在 Azure Active Directory 控制台代码 C# 中获取响应的问题

Question

I am trying to execute below code to search a user in Azure Active Directory:

using Newtonsoft.Json;
using System;
using System.Collections.Generic;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Net.Mail;
using System.IO;

namespace AADConsoleApp
{
    class Program
    {
          static void Main(string[] args)
          {
             async System.Threading.Tasks.Task MySearchResult()
             {
                string search_url= "https://XXXXX-XXX.XX-XX.XXX.io/api/legacy/users?email=XXXX@XXX";

                try
                {
                    HttpClient client = new HttpClient();
                    client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic",
                        Convert.ToBase64String(
                            System.Text.ASCIIEncoding.ASCII.GetBytes(
                                string.Format("{0}:{1}", "username", "password"))));

                    using (client)
                    {
                        HttpResponseMessage responsemMsg = await client.GetAsync(AD_API_Name_Search_URL);

                        Console.WriteLine("Hello");

                        if (responsemMsg.IsSuccessStatusCode)
                        {
                            var apiResponse = await responsemMsg.Content.ReadAsStringAsync();
                        }
                    }
                }
                catch (Exception ex)
                {
                }
            }

            MySearchResult();
          }
    }
}

But, I am unable to get anything in response and below line fails:

HttpResponseMessage responsemMsg = await client.GetAsync(search_url);

Please help me fix this problem.

Answer 1

As far as I know, you need to use Azure AD Graph API or Microsoft Graph API to retrieve a user. And, Microsoft Graph API is now officially recommended.

On the other hand, both Azure AD Graph API and Microsoft Graph API are protected by Azure AD which uses OAuth2 authorization, not basic authorization. You may get-started with Authentication and authorization basics for Microsoft Graph

So, basically, you need to do the following steps:

1. Register an app in Azure portal . And
2. Choose right scopes. For example, the Get a user API needs one of the following permission:

3. Get access on behalf of a user (delegated permission) or Get access without a user (application permission)

4. Call Grapp API with token. Here is a sample:

class Program
{
    public static string GetDelegatedToken()
    {
        string token = null;

        using (HttpClient hc = new HttpClient())
        {
            hc.DefaultRequestHeaders.TryAddWithoutValidation("Cache-Control", "no-cache");

            var body = new List<KeyValuePair<string, string>>();
            body.Add(new KeyValuePair<string, string>("grant_type", "password"));
            // Set scope
            body.Add(new KeyValuePair<string, string>("scope", "User.Read"));
            // The app id of the app you registered in Azure AD
            body.Add(new KeyValuePair<string, string>("client_id", "dc17****-****-****-****-****a5e7"));
            // The secret you created in your app
            body.Add(new KeyValuePair<string, string>("client_secret", "/pG******************32"));
            // Change it with your own user id
            body.Add(new KeyValuePair<string, string>("username", "jack@hanxia.onmicrosoft.com"));
            body.Add(new KeyValuePair<string, string>("password", "your password"));

            // Change e4c9ab4e-bd27-40d5-8459-230ba2a757fb with your tenant id
            var result = hc.PostAsync("https://login.microsoftonline.com/e4c9ab4e-bd27-40d5-8459-230ba2a757fb/oauth2/v2.0/token", new FormUrlEncodedContent(body)).Result;

            var json = JsonConvert.DeserializeObject<JObject>(result.Content.ReadAsStringAsync().Result);
            token = json["access_token"].ToString();
        }

        return token;
    }


    static void Main(string[] args)
    {
        using (HttpClient hc = new HttpClient())
        {
            hc.DefaultRequestHeaders.TryAddWithoutValidation("Cache-Control", "no-cache");
            hc.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", GetDelegatedToken());
            var result = hc.GetAsync("https://graph.microsoft.com/v1.0/users/jack@hanxia.onmicrosoft.com").Result;
            result.Content.CopyToAsync(Console.OpenStandardOutput()).GetAwaiter().GetResult();
        }
        Console.WriteLine();
    }
}

Response: