如何將所有者添加到Azure Active Directory應用程序

Question

我正在通過以下代碼注冊AAD應用程序

ActiveDirectoryClient activeDirectoryClient = new ActiveDirectoryClient(serviceRoot, async () => await GetAppTokenAsync());

            Application application = new Application()
            {
                AvailableToOtherTenants = false,
                DisplayName = appName,
                ErrorUrl = null,
                GroupMembershipClaims = null,
                Homepage = "http://"+appName,
                IdentifierUris = new List<string>() { "https://"+appName }, 
                KeyCredentials = new List<KeyCredential>(),
                KnownClientApplications = new List<Guid>(),
                LogoutUrl = null,
                Oauth2AllowImplicitFlow = false,
                Oauth2AllowUrlPathMatching = false,
                Oauth2Permissions = new List<OAuth2Permission>(),
                Oauth2RequirePostResponse = false,
                // PasswordCredentials = new List<PasswordCredential>(),
                PasswordCredentials = new List<PasswordCredential>(),
                PublicClient = false,
                ReplyUrls = new List<string>(),
                // RequiredResourceAccess = new List<RequiredResourceAccess>(),
                RequiredResourceAccess = new List<RequiredResourceAccess>(),
                SamlMetadataUrl = null,
                ExtensionProperties = new List<ExtensionProperty>(),
                Manager = null,
                ObjectType = "Application",
                DeletionTimestamp = null,
                CreatedOnBehalfOf = null,
                CreatedObjects = new List<DirectoryObject>(),
                DirectReports = new List<DirectoryObject>(),
                Members = new List<DirectoryObject>(),
                MemberOf = new List<DirectoryObject>(),
                Owners = new List<DirectoryObject>(),
                OwnedObjects = new List<DirectoryObject>(),
                Policies = new List<DirectoryObject>()
            };

我還有一個類型為Microsoft.Azure.ActiveDirectory.GraphClient.User的對象，其中包含要添加為應用程序所有者的User的所有信息。

我怎樣才能做到這一點？

我嘗試的方式就是這樣做

activeDirectoryClient.Applications.AddApplicationAsync(application).Wait();

            ServicePrincipal newServicePrincpal = new ServicePrincipal();
            if (application != null)
            {
                newServicePrincpal.DisplayName = application.DisplayName;
                newServicePrincpal.AccountEnabled = true;
                newServicePrincpal.AppId = application.AppId;
                newServicePrincpal.Owners.Add(user);

                try
                {
                    activeDirectoryClient.ServicePrincipals.AddServicePrincipalAsync(newServicePrincpal).Wait();
                }
                catch (Exception e)
                {
                    Console.WriteLine(e.Message);
                }
            }

但是，當我在Azure門戶中手動導航到應用程序時，出現的唯一所有者是我自己的帳戶，而不是我在用戶變量中獲得的其他帳戶

知道如何將其他所有者添加到應用程序嗎？

Answer 1

我也可以重現此問題。 此問題的根本原因是，Azure AD Graph庫在嘗試創建服務主體時不提供所有者信息。

如果要添加服務主體的所有者，則可以在創建服務主體后使用以下代碼：

var activeDirectoryClient = GraphHelper.CreateGraphClient();
var sp = (ServicePrincipal)activeDirectoryClient.ServicePrincipals.GetByObjectId("4af8365b-1b49-481c-8c47-7b3fab5611fc").ExecuteAsync().Result;
var user = new Users().GetUserByUserName(activeDirectoryClient, "user2@adfei.onmicrosoft.com").Result;
sp.Owners.Add(user);
sp.UpdateAsync();

如果要添加application的所有者，請參考以下代碼：

var activeDirectoryClient = GraphHelper.CreateGraphClient();
var app = (Application)activeDirectoryClient.Applications.GetByObjectId("bd87934b-dd4f-446a-a025-7675d1b2464a").ExecuteAsync().Result;
var user = new Users().GetUserByUserName(activeDirectoryClient, "user2@adfei.onmicrosoft.com").Result;
app.Owners.Add(user);
app.UpdateAsync();

有關應用程序和服務主體之間區別的更多詳細信息，請檢查此文檔 。

而且，如果您希望Graph客戶端庫在創建所有者時支持添加所有者，則可以嘗試從此處提交反饋。

更新資料

public static ActiveDirectoryClient CreateGraphClient()
{
    string accessToken = "";
    string tenantId= "";
    string graphResourceId = "https://graph.windows.net";

    Uri servicePointUri = new Uri(graphResourceId);
    Uri serviceRoot = new Uri(servicePointUri, tenantId);

    ActiveDirectoryClient activeDirectoryClient = new ActiveDirectoryClient(serviceRoot, async () => await Task.FromResult(accessToken));

    return activeDirectoryClient;
}

添加一個runalbe代碼示例以添加服務主體的所有者： https : //github.com/VitorX/AddServicePrincipalWithOwner

更新2

在運行完上面的代碼示例之后，您可以使用如下所示的Fiddler捕獲結果。 通過創建服務主體的響應，我們可以獲得服務主體的對象ID：

然后，我們可以通過REST檢查主體的所有者，如下圖所示：