错误：由于对用户的挑战而抛出了msaluirequiredException

Question

我正在尝试进行基本的Microsoft Graph API调用，但是每当我调用getAccessTokenForuserAsync（）函数以获取令牌时，我会收到此错误。这是ASP.NET Core 6 MVC应用程序。

program.cs：

JwtSecurityTokenHandler.DefaultMapInboundClaims = false;

// Add services to the container.
builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
.AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"))
    .EnableTokenAcquisitionToCallDownstreamApi(initialScopes)
        .AddMicrosoftGraph(builder.Configuration.GetSection("MicrosoftGraph"))
        .AddInMemoryTokenCaches();

appsettings.json：

"MicrosoftGraph": {
    "BaseUrl": "https://graph.microsoft.com/v1.0",
    "Scopes": "user.read"
},

控制器：

[AuthorizeForScopes(Scopes = new string[] { "user.read" })]
public class UserManagementController : Controller
{
    ...
    [AuthorizeForScopes(Scopes = new string[] { "user.read" })]
    public async Task<IActionResult> Index()
    {
        try
        {
             var accessToken = await _tokenAcquisition.GetAccessTokenForUserAsync(new string[] { "user.read" });
             return View();
        }
        catch(Exception ex)
        {
            return BadRequest("An error occurred loading the user management page.");
        }
    }
}

我尝试过许多解决方案。错误总是相同的：

由于用户面临挑战，因此抛出了msaluirequiredException。没有帐户或登录提示传递给AccelireTokenSilent Call

我只是想让基本知识正常工作，没有任何幻想。

Answer 1

请让我在这里分享一个例子。

首先，让我们添加MS Identity UI，创建一个名为_loginPartial.cshtml in views/sharone文件夹中的部分视图。

@using System.Security.Principal

<ul class="navbar-nav">
@if (User.Identity.IsAuthenticated)
{
        <li class="nav-item">
            <span class="navbar-text text-dark">Hello @User.Identity.Name!</span>
        </li>
        <li class="nav-item">
            <a class="nav-link text-dark" asp-area="MicrosoftIdentity" asp-controller="Account" asp-action="SignOut">Sign out</a>
        </li>
}
else
{
        <li class="nav-item">
            <a class="nav-link text-dark" asp-area="MicrosoftIdentity" asp-controller="Account" asp-action="SignIn">Sign in</a>
        </li>
}
</ul>

然后将部分视图添加到_Layout.cshtml：＆lt; partial name =“ _ loginPartial”/＆gt;

然后在program.cs.cs中，通过设置Azure Ad agentication以下代码，并在app.useeauthorization（）;之前添加app.useateentication（）;：

string[]? initialScopes = builder.Configuration.GetValue<string>("DownstreamApi:Scopes")?.Split(' ');
builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
.AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"))
    .EnableTokenAcquisitionToCallDownstreamApi(initialScopes)
        .AddMicrosoftGraph(builder.Configuration.GetSection("MicrosoftGraph"))
        .AddInMemoryTokenCaches();
// Add services to the container.
builder.Services.AddControllersWithViews(options =>
{
    var policy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .Build();
    options.Filters.Add(new AuthorizeFilter(policy));
}).AddMicrosoftIdentityUI(); 

这些需要以下包装：

<PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="6.0.6" />
<PackageReference Include="Microsoft.Identity.Web.MicrosoftGraph" Version="1.25.1" />
<PackageReference Include="Microsoft.Identity.Web.UI" Version="1.25.1" />

然后appSettings.json，添加类似下面的属性：

"AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "tenant_name.onmicrosoft.com",
    "TenantId": "common",
    "ClientId": "azure_ad_client_id",
    "ClientSecret": "client_secret",
    "CallbackPath": "/signin-oidc"
  },
  "DownstreamApi": {
    "BaseUrl": "https://graph.microsoft.com/v1.0",
    "Scopes": "user.read"
  }

然后添加[授权]为HOME Con​​troller添加，以便您在渲染索引页面之前要求您登录。

[Authorize]
public class HomeController : Controller
{
    private readonly ITokenAcquisition _tokenAcquisition;

    public HomeController(ITokenAcquisition tokenAcquisition)
    {
        _tokenAcquisition = tokenAcquisition;
    }

    [AuthorizeForScopes(ScopeKeySection = "DownstreamApi:Scopes")]
    public async Task<IActionResult> IndexAsync()
    {
        string accessToken = await _tokenAcquisition.GetAccessTokenForUserAsync(new string[] { "user.read" });
        return View();
    }
}