从使用AzureAD身份验证的ASP.net Core WebApp以身份验证的用户身份调用Microsoft Graph API

Question

I have a Asp.NET Core MVC 2.2 WebApp that uses Azure Active Directory to log-in users, configured like this:

public void ConfigureServices(IServiceCollection services){
    //...

    services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
            .AddAzureAD(options => configuration.Bind("AzureAd", options));

    //...
}

All the required info is configured in appsettings.json (ClientID, TenantID, domain, etc.) and the login process works perfectly without issues.

Now, when the user calls a certain action in a certain controller, I would like to make a few calls to the Microsoft Graph API. As I understand, since I'm already logged in as an authenticated AzureAD user, this should not be a problem, since I should be able to set the required Delgated permissions and then use an instance of GraphServiceClient (from the Microsoft.Graph library) to make the calls:

[HttpGet("[action]")]
public IActionResult Test()
{
    GraphServiceClient graphClient = GetGraphServiceClient(); //HOW????

    //... make calls etc.

    return Ok("OK");
}

The problem is that, when searching online, I got completely lost on HOW to obtain a authenticated instance of GraphServiceClient . I found several samples, but all using completely different approaches, and often requiring dozens of extra classes and support methods. Is it really that complicated?

So my question is, what is the best/simplest way to call the Microsoft Graph API in my scenario? To recap:

• I need to call the Graph API from an action method in one of my controllers
• The user will always be authenticated when the call is made, and the delegated permissions are properly set in the AzureAD console, so all that is needed (in theory) is to obtain a working graph client

Can someone provide a minimal sample?

Answer 1

You can get the GraphServiceClient like this:

   var accessToken = "";
    var graphserviceClient = new GraphServiceClient(
    new DelegateAuthenticationProvider(
    (requestMessage) =>
    {
        requestMessage.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
        return Task.FromResult(0);
    }));

Here is the aspnetcore sample for your reference.

Update:

That's why I've asked if there was a more straightforward way.

Yes, there is. You can choose the appropriate authentication provider here to create the GraphServiceClient.

GraphServiceClient graphClient = new GraphServiceClient(authProvider);