使用 C# 刷新 MS Graph 的身份验证令牌

Question

如何刷新身份验证令牌 Microsoft Graph using Microsoft Graph .NET Client Library 或其他使用 C#?

我目前正在做的是将令牌保存在静态 class:

public class TokenKeeper
{
    public static string token = null;
    public static string AcquireToken()
    {
        if (token == null || token.IsEmpty())
        {
            throw new Exception("Authorization Required.");
        }
        return token;
    }
    public static void Clear()
    {
        token = null;
    }
}

我在Startup里填token class:

public partial class Startup
{
    private static string AppKey = CloudConfigurationManager.GetSetting("ida:Password");
    private static string aadInstance = CloudConfigurationManager.GetSetting("ida:AADInstance");
    private static string TenantName = CloudConfigurationManager.GetSetting("ida:Tenant");
    private static string Authority = String.Format(CultureInfo.InvariantCulture, aadInstance, TenantName);
    private static string graphResourceId = CloudConfigurationManager.GetSetting("ida:GraphUrl");
    private BpContext db = new BpContext();

    public void Configuration(IAppBuilder app)
    {
        ConfigureAuth(app);
    }

    public void ConfigureAuth(IAppBuilder app)
    {
        string ClientId = CloudConfigurationManager.GetSetting("ida:ClientID");
        string Authority = "https://login.microsoftonline.com/common/";

        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

        app.UseCookieAuthentication(new CookieAuthenticationOptions());

        app.UseOpenIdConnectAuthentication(
            new OpenIdConnectAuthenticationOptions
            {
                ClientId = ClientId,
                Authority = Authority,
                Scope = "User.ReadBasic.All",
                //Details omitted
                    AuthorizationCodeReceived = (context) =>
                    {
                        var code = context.Code;
                        // Create a Client Credential Using an Application Key
                        ClientCredential credential = new ClientCredential(ClientId, AppKey);
                        string userObjectID = context.AuthenticationTicket.Identity.FindFirst(
                            "http://schemas.microsoft.com/identity/claims/objectidentifier").Value;
                        AuthenticationContext authContext = new AuthenticationContext(Authority, new NaiveSessionCache(userObjectID));
                        AuthenticationResult result = authContext.AcquireTokenByAuthorizationCode(
                            code, new Uri(HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Path)), credential, graphResourceId);                    
                        TokenKeeper.token = result.AccessToken;

                        return Task.FromResult(0);
                    }
                     //Details omitted
                }
            });
    }
}

我也在注销时清除了令牌。

Answer 1

AuthenticationResult 对象包含访问令牌和刷新令牌。因此，刷新令牌也可以像访问令牌一样持久化在 TokenKeeper 中。当访问令牌过期时（由 AuthenticationResult.ExpiresOn 指示），使用刷新令牌和 AuthenticationContext.AcquireTokenByRefreshToken 方法获取新的访问令牌。

如果您不想明确跟踪刷新令牌，请参阅 ADAL Cache 了解 ADAL 库如何为您完成。

Answer 2

您可以通过提供与 AccessToken 一起收到的 RefreshToken 来刷新访问令牌。由于您的代码中有 ID/Secret 可用，因此您可以使用它们来提供 ClientCredential。代码示例为：

var authContext = new AuthenticationContext("https://login.microsoftonline.com/common");
var result = authContext.AcquireTokenByRefreshToken(refreshToken, new ClientCredential(ClientId, AppKey));

使用 C# 刷新 MS Graph 的身份验证令牌

Refresh auth token for MS Graph with C#

c#

oauth

dotnetopenauth

microsoft-graph-api