ADAL.NET-从API向API验证OnBehalfOf时，为什么需要AcquireTokenAsync？

Question

The canonical pattern for getting access tokens using ADAL.NET looks like this:

try
{
 result = await authContext.AcquireTokenSilentAsync(graphResourceId, clientId);
}
catch (AdalException adalException) 
{
 if (adalException.ErrorCode == AdalError.FailedToAcquireTokenSilently || adalException.ErrorCode == AdalError.UserInteractionRequired)
 {
  result = await authContext.AcquireTokenAsync(graphResourceId,
                                               clientCred, 
                                               userAssertion);
 }
} 

Supposedly AcquireTokenSilentAsync attempts to retrieve a token without user interaction, while AcquireTokenAsync prompts the user for permission. However...This function is being called within a Web API that's trying to call another Web API - so there's no way to prompt the user for permission at all. Which one do I use? Do I need to use both?

Answer 1

Typically, you just use the second (with userAssertion) since that's all you have in a WebAPI - the incoming token of a user of the client calling you. Note that this API will NOT prompt the user - that a different signature with PlatfromParameters. This API will exchange an incoming token addressed to this API for a token addressed to the API this one needs to call.