获取令牌以使用守护程序应用程序调用 Web API

下面是将 Web API 的范围定义为 appsettings.json 文件中的部分配置的示例。 此示例摘自 GitHub 上的 .NET 控制台守护程序代码示例。

{
    "AzureAd": {
        // Same AzureAd section as before.
    },

    "MyWebApi": {
        "BaseUrl": "https://localhost:44372/",
        "RelativePath": "api/TodoList",
        "RequestAppToken": true,
        "Scopes": [ "[Enter here the scopes for your web API]" ]
    }
}

在Java中，将默认Microsoft Graph范围定义为常量：

final static String GRAPH_DEFAULT_SCOPE = "https://microsoftgraph.chinacloudapi.cn/.default";

在 Node.js中，在令牌请求对象中指定范围：

const tokenRequest = {
    scopes: [process.env.GRAPH_ENDPOINT + '.default'], // e.g. 'https://microsoftgraph.chinacloudapi.cn/.default'
};

在 MSAL Python 中，该配置文件应该如以下代码片段所示：

{
    "scope": ["https://microsoftgraph.chinacloudapi.cn/.default"],
}

在低级别.NET代码中，通过追加/.default到资源 ID 来生成范围：

ResourceId = "someAppIDURI";
var scopes = new [] {  ResourceId+"/.default"};

使用 Microsoft。Identity.Web 不需要直接获取令牌。 可以使用更高级别的 API，如从守护程序应用程序调用一个 Web API中所示。 但如果使用的是需要令牌的 SDK，则可以通过抽象获取应用令牌 ITokenAcquirer ，如以下示例所示：

using Microsoft.Extensions.DependencyInjection;
using Microsoft.Identity.Abstractions;
using Microsoft.Identity.Web;

// In the Program.cs, acquire a token for your downstream API

var tokenAcquirerFactory = TokenAcquirerFactory.GetDefaultInstance();
ITokenAcquirer acquirer = tokenAcquirerFactory.GetTokenAcquirer();
AcquireTokenResult tokenResult = await acquirer.GetTokenForUserAsync(new[] { "https://microsoftgraph.chinacloudapi.cn/.default" });
string accessToken = tokenResult.AccessToken;

以下Java令牌获取示例摘自 MSAL Java开发示例。

private static IAuthenticationResult acquireToken() throws Exception {

     // Load token cache from file and initialize token cache aspect. The token cache will have
     // dummy data, so the acquireTokenSilently call will fail.
     TokenCacheAspect tokenCacheAspect = new TokenCacheAspect("sample_cache.json");

     IClientCredential credential = ClientCredentialFactory.createFromSecret(CLIENT_SECRET);
     ConfidentialClientApplication cca =
             ConfidentialClientApplication
                     .builder(CLIENT_ID, credential)
                     .authority(AUTHORITY)
                     .setTokenCacheAccessAspect(tokenCacheAspect)
                     .build();

     IAuthenticationResult result;
     try {
         SilentParameters silentParameters =
                 SilentParameters
                         .builder(SCOPE)
                         .build();

         // try to acquire token silently. This call will fail since the token cache does not
         // have a token for the application you are requesting an access token for
         result = cca.acquireTokenSilently(silentParameters).join();
     } catch (Exception ex) {
         if (ex.getCause() instanceof MsalException) {

             ClientCredentialParameters parameters =
                     ClientCredentialParameters
                             .builder(SCOPE)
                             .build();

             // Try to acquire a token. If successful, you should see
             // the token information printed out to console
             result = cca.acquireToken(parameters).join();
         } else {
             // Handle other exceptions accordingly
             throw ex;
         }
     }
     return result;
 }

以下代码片段说明了 MSAL 节点机密客户端应用程序中的令牌获取：

try {
    const authResponse = await cca.acquireTokenByClientCredential(tokenRequest);
    console.log(authResponse.accessToken) // display access token
} catch (error) {
    console.log(error);
}

以下示例演示了 MSAL Python 模式，用于使用客户端凭据获取仅限应用的访问令牌：

result = None

# First, the code looks up a token from the cache.
# Because we're looking for a token for the current app, not for a user,
# use None for the account parameter.
result = app.acquire_token_silent(config["scope"], account=None)

if not result:
    logging.info("No suitable token exists in cache. Let's get a new one from Azure AD.")
    result = app.acquire_token_for_client(scopes=config["scope"])

if "access_token" in result:
    # Call a protected API with the access token.
    print(result["token_type"])
else:
    print(result.get("error"))
    print(result.get("error_description"))
    print(result.get("correlation_id"))  # You might need this when reporting a bug.

using Microsoft.Identity.Client;

// With client credentials flows, the scope is always of the shape "resource/.default" because the
// application permissions need to be set statically (in the portal or by PowerShell), and then granted by
// a tenant administrator.
string[] scopes = new string[] { "https://microsoftgraph.chinacloudapi.cn/.default" };

AuthenticationResult result = null;
try
{
 result = await app.AcquireTokenForClient(scopes)
                  .ExecuteAsync();
}
catch (MsalUiRequiredException ex)
{
    // The application doesn't have sufficient permissions.
    // - Did you declare enough app permissions during app creation?
    // - Did the tenant admin grant permissions to the application?
}
catch (MsalServiceException ex) when (ex.Message.Contains("AADSTS70011"))
{
    // Invalid scope. The scope has to be in the form "https://resourceurl/.default"
    // Mitigation: Change the scope to be as expected.
}

AcquireTokenForClient 使用应用程序令牌缓存

在 MSAL.NET 中，AcquireTokenForClient 使用应用程序令牌缓存。 （所有其他 AcquireTokenXX 方法都使用用户令牌缓存。）不要在调用 AcquireTokenSilent 之前调用 AcquireTokenForClient，因为 AcquireTokenSilent 使用“用户” 令牌缓存。 AcquireTokenForClient 会检查应用程序令牌缓存本身并对其进行更新。

转到此方案中的下一篇文章：调用 Web API。

转到此方案中的下一篇文章：调用 Web API。

转到此方案中的下一篇文章：调用 Web API。

转到此方案中的下一篇文章：调用 Web API。

转到此方案中的下一篇文章：调用 Web API。