从 Microsoft Graph 获取所有用户

Question

I have an ASP.NET MVC application that is registered in Azure Active Directory. I am adding a new feature to the app which will require a list of all users from AAD. By putting together some code snippets I got from various MSDN docs, this is what my method to get the users looks like so far:

public async Task GetUsers()
{
    string clientId = ConfigurationManager.AppSettings["ida:ClientId"];
    string tenant = ConfigurationManager.AppSettings["ida:Tenant"];
    string clientSecret = ConfigurationManager.AppSettings["ida:ClientSecret"];

    IConfidentialClientApplication confidentialClientApplication = ConfidentialClientApplicationBuilder
            .Create(clientId)
            .WithTenantId(tenant)
            .WithClientSecret(clientSecret)
            .Build();

    ClientCredentialProvider authProvider = new ClientCredentialProvider(confidentialClientApplication);

    GraphServiceClient graphClient = new GraphServiceClient(authProvider);

    var users = await graphClient.Users.Request().GetAsync();
}

However, when I run the application, I get Original exception: AADSTS7000215: Invalid client secret is provided. I double checked to make sure that the client secret that I added to web.config matches what's shown in AAD, and that the client secret hasn't expired. I even deleted the client secret and created a new one, but that didn't fix the problem either. I also ensured that the permission User.Read.All of type Application has been granted for this app. What could be causing this error, and what could be done to resolve it? Also, I'm wondering if there's a simpler way to get a list of users given that I already have authentication set up for this app using Owin.IAppBuilder. Here's what I have in my Startup.cs file:

    public class Startup
    {
        private static string clientId = ConfigurationManager.AppSettings["ida:ClientId"];
        private static string aadInstance = ConfigurationManager.AppSettings["ida:AADInstance"];
        private static string tenant = ConfigurationManager.AppSettings["ida:Tenant"];
        private static string postLogoutRedirectUri = ConfigurationManager.AppSettings["ida:PostLogoutRedirectUri"];

        string authority = string.Format(CultureInfo.InvariantCulture, aadInstance, tenant);

        public void Configuration(IAppBuilder app)
        {
            ConfigureAuth(app);
        }

        public void ConfigureAuth(IAppBuilder app)
        {
            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
            app.UseCookieAuthentication(new CookieAuthenticationOptions());
            app.UseOpenIdConnectAuthentication(
                new OpenIdConnectAuthenticationOptions()
                {
                    ClientId = clientId,
                    Authority = authority,
                    PostLogoutRedirectUri = postLogoutRedirectUri,
                    Notifications = new OpenIdConnectAuthenticationNotifications
                    {
                        AuthenticationFailed = ctx => {
                            ctx.HandleResponse();
                            ctx.Response.Redirect("/Error/messages" + ctx.Exception.Message);
                            return Task.FromResult(0);
                        }
                } });
        }
    }

Answer 1

It works for me this way (using WithAuthority), I did not need any additional scopes:

string clientId = ConfigurationManager.AppSettings["ida:ClientId"];
string aadInstance = ConfigurationManager.AppSettings["ida:AADInstance"];
string tenantId = ConfigurationManager.AppSettings["ida:TenantId"];
string clientSecret = ConfigurationManager.AppSettings["ida:ClientSecret"];

IConfidentialClientApplication confidentialClientApplication = ConfidentialClientApplicationBuilder
    .Create(clientId)
    .WithAuthority(new Uri($"{aadInstance}{tenantId}/"))
    .WithClientSecret(clientSecret)
    .Build();

and then...

return await graphClient.Users
    .Request()
    .GetAsync();