快速入门：从 iOS 或 macOS 应用将用户登录并调用 Microsoft Graph APIQuickstart: Sign in users and call the Microsoft Graph API from an iOS or macOS app

• 04/22/2020
• • 
  • 

本快速入门包含一个代码示例，该示例演示了本机 iOS 或 macOS 应用程序如何使用 Microsoft 标识平台登录工作和学校帐户、获取访问令牌并调用 Microsoft Graph API。This quickstart contains a code sample that demonstrates how a native iOS or macOS application can use the Microsoft identity platform to sign in work and school accounts, get an access token, and call the Microsoft Graph API.

本快速入门适用于 iOS 和 macOS 应用。This quickstart applies to both iOS and macOS apps. 某些步骤只是 iOS 应用所需的。Some steps are needed only for iOS apps. 这些步骤会指出它们仅适用于 iOS。Those steps call out that they are only for iOS.

步骤 2：下载示例项目Step 2: Download the sample project

• 下载用于 iOS 的代码示例Download the Code Sample for iOS
• 下载用于 macOS 的代码示例Download the Code Sample for macOS

步骤 3：安装依赖项Step 3: Install dependencies

在终端窗口中导航到已下载代码示例所在的文件夹，然后运行 pod install 以安装最新的 MSAL 库。In a terminal window, navigate to the folder with the downloaded code sample and run pod install to install the latest MSAL library.

步骤 4：配置项目Step 4: Configure your project

更多信息More Information

阅读以下各部分来详细了解本快速入门。Read these sections to learn more about this quickstart.

获取 MSALGet MSAL

MSAL (MSAL.framework) 是一个库，用于用户登录和请求令牌，此类令牌用于访问受 Microsoft 标识平台保护的 API。MSAL (MSAL.framework) is the library used to sign in users and request tokens used to access an API protected by Microsoft identity platform. 可以使用以下过程将 MSAL 添加到应用程序中：You can add MSAL to your application using the following process:

$ vi Podfile

将以下代码添加到 podfile（使用项目的目标）：Add the following to this podfile (with your project's target):

use_frameworks!

target 'MSALiOS' do
   pod 'MSAL'
end

运行 CocoaPods 安装命令：Run CocoaPods installation command:

pod install

初始化 MSALInitialize MSAL

可以通过添加以下代码，为 MSAL 添加引用：You can add the reference for MSAL by adding the following code:

import MSAL

然后，使用以下代码对 MSAL 进行初始化：Then, initialize MSAL using the following code:

let authority = try MSALAADAuthority(url: URL(string: kAuthority)!)

let msalConfiguration = MSALPublicClientApplicationConfig(clientId: kClientID, redirectUri: nil, authority: authority)
self.applicationContext = try MSALPublicClientApplication(configuration: msalConfiguration)

其中：Where:
clientId	在 portal.azure.cn 中注册的应用程序的应用程序 IDThe Application ID from the application registered in portal.azure.cn
authority	Microsoft 标识平台终结点。The Microsoft identity platform endpoint. 在大多数情况下，这将是 https://login.partner.microsoftonline.cn/commonIn most of cases this will be https://login.partner.microsoftonline.cn/common
redirectUri	应用程序的重定向 URI。The redirect URI of the application. 可以传递“nil”以使用默认值，或传递自定义的重定向 URI。You can pass 'nil' to use the default value, or your custom redirect URI.

（仅适用于 iOS）其他应用要求For iOS only, additional app requirements

应用还必须在 AppDelegate 中包含以下内容。Your app must also have the following in your AppDelegate. 这样就可以在你进行身份验证时让 MSAL SDK 处理来自身份验证代理应用的令牌响应。This lets MSAL SDK handle token response from the Auth broker app when you do authentication.

func application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey : Any] = [:]) -> Bool {

       return MSALPublicClientApplication.handleMSALResponse(url, sourceApplication: options[UIApplication.OpenURLOptionsKey.sourceApplication] as? String)
   }

func scene(_ scene: UIScene, openURLContexts URLContexts: Set<UIOpenURLContext>) {

       guard let urlContext = URLContexts.first else {
           return
       }

       let url = urlContext.url
       let sourceApp = urlContext.options.sourceApplication

       MSALPublicClientApplication.handleMSALResponse(url, sourceApplication: sourceApp)
   }

最后，应用必须在 Info.plist 中有一个与 CFBundleURLTypes 一起的 LSApplicationQueriesSchemes 条目。Finally, your app must have an LSApplicationQueriesSchemes entry in your Info.plist alongside the CFBundleURLTypes. 该示例包含了此内容。The sample comes with this included.

<key>LSApplicationQueriesSchemes</key>
<array>
   <string>msauthv2</string>
   <string>msauthv3</string>
</array>

登录用户与请求令牌Sign in users & request tokens

MSAL 有两种用来获取令牌的方法：acquireToken 和 acquireTokenSilent。MSAL has two methods used to acquire tokens: acquireToken and acquireTokenSilent.

acquireToken：以交互方式获取令牌acquireToken: Get a token interactively

在某些情况下，用户必须与 Microsoft 标识平台交互。Some situations require users to interact with Microsoft identity platform. 对于这种情况，最终用户可能需要选择其帐户并输入其凭据，或许可应用的权限。In these cases, the end user may be required to select their account, enter their credentials, or consent to your app's permissions. 例如，For example,

• 用户首次登录应用程序The first time users sign in to the application
• 用户在重置其密码时需输入其凭据。If a user resets their password, they'll need to enter their credentials
• 当应用程序首次请求资源的访问权限时When your application is requesting access to a resource for the first time
• 需要 MFA 或其他条件访问策略时When MFA or other Conditional Access policies are required

let parameters = MSALInteractiveTokenParameters(scopes: kScopes, webviewParameters: self.webViewParamaters!)
self.applicationContext!.acquireToken(with: parameters) { (result, error) in /* Add your handling logic */}

其中：Where:
scopes	包含所请求的范围（即针对 Microsoft Graph 的 ["https://microsoftgraph.chinacloudapi.cn/user.read"] 或针对自定义 Web API (api://<Application ID>/access_as_user) 的 [ "<Application ID URL>/scope" ]）Contains the scopes being requested (that is, ["https://microsoftgraph.chinacloudapi.cn/user.read"] for Microsoft Graph or [ "<Application ID URL>/scope" ] for custom web APIs (api://<Application ID>/access_as_user)

acquireTokenSilent：以无提示方式获取访问令牌acquireTokenSilent: Get an access token silently

应用不应该要求其用户每次请求令牌时都要登录。Apps shouldn't require their users to sign in every time they request a token. 如果用户已登录，则此方法允许应用以无提示方式请求令牌。If the user has already signed in, this method allows apps to request tokens silently.

self.applicationContext!.getCurrentAccount(with: nil) { (currentAccount, previousAccount, error) in

   guard let account = currentAccount else {
      return
   }

   let silentParams = MSALSilentTokenParameters(scopes: self.kScopes, account: account)
   self.applicationContext!.acquireTokenSilent(with: silentParams) { (result, error) in /* Add your handling logic */}
}

其中：Where:
scopes	包含所请求的范围（即针对 Microsoft Graph 的 ["https://microsoftgraph.chinacloudapi.cn/user.read"] 或针对自定义 Web API (api://<Application ID>/access_as_user) 的 [ "<Application ID URL>/scope" ]）Contains the scopes being requested (that is, ["https://microsoftgraph.chinacloudapi.cn/user.read"] for Microsoft Graph or [ "<Application ID URL>/scope" ] for custom web APIs (api://<Application ID>/access_as_user)
account	正在请求其令牌的帐户。The account a token is being requested for. 本快速入门介绍单帐户应用程序。This quickstart is about a single account application. 如果要构建多帐户应用，则需要定义相关逻辑，以使用 accountsFromDeviceForParameters:completionBlock: 并传递正确的 accountIdentifier 来标识用于令牌请求的帐户If you want to build a multi-account app you'll need to define logic to identify which account to use for token requests using accountsFromDeviceForParameters:completionBlock: and passing correct accountIdentifier

后续步骤Next steps

试用 iOS 和 macOS 教程，了解有关如何构建应用程序的完整分步指南，包括本快速入门的完整说明。Try out the tutorial for iOS and macOS for a complete step-by-step guide on building applications, including a complete explanation of this quickstart.

了解如何创建本快速入门中使用的应用程序Learn how to create the application used in this quickstart

帮助和支持Help and support

如果需要帮助、需要报告问题，或者需要详细了解支持选项，请参阅以下文章：If you need help, want to report an issue, or want to learn more about your support options, see the following article: