在 C# 中使用 Azure AD Graph API 将角色添加到已创建的应用程序

Question

如何在 c# 中使用 Azure AD Graph API 在 azure ad 上创建的应用程序中添加角色。
我在 C# 中创建这样的角色：

 Guid _id = new Guid();

 AppRole appRole = new AppRole

    {
      AllowedMemberTypes = _AllowedMemberTypes,
      Description = "Admins can manage roles and perform all actions.",
      DisplayName = "Global Admin",
      Id = _id,
      IsEnabled = true,
      Value = "Admin"
    };

使用 Azure AD Graph API.

将使用什么调用在应用程序中添加这个新角色

Answer 1

您可以参考以下代码分配应用程序角色。

1.get 访问令牌

private static async Task<string> GetAppTokenAsync(string graphResourceId, string tenantId, string clientId, string secretKey)
        {
            string aadInstance = "https://login.microsoftonline.com/" + tenantId + "/oauth2/token";
            AuthenticationContext authenticationContext = new AuthenticationContext(aadInstance, false);
            var result = await authenticationContext.AcquireTokenAsync(graphResourceId,
                new ClientCredential(clientId, userId));
            return result.AccessToken;
        }

2.Init 图形客户端。

var graphResourceId = "https://graph.windows.net";
var tenantId = "tenantId";
var clientId = "client Id";
var secretKey = "secret key";
var servicePointUri = new Uri(graphResourceId); 
var serviceRoot = new Uri(servicePointUri, tenantId);
var activeDirectoryClient = new ActiveDirectoryClient(serviceRoot, async () => await GetAppTokenAsync(graphResourceId, tenantId, clientId, secretKey));

3.create角色

AppRole appRole = new AppRole
{
    Id = Guid.NewGuid(),
    IsEnabled = true,
    Description = "Admins can manage roles and perform all actions.",
    DisplayName = "Global Admin",
    Value = "Admin"
};

4.add 角色分配

User user = (User) activeDirectoryClient.Users.GetByObjectId("userobjectId").ExecuteAsync().Result;
AppRoleAssignment appRoleAssignment = new AppRoleAssignment
{
       Id = appRole.Id,
       ResourceId = Guid.Parse(newServicePrincpal.ObjectId),
       PrincipalType = "User",
       PrincipalId = Guid.Parse(user.ObjectId),

  };
user.AppRoleAssignments.Add(appRoleAssignment);
user.UpdateAsync().Wait();

Answer 2

我终于能够使用 Azure Ad Graph 在 Azure 上创建一个新角色 API

1) 创建一个角色：

Guid _id = Guid.NewGuid();
List<String> _AllowedMemberTypes = new List<string> {
    "User"
};
AppRole appRole = new AppRole
{
    AllowedMemberTypes = _AllowedMemberTypes,
    Description = "Admins can manage roles and perform all actions.",
    DisplayName = "Global Admin",
    Id = _id,
    IsEnabled = true,
    Value = "Admin"

};

2) 获取需要在其中创建角色的应用程序：

IPagedCollection<IApplication> pagedCollection = await activeDirectoryClient.Applications.Where(x => x.AppId == AppclientId).ExecuteAsync();
var appObject = pagedCollection.CurrentPage.ToList().FirstOrDefault();

3) 向应用程序添加角色并更新应用程序：

 appObject.AppRoles.Add(appRole as AppRole);
 await appObject.UpdateAsync();

在 C# 中使用 Azure AD Graph API 将角色添加到已创建的应用程序

Add role to already created application using Azure AD Graph API in C#

c#

azure

azure-active-directory

azure-ad-graph-api