在 .Net Core 的声明中获取 Azure AD 用户所属的组列表

Question

我正在尝试使用“隐式流”中生成的令牌获取 Azure AD 用户属于 .Net Core 中的组列表。没有群组信息。

我正在使用以下链接中提到的“隐式流”： .NET Core and Azure Active Directory integration

以下显示了如何在 .NET Framework 中执行此操作，但 .NET Core 没有“ActiveDirectoryClient”类。

Get a list of groups that Azure AD user belongs to in claims

非常感谢任何帮助！

德里克

Answer 1

你可以先在manifest中设置groupMembershipClaims属性为SecurityGroup，然后登录后在asp.net core中获取组列表：

var groups = User.Claims.Where(c => c.Type == "groups").ToList();

更新：

然后您可以调用 Azure AD Graph api 来获取组信息。首先参考代码示例：https://github.com/Azure-Samples/active-directory-dotnet-webapp-webapi-openidconnect-aspnetcore

在 .net core 应用中，您可以获取组对象 id 并调用图形 api：

https://graph.windows.net/myorganization/groups/<objectid>?api-version=1.6

您可以在应用程序的Required permissions 刀片中为Windows Azure Active Directory 设置Read all groups 委派权限。然后尝试下面的代码来获取组名：

        try
        {

            var groups = User.Claims.Where(c => c.Type == "groups").ToList();


            string userObjectID = (User.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier"))?.Value;
            AuthenticationContext authContext = new AuthenticationContext(Startup.Authority, new NaiveSessionCache(userObjectID, HttpContext.Session));
            ClientCredential credential = new ClientCredential(Startup.ClientId, Startup.ClientSecret);
            result = await authContext.AcquireTokenSilentAsync(Startup.GraphResourceId, credential, new UserIdentifier(userObjectID, UserIdentifierType.UniqueId));

            //
            // Retrieve the group information.
            //
            HttpClient client = new HttpClient();
            HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, "https://graph.windows.net/myorganization/groups/"+ groups[1].Value + "?api-version=1.6" );
            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken);
            HttpResponseMessage response = await client.SendAsync(request);


            if (response.IsSuccessStatusCode)
            {
                List<Dictionary<String, String>> responseElements = new List<Dictionary<String, String>>();
                JsonSerializerSettings settings = new JsonSerializerSettings();
                String responseString = await response.Content.ReadAsStringAsync();
                var model = JsonConvert.DeserializeObject<RootObject>(responseString);
                var groupName = model.displayName;
            }
            else
            {

                if (response.StatusCode == System.Net.HttpStatusCode.Unauthorized)
                {

                }
            }
        }
        catch (Exception ee)
        {

        }

以下集团实体供您参考：

   public class RootObject
        {
            public string objectType { get; set; }
            public string objectId { get; set; }
            public object deletionTimestamp { get; set; }
            public string description { get; set; }
            public object dirSyncEnabled { get; set; }
            public string displayName { get; set; }
            public object mail { get; set; }
            public string mailNickname { get; set; }
            public bool mailEnabled { get; set; }
            public bool securityEnabled { get; set; }
        }