如何从 Azure AD 获取 TokenCredentials 的访问令牌？

Question

I am trying to connect to my Azure account and for that I need to create TokenCredentials object which need access token as a parameter. But I'm having problems to get that access token.

I have tried to do as this samle is guiding: https://github.com/Azure-Samples/azure-batch-samples/blob/master/CSharp/AccountManagement/Program.cs

Here is the code that I am trying to run:

public static async Task<ServiceClientCredentials> CreateTokenCredentialsAsync()
{
    var clientId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
    var redirectUri = "https://myredirecturi.com";
    var authorityUri = "https://login.microsoftonline.com/common";
    var resourceUri = "https://management.core.windows.net/";

    var platformPrameters = new PlatformParameters(PromptBehavior.Auto);

    var authContext = new AuthenticationContext(authorityUri);
    AuthenticationResult authResult = await authContext.AcquireTokenAsync(
        resourceUri,
        clientId,
        new Uri(redirectUri),
        platformPrameters);

    var token = authResult.AccessToken;

    ServiceClientCredentials creds = new TokenCredentials(authResult.AccessToken);

    return creds;
}

And I am getting following exception:

Invalid resource.
The client has requested access to a resource which is not listed in the requested permissions in the client's application registration.
Client app ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx(<my registered app name>).
Resource value from request: https://management.core.windows.net/.
Resource app ID: yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyy. 
List of valid resources from app registration: ...

What should I do to make this work and get access token?

Answer 1

Sounds like you haven't added Azure Service Management API to your Required permissions when registering the app in Azure AD.

First, find your app registration in Azure AD. Then go to API permissions. Click Add a permission.

Then click Azure Service Management.

Choose user_impersonation under Delegated permissions and click Add permissions.

Now you should be able to get the login dialog to show up. It will ask you for consent to access the ARM API as you. If you want to avoid those prompts and allow the app to call ARM API as any signed-in user in your tenant, you can click Grant admin consent for tenant name on the API permissions tab (assuming you are an admin).