获取 Microsoft Graph 的访问令牌

Question

I have a web application in C# through which I'm trying to get access token for Microsoft Graph API. I'm able to get tokens through using Client secret, but don't want to get the token by using the client secret but get the token by other means, want to get tokens without client secrets. I'm successfully getting the tokens using secrets and have stored them in KeyVault but getting an alert for " Explicit Credentials are being used for your application/service principals ", so require some alternative to get tokens. Is there any way to get tokens without secrets. Any help would be great.

Answer 1

One can use ROPC oAuth grant based on username and password instead of using Client Secrets to get access tokens. Microsoft identity platform supports the OAuth 2.0 Resource Owner Password Credentials (ROPC) grant, which allows an application to sign in the user by directly handling their password. Refer, https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth-ropc Warning: Microsoft recommends you do not use the ROPC flow. In most scenarios, more secure alternatives are available and recommended. This flow requires a very high degree of trust in the application, and carries risks which are not present in other flows. You should only use this flow when other more secure flows can't be used.

Answer 2

It is not a recommended way to use without client secret since due to security concerns.

If you still don't want to use client secret go with implicit grant flow which we can easily implement on the front end by maintaining SPA and passing token to the backend