使用Azure AD凭据连接CRM Web服务

Question

I have a .NET MVC application that is going to work together with CRM 2016 Online. I added the Azure AD authentication to the project and it works fine so that users can log into it with the same accounts they use for CRM. If they are already logged, then there is no login screen.

The problem is I want to use these credentials to Fetch data from CRM, either by the Organization Service or Web Api.

How can I use the log in information I already have and pass it to the Service? Any code samples on this anywhere?

Seems like the ADAL would be the way to go. I tried this code here https://msdn.microsoft.com/en-us/library/gg327838.aspx

// Authenticate the registered application with Azure Active Directory.
AuthenticationContext authContext = 
new AuthenticationContext("https://login.windows.net/common", false);
AuthenticationResult result = authContext.AcquireToken(resource, clientId, new
                                                   Uri(redirectUrl));

There was no AuthenticationContext. I added the ADAL NuGet-package to get this. But fail! There is no AcquireToken method in AuthenticationContext. There is one called AcquireTokenASync, which has totally different parameters. So I'm stuck here too!

If this would work, could it use the Azure AD login I already have done, or would it popup a new login screen?

Answer 1

This might not be a perfect fit for your situation but you could.

1. Run your MVC app under a service account.
2. Use the service account credentials to access CRM.
3. When someone is logged into your MVC app, I presume you will have something like their email address or domain name available.
4. As the service account search CRM for systemuser records matching the email address or domain name. You need to find the system user record Id.
5. Create another IOrganizationService , but pass the the user record Id you found in CRM.
6. Effectively your service account is now impersonating the user logged into the MVC app. Anything you do will be done as the impersonated user.

Impersonate another user

// Retrieve the system user ID of the user to impersonate.
OrganizationServiceContext orgContext = new OrganizationServiceContext(_serviceProxy);
_userId = (from user in orgContext.CreateQuery<SystemUser>()
          where user.FullName == "Kevin Cook"
          select user.SystemUserId.Value).FirstOrDefault();

// To impersonate another user, set the OrganizationServiceProxy.CallerId
// property to the ID of the other user.
_serviceProxy.CallerId = _userId;

Impersonate another user using the Web API

POST [Organization URI]/api/data/v8.1/accounts HTTP/1.1
MSCRMCallerID: 00000000-0000-0000-000000000002
Accept: application/json
Content-Type: application/json; charset=utf-8
OData-MaxVersion: 4.0
OData-Version: 4.0

{"name":"Sample Account created using impersonation"}