需要使用C＃Rest调用生成Azure AD承载令牌

Question

I want to generate a Azure AD bearer token via C# REST call. I want to write the user registration logic inside an API call. I am using this as token endpoint :

https://login.windows.net/[tenant-id]/oauth2/token

I followed the same procedure as described in this article.

The user credential I am using is a "Global Administrator".

But I am still getting 'Unauthorized' error. Please find the code snippet and response body below-

Code

using (HttpClient client = new HttpClient())
        {
            var tokenEndpoint = @"https://login.windows.net/<tanent-name>/oauth2/token";
            var accept = "application/json";

            client.DefaultRequestHeaders.Add("Accept", accept);
            string postBody = @"resource=https%3A%2F%2Fgraph.microsoft.com%2F
              &client_id=<client-id>
              &grant_type=password
              &username=<admin-user-name>
              &password=<admin-pass>
              &scope=openid";

            using (var response = await client.PostAsync(tokenEndpoint, new StringContent(postBody, Encoding.UTF8, "application/x-www-form-urlencoded")))
            {
                if (response.IsSuccessStatusCode)
                {
                    var jsonresult = JObject.Parse(await response.Content.ReadAsStringAsync());
                    var token = (string)jsonresult["access_token"];
                    return token;
                }
                else
                    return null;
            }
        }

Response Body

{ StatusCode: 401, ReasonPhrase: 'Unauthorized',
  Version: 1.1, Content: System.Net.Http.StreamContent, Headers:
{
  Pragma: no-cache
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  X-Content-Type-Options: nosniff
  x-ms-request-id: cabefe46-ff73-4659-80a2-2f4136200900
  Cache-Control: no-store, no-cache
  P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
  Set-Cookie: esctx=AQABAAAAAADX8GCi6Js6SK82TsD2Pb7...
  Set-Cookie: x-ms-gateway-slice=004; path=/; secure; HttpOnly
  Set-Cookie: stsservicecookie=ests; path=/; secure; HttpOnly
  Server: Microsoft-IIS/10.0
  X-Powered-By: ASP.NET
  Date: Thu, 24 May 2018 13:43:39 GMT
  Content-Length: 457
  Content-Type: application/json; charset=utf-8
  Expires: -1
}}

PS- Also please point out if there is any other way of adding new user without doing the REST call. I don't want to have user registration in the client application.

[Update] Please find the screenshot of added permissions and roles.

Answer 1

As Tom mentioned, your issue shoud be caused by the user doesn't have permission to your App.

Since you're using ROPC grant flow, make sure that the user is the owner of that Client/AAD App.

You can add onwer to the AAD app:

Go to Azure portal > Azure Acitve Directory > Application Registration > The App > Settings > Owners > Add owner > Select that user.

Additonal, if the user has enabled MFA, this flow won't work.

Let me know if it helps!

Answer 2

Also please point out if there is any other way of adding new user without doing the REST call. I don't want to have user registration in the client application.

If you want to create user, we could use the Microsoft.Graph to do that.

Before that we need to registry the Azure AD application . And add the Microsoft graph permission. For more details we could refer to the Create User API .

I test it with Directory.ReadWrite.All permission. Don't forget to Grant permissions.

Demo code.

string graphResourceId = "https://graph.microsoft.com/";
string authority = "https://login.microsoftonline.com/{0}";
string tenantId = "tenant Id";
string clientId = "client Id";
string secret = "secret";
authority = String.Format(authority, tenantId);
AuthenticationContext authContext = new AuthenticationContext(authority);
var accessToken = authContext.AcquireTokenAsync(graphResourceId, new ClientCredential(clientId, secret)).Result.AccessToken;
            var graphserviceClient = new GraphServiceClient(
                new DelegateAuthenticationProvider(
                    requestMessage =>
                    {
                        requestMessage.Headers.Authorization = new AuthenticationHeaderValue("bearer", accessToken);

                        return Task.FromResult(0);
                    }));
var user = new User
         {
             UserPrincipalName = "tomaccount1@xxxxx.onmicrosoft.com",
             AccountEnabled = true,
             DisplayName = "tom1",
             PasswordProfile = new PasswordProfile
             {
                 ForceChangePasswordNextSignIn = true,
                 Password = "1234qweA!@#$%6"
             },
              MailNickname = "tomaccount1"
            };
 var addUserResult = graphserviceClient.Users.Request().AddAsync(user).Result;

Test Result:

Check from Azure AD

Packages.config

<?xml version="1.0" encoding="utf-8"?>
<packages>
  <package id="Microsoft.Graph" version="1.9.0" targetFramework="net471" />
  <package id="Microsoft.Graph.Core" version="1.9.0" targetFramework="net471" />
  <package id="Microsoft.IdentityModel.Clients.ActiveDirectory" version="3.19.4" targetFramework="net471" />
  <package id="Newtonsoft.Json" version="11.0.2" targetFramework="net471" />
  <package id="System.IO" version="4.3.0" targetFramework="net471" />
  <package id="System.Net.Http" version="4.3.3" targetFramework="net471" />
  <package id="System.Runtime" version="4.3.0" targetFramework="net471" />
  <package id="System.Security.Cryptography.Algorithms" version="4.3.1" targetFramework="net471" />
  <package id="System.Security.Cryptography.Encoding" version="4.3.0" targetFramework="net471" />
  <package id="System.Security.Cryptography.Primitives" version="4.3.0" targetFramework="net471" />
  <package id="System.Security.Cryptography.X509Certificates" version="4.3.2" targetFramework="net471" />
</packages>