使用GraphAPI/C#在AzureAD中删除应用程序角色的问题

问题描述

我正在尝试使用VisualStudio/C#/GraphAPI在AzureAD中添加/删除应用程序角色.我可以成功地将用户添加到ApplicationRole中，但是Remove(或Delete)角色不起作用.

I am trying to Add/Remove Application Role in AzureAD using VisualStudio/C#/GraphAPI. I can successfully add user to ApplicationRole but Remove(or Delete) role doesn't work.

我在Internet上进行了研究，这似乎与AzureAD图形API本身有关.检查:

I researched on internet and it seems an issue with AzureAD graph API itself. check:

https://social.msdn.microsoft.com/Forums/sqlserver/zh-CN/5707763c-41f7-4465 -abdb-3a8d8ded153b/graph-api-apiversion15-如何从使用c-net的应用程序角色中删除用户?forum = WindowsAzureAD

但是，这是一篇过时的文章，所以不确定是否有任何解决方法.

However, it's an old post so not sure if any workaround is available now.

感谢您提供任何帮助来解决此问题.

Any help is appreciated to fix this issue.

推荐答案

我可以使用以下代码删除应用程序角色.

I can remove the application role with follow code.

var listRoles = user.AppRoleAssignments.ToList();
user.AppRoleAssignments.Remove(listRoles[0]); //just demo: you could remove the role as your wanted
user.UpdateAsync().Wait();

以下是我的详细测试演示代码

The following is my detail test demo code

1.获取访问令牌

private static async Task<string> GetAppTokenAsync(string graphResourceId, string tenantId, string clientId, string secretKey)
        {
            string aadInstance = "https://login.microsoftonline.com/" + tenantId + "/oauth2/token";
            AuthenticationContext authenticationContext = new AuthenticationContext(aadInstance, false);
            var result = await authenticationContext.AcquireTokenAsync(graphResourceId,
                new ClientCredential(clientId, userId));
            return result.AccessToken;
        }

2.初始化graphclient.

2.Init the graphclient.

var graphResourceId = "https://graph.windows.net";
var tenantId = "tenantId";
var clientId = "client Id";
var secretKey = "secret key";
var servicePointUri = new Uri(graphResourceId); 
var serviceRoot = new Uri(servicePointUri, tenantId);
var activeDirectoryClient = new ActiveDirectoryClient(serviceRoot, async () => await GetAppTokenAsync(graphResourceId, tenantId, clientId, secretKey));

3.创建应用程序和服务主体

3.create application and service principal

 Application appObject = new Application { DisplayName = "Test-Demo App" };
 appObject.IdentifierUris.Add("https://localhost/demo/" + Guid.NewGuid());
 appObject.ReplyUrls.Add("https://localhost/demo");
 AppRole appRole = new AppRole
 {
    Id = Guid.NewGuid(),
    IsEnabled = true,
    DisplayName = "Something",
    Description = "Anything",
    Value = "policy.write"
 };

 appRole.AllowedMemberTypes.Add("User");
 appObject.AppRoles.Add(appRole);
 activeDirectoryClient.Applications.AddApplicationAsync(appObject).Wait();
 // create a new Service principal
 ServicePrincipal newServicePrincpal = new ServicePrincipal
 {
    DisplayName = appObject.DisplayName,
    AccountEnabled = true,
    AppId = appObject.AppId
 };
activeDirectoryClient.ServicePrincipals.AddServicePrincipalAsync(newServicePrincpal).Wait();

4.add角色分配

User user = (User) activeDirectoryClient.Users.GetByObjectId("userobjectId").ExecuteAsync().Result;
AppRoleAssignment appRoleAssignment = new AppRoleAssignment
{
       Id = appRole.Id,
       ResourceId = Guid.Parse(newServicePrincpal.ObjectId),
       PrincipalType = "User",
       PrincipalId = Guid.Parse(user.ObjectId),

  };
user.AppRoleAssignments.Add(appRoleAssignment);
user.UpdateAsync().Wait();

5.从用户删除角色

var listRoles = user.AppRoleAssignments.ToList();
user.AppRoleAssignments.Remove(listRoles[0]);
user.UpdateAsync().Wait();

这篇关于使用GraphAPI/C#在AzureAD中删除应用程序角色的问题的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！