.AccessToken);

        return Task.FromResult(0);
    }));

更改密码尝试:

public async Task<ActionResult> ResetPassword([FromBody] JObject data)
{
    try
    {
        await graphClient.Me
        .ChangePassword(data["currentPassword"].ToString(), data["newPassword"].ToString())
        .Request()
        .PostAsync();
...
}

允许用户重置密码的步骤是什么(以编程方式/Azure 门户)？是否有其他方法可以在不使用 Graph API 的情况下更改密码？

Answer 1

我的解决方案是配置 Azure AD Connect 的帐户权限

我必须在 Azure AD Connect 中启用密码写回；-)