如何从Azure AD B2C获取用户组信息

Posted 2021-04-08

我正在使用Microsoft Graph来获取用户信息，即"List users" API。

以下是访问用户信息的代码：

  ClientCredential clientCred = new ClientCredential(clientId, clientSecret);
  AuthenticationResult authenticationResult = await authenticationContext.AcquireTokenAsync(resourceId, clientCred);
  string token = authenticationResult.AccessToken;
  Debug.WriteLine("token=" + token);   

  var responseString = String.Empty;
  string[] scopes = { "User.Read" };

  using (var client = new HttpClient())
  {
    string requestUrl = "https://graph.microsoft.com/v1.0/users?$select=id,givenName,surname";

    HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, requestUrl);
    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
    Debug.WriteLine(request.ToString());

    HttpResponseMessage response = client.SendAsync(request).Result;

    responseString = response.Content.ReadAsStringAsync().Result;

    Debug.WriteLine(responseString);
  }

输出：

 {    
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users(id,givenName,surname)",
"value": [
    {
        "id": "000000000-0000-0000-000-000000000",
        "givenName": "XXX",
        "surname": "XXX"
    }, {
        "id": "000000000-0000-0000-000-000000000",
        "givenName": "XXX",
        "surname": "XXX"
    }
]
 }

如何获取用户组？

答案

您可以调用user: getMemberGroups API操作让用户获取其组：

您需要这样发出请求：

POST https://graph.microsoft.com/v1.0/users/user-id-here/getMemberGroups
Content-type: application/json
Content-length: 33

{
  "securityEnabledOnly": true
}

securityEnabledOnly参数定义是否仅应返回安全组。将其设置为false还将返回例如用户的Office 365组成员身份。

一种替代方法是使用memberOf导航属性：

GET https://graph.microsoft.com/v1.0/users/user-id-here/memberOf

这将返回用户是其直接成员的组和目录角色。