使用WPF应用程序使用图连接到Azure AD api

Question

我试图用图来连接到wpf应用程序中的天蓝色AD。身份验证似乎很顺利，我得到一个访问令牌返回。我也可以使用这个令牌来获得关于我自己的基本信息。然而，当我试图从目录要求的东西我得到的错误：

Code":"JWT10315 Signature validation failed. Keys tried:

然后一大堆其他的东西。一切似乎都没问题。该应用程序在Azure中注册。我设置了正确的访问权限。我无能为力。任何人都可以帮助我？我的代码如下。

//using Microsoft.IdentityModel.Clients.ActiveDirectory; 
using Microsoft.Identity.Client; 
using System; 
using System.Collections.Generic; 
using System.Linq; 
using System.Text; 
using System.Threading.Tasks; 
using System.Windows; 
using System.Windows.Controls; 
using System.Windows.Data; 
using System.Windows.Documents; 
using System.Windows.Input; 
using System.Windows.Media; 
using System.Windows.Media.Imaging; 
using System.Windows.Navigation; 
using System.Windows.Shapes; 

namespace O365_Graph_Connector 
{ 
/// <summary> 
/// Interaction logic for MainWindow.xaml 
/// </summary> 
public partial class MainWindow : Window 
{ 
    //graph endpoint 
    //$upn="userPrincipalName eq '" + $user.Id +"'" 
    string url = "https://graph.windows.net/mydomain.com/activities/signinEvents?api-version=beta&`$filter=userPrincipalName eq 'upn@withheld.com'"; 
    //string url = "https://graph.microsoft.com/v1.0/me/"; 
    //Scopes 
    string[] _scopes = new string[] { "Directory.Read.All" }; 

    public MainWindow() 
    { 
     InitializeComponent(); 
     txtOutput.Text = "bla"; 


    } 

    private async void btnConnect_Click(object sender, RoutedEventArgs e) 
    { 

     AuthenticationResult authResult = null; 

     try 
     { 
      if (authResult == null) 
      { 
       authResult = await App.PublicClientApp.AcquireTokenSilentAsync(_scopes, App.PublicClientApp.Users.FirstOrDefault()); 
       Console.WriteLine("authenticated"); 
      } 
     } 
     catch (MsalUiRequiredException ex) 
     { 
      // A MsalUiRequiredException happened on AcquireTokenSilentAsync. This indicates you need to call AcquireTokenAsync to acquire a token 
      System.Diagnostics.Debug.WriteLine($"MsalUiRequiredException: {ex.Message}"); 

      try 
      { 
       Console.WriteLine("trying method2"); 
       authResult = await App.PublicClientApp.AcquireTokenAsync(_scopes); 

      } 
      catch (MsalException msalex) 
      { 
       txtOutput.Text = $"Error Acquiring Token:{System.Environment.NewLine}{msalex}"; 

      } 
     } 
     catch (Exception ex) 
     { 
      txtOutput.Text = $"Error Acquiring Token Silently:{System.Environment.NewLine}{ex}"; 
      return; 
     } 

     if (authResult != null) 
     { 
      //txtOutput.Text = await GetHttpContentWithToken(url, authResult.AccessToken); 
      String strResult = await GetHttpContentWithToken(url, authResult.AccessToken); 
      txtOutput.Text = strResult; 

     } 
    } 

    /// <summary> 
    /// Perform an HTTP GET request to a URL using an HTTP Authorization header 
    /// </summary> 
    /// <param name="url">The URL</param> 
    /// <param name="token">The token</param> 
    /// <returns>String containing the results of the GET operation</returns> 
    public async Task<string> GetHttpContentWithToken(string url, string token) 
    { 
     var httpClient = new System.Net.Http.HttpClient(); 
     System.Net.Http.HttpResponseMessage response; 
     try 
     { 
      var request = new System.Net.Http.HttpRequestMessage(System.Net.Http.HttpMethod.Get, url); 
      //Add the token in Authorization header 
      request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token); 
      response = await httpClient.SendAsync(request); 
      var content = await response.Content.ReadAsStringAsync(); 
      return content; 
     } 
     catch (Exception ex) 
     { 
      return ex.ToString(); 
     } 
    } 

    private void btnSignOut_Click(object sender, RoutedEventArgs e) 
    { 
     if (App.PublicClientApp.Users.Any()) 
     { 
      try 
      { 
       App.PublicClientApp.Remove(App.PublicClientApp.Users.FirstOrDefault()); 
       this.txtOutput.Text = "User has signed-out"; 
       //this.CallGraphButton.Visibility = Visibility.Visible; 
       //this.SignOutButton.Visibility = Visibility.Collapsed; 
      } 
      catch (MsalException ex) 
      { 
       txtOutput.Text = $"Error signing-out user: {ex.Message}"; 
       } 
      } 
     } 
    } 
} 

Answer 1

string url = " https://graph.windows.net/mydomain.com/activities/signinEvents?api-version=beta& `$filter=userPrincipalName eq 'upn@withheld.com'";

根据你的描述，你正在访问Azure Active Directory sign-in activity report API。我跟着这个tutorial来检查这个问题。我同时检查了仅限应用程序范围（应用程序作为没有登录用户的服务运行）和委托范围（委托登录用户的权限）与Directory.Read.All范围，我也可以检索用户的信息。

但是，当我通过邮递员使用访问令牌访问登录活动API Endpoint时，我收到响应并提示我将租户升级到Azure AD Premium层，然后选取我的目录并通过激活试用在Azure门户点击“公司品牌推广>免费赠送试用版”。一旦升级，我可以取回登入活动如下：

此外，我遇到了类似的问题如下：

在一般情况下，你可以利用jwt.io解码您的访问令牌并确保相关属性已被正确包含。