How do I use OpenID and Microsoft Graph to enumerate Azure ActiveDirectory groups?

0
votes

I have the following values:

How do I use these values to create a Microsoft Graph service client?

var graphClient = new GraphServiceClient(
    // What goes here?
);

I need the client to enumerate AAD groups.

1
c#azure-active-directorymicrosoft-graph-api

1 Answers

1
votes

Based on your description, I assumed that you are using the AAD v1.0, for using the Microsoft Graph client SDK, you need to add Required permissions to the Microsoft Graph API with the application permissions or delegated permissions for your AAD application on Azure Portal. Differences between application permissions and delegated permissions, you could follow here.

For web application and use the user-based authentication flow, you could follow the samples below:

Calling the Azure AD Graph API in a web application

Microsoft Graph Snippets Sample for ASP.NET 4.6

Note: For your scenario, you need to combine the code in the above two samples. Or you could just create the AAD v2.0 application and just use the second sample.

For server to server scenario, you could just use ADAL to retrieve the access token to initialize your GraphServiceClient:

    private static async Task<string> GetAccessTokenAsync()
    {
        string tenantId = "<tenantId>";
        string clientId = "<clientId>";
        string clientSecrets = "<clientSecrets>";
        Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationResult result = null;

        var context = new AuthenticationContext(String.Format("https://login.windows.net/{0}", tenantId)); 

        var authParam = new PlatformParameters(PromptBehavior.Never, null);
        var result = await context.AcquireTokenAsync(
                "https://graph.microsoft.com"
                , new Microsoft.IdentityModel.Clients.ActiveDirectory.ClientCredential(clientId, clientSecrets)
                );
        return result.AccessToken;
    }

//initialize the GraphServiceClient instance
var graphClient = new GraphServiceClient(
            "https://graph.microsoft.com/v1.0",
            new DelegateAuthenticationProvider(
                async (requestMessage) =>
                {
                    var token = await GetAccessTokenAsync();
                    requestMessage.Headers.Authorization = new AuthenticationHeaderValue("bearer", token);
                }));