使用http post请求在Azure Active Directory (B2C)中使用Graph API创建一个新用

本文关键字：API Graph 创建 新用 一个 Azure 请求 Active Directory 使用 B2C | 更新日期: 2023-09-27 18:06:38

我以前一直在使用活动目录认证库(ADAL)以编程方式添加用户，但现在我需要定义"signInNames"(=用户电子邮件)，这似乎不可能与ADAL(请告诉我，如果我错了)。

现在我正试图使用HTTP POST以编程方式添加一个新用户(本地帐户)，遵循MSDN上的文档。

//Get access token (using ADAL)
var authenticationContext = new AuthenticationContext(AuthString, false);
var clientCred = new ClientCredential(ClientId, ClientSecret);
var authenticationResult = authenticationContext.AcquireTokenAsync(ResourceUrl, clientCred);
var token = authenticationResult.Result.AccessToken;

//HTTP POST CODE
const string mail = "new@email.com";
// Create a new user object.
var user = new CustomUser
{
    accountEnabled = true,
    country = "MS",
    creationType = "LocalAccount",
    displayName = mail,
    passwordPolicies = "DisablePasswordExpiration,DisableStrongPassword",
    passwordProfile = new passwordProfile { password = "jVPmEm)6Bh", forceChangePasswordNextLogin = true },
    signInNames = new signInNames { type = "emailAddress", value = mail }
};
var url = "https://graph.windows.net/" + TenantId + "/users?api-version=1.6";
var jsonObject = JsonConvert.SerializeObject(user);
using (var client = new HttpClient())
{
    client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
    var response = client.PostAsync(url,
        new StringContent(JsonConvert.SerializeObject(user).ToString(),
            Encoding.UTF8, "application/json"))
            .Result;
    if (response.IsSuccessStatusCode)
    {
        dynamic content = JsonConvert.DeserializeObject(
            response.Content.ReadAsStringAsync()
            .Result);
        // Access variables from the returned JSON object
        var appHref = content.links.applications.href;
    }
}

但是我没有成功，得到这个响应:

{StatusCode: 400, ReasonPhrase: 'Bad Request', Version: 1.1, Content:....}

有什么主意吗?我成功地使用了Powershell-script，但我需要在我的c#应用程序中这样做。

使用http post请求在Azure Active Directory (B2C)中使用Graph API创建一个新用

谢谢你的回复，费雪，我相信我有正确的权限。我是怎么解决问题的

首先，我删除了我自己的自定义类"NewUser"，然后我下载了这个示例项目:https://github.com/AzureADQuickStarts/B2C-GraphAPI-DotNet/blob/master/B2CGraphClient/B2CGraphClient.cs，以消除我的代码出错的风险。我修改了它以支持我的需要，然后创建了一个简单的JObject: 

var jsonObject = new JObject
                        {
                            {"accountEnabled", true},
                            {"country", customer.CustomerBase.Company},
                            {"creationType", "LocalAccount"},
                            {"displayName", pendingCustomer.Email.Trim()},
                            {"passwordPolicies", "DisablePasswordExpiration,DisableStrongPassword"},
                            {"passwordProfile", new JObject
                            {
                                {"password", pwd},
                                {"forceChangePasswordNextLogin", true}
                            } },
                            {"signInNames", new JArray
                                {
                                    new JObject
                                    {
                                        {"value", pendingCustomer.Email.Trim()},
                                        {"type", "emailAddress"}
                                    }
                                }
                            }
                        };
client = new B2CGraphClient(ClientId, ClientSecret, TenantId);
var response = await client.CreateUser(jsonObject.ToString());
var newUser = JsonConvert.DeserializeObject<User>(response);
从B2CGraphClient.cs 

        private async Task<string> SendGraphPostRequest(string api, string json)
    {
        // NOTE: This client uses ADAL v2, not ADAL v4
        var result = authContext.AcquireToken(Globals.aadGraphResourceId, credential);
        var http = new HttpClient();
        var url = Globals.aadGraphEndpoint + tenant + api + "?" + Globals.aadGraphVersion;
        var request = new HttpRequestMessage(HttpMethod.Post, url);
        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken);
        request.Content = new StringContent(json, Encoding.UTF8, "application/json");
        var response = await http.SendAsync(request);
        if (!response.IsSuccessStatusCode)
        {
            var error = await response.Content.ReadAsStringAsync();
            var formatted = JsonConvert.DeserializeObject(error);
            //Console.WriteLine("Error Calling the Graph API: 'n" + JsonConvert.SerializeObject(formatted, Formatting.Indented));
            Logger.Error("Error Calling the Graph API: 'n" + JsonConvert.SerializeObject(formatted, Formatting.Indented));
        }
        Logger.Info((int)response.StatusCode + ": " + response.ReasonPhrase);
        return await response.Content.ReadAsStringAsync();
    }

这最终解决了我所有的问题，这可能是我的newcustomer类序列化中的格式错误，然后被API拒绝了。

您是否授予应用程序足够的权限来操作用户?对于B2C租户，创建用户REST API对我来说很有效。

下面是我测试的步骤:

1。通过下面的PowerShell创建应用程序

PowerShell:
$bytes = New-Object Byte[] 32
$rand = [System.Security.Cryptography.RandomNumberGenerator]::Create()
$rand.GetBytes($bytes)
$rand.Dispose()
$newClientSecret = [System.Convert]::ToBase64String($bytes)
New-MsolServicePrincipal -DisplayName "My New B2C Graph API App" -Type password -Value

2。将应用程序授予用户帐户管理员角色

Add-MsolRoleMember -RoleObjectId fe930be7-5e62-47db-91af-98c3a49a38b1 -RoleMemberObjectId 7311370c-dac3-4f34-b2ce-b22c2a5a811e -RoleMemberType servicePrincipal

3。获取带有客户端凭证流的应用的令牌

POST: https://login.microsoftonline.com/adb2cfei.onmicrosoft.com/oauth2/token
grant_type=client_credentials&client_id={AppPrincipalId return by PowerShell}&client_secret={client_secret}&resource=https%3A%2F%2Fgraph.windows.net

4。使用下面的REST创建用户:

POST: https://graph.windows.net/adb2cfei.onmicrosoft.com/users?api-version=1.6
authorization: bearer {token}
content-type: application/json
{
  "accountEnabled": true,
  "creationType": "LocalAccount",
  "displayName": "Alex Wu",
  "passwordProfile": {
    "password": "Test1234",
    "forceChangePasswordNextLogin": false
  },
  "signInNames": [
    {
      "type": "userName",
      "value": "AlexW"
    },
    {
      "type": "emailAddress",
      "value": "AlexW@example.com"
    }
  ]
}
相关文章：