AAD Service Principal获取azure user list (Microsoft Graph API)

本段代码是个通用性很强的sample code，不仅能够操作AAD本身，也能通过Azure Service Principal的授权来访问和控制Azure的订阅资源。（Azure某种程度上能看成是两个层级：AAD+Subscription）

下文中的代码是演示的screenshot中的红字2的部分。红字1的部分的permission实质上是赋予AAD service principal操作订阅的权限（这个需要切换var resource = “https://management.core.chinacloudapi.cn/“）

预先准备

1. 注册一个Azure AD application
2. 对这个aad application赋予适当的权限

sample code 如下:

using Microsoft.IdentityModel.Clients.ActiveDirectory;
using Newtonsoft.Json;
using Newtonsoft.Json.Linq;
using System;
using System.Collections.Generic;
using System.Collections.Specialized;
using System.IO;
using System.Linq;
using System.Net;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;
using System.Threading.Tasks;
 
namespace AadGraphApi
{
    class Program
    {
        static void Main(string[] args)
        {
            //Demo below AAD graph api
            //1. List All users in AAD
            //2. Check user existence
            //3. Get AppRoleAssignment
            //4. implement the appRoleAssignment
 
            //Test MoonCake Azure
            //Task task = CnTest();
 
            //Test Global Azure
            Task task = CnTest();
            var x = task;
            Console.WriteLine("**--------done-------**");
            Console.ReadLine();
        }
        // using Http Request to get Token
        private static async Task<string> CnAppAuthenticationAsync()
        {
            // Using in Mooncake Azure
            // Constants
            var tenant = "";
            var resource = "https://graph.chinacloudapi.cn";
            //var resource = "https://management.core.chinacloudapi.cn/";
            var clientID = "";
            var secret = "";
            // Ceremony
            var authority = $"https://login.chinacloudapi.cn/{tenant}";
            var authContext = new AuthenticationContext(authority);
            var credentials = new ClientCredential(clientID, secret);
            var authResult = await authContext.AcquireTokenAsync(resource, credentials);
            return authResult.AccessToken;
        }
 
        private static async Task CnTest()
        {
            var token = await CnAppAuthenticationAsync();
 
            using (var client = new HttpClient())
            {
                //
                //be careful for the specific parameters in the URI . replace it with yours
                //
                client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
 
                var apiUriUserExist = new Uri("https://graph.chinacloudapi.cn/{yourtenantid}/users/**.partner.onmschina.cn?api-version=1.6");
                var apiUriListAllUser = new Uri("https://graph.chinacloudapi.cn/**.partner.onmschina.cn/users?api-version=1.6");
                var apiUriGetAppRoleAssignment = new Uri("https://graph.chinacloudapi.cn/**。partner.onmschina.cn/users/**.partner.onmschina.cn/appRoleAssignments?api-version=1.6");
 
                //var userExist = await DoesUserExistsAsync(client, apiUriUserExist);
                //Console.WriteLine($"Does user exists? {userExist}");
 
                var userLists = await ListAllUsers(client, apiUriListAllUser);
                Console.WriteLine(userLists);
                /*
                var appRoleList = await GetAppRoleAssignment(client, apiUriGetAppRoleAssignment);
                Console.WriteLine(appRoleList);
 
                //post request for AAD appRoleAssignment
                await CnPostAppRoleAssignment(client);
                //
                */
            }
        }
 
        private static async Task<bool> DoesUserExistsAsync(HttpClient client, Uri apiUri)
        {
            try
            {
                var payload = await client.GetStringAsync(apiUri);
                return true;
            }
            catch (HttpRequestException)
            {
                return false;
            }
        }
 
        private static async Task<string> ListAllUsers(HttpClient client, Uri apiUri)
        {
            try
            {
                var payload = await client.GetStringAsync(apiUri);
                return payload;
            }
            catch (HttpRequestException ex)
            {
                return ex.ToString();
            }
        }
    }
}

本段代码通过授权去拿Azure AD 中的user。还有很多其他的操作，比如delete user, list all user , Azure提供了一系列的Graph API 
同理我们也能通过Managment授权发送操作资源的http请求达到代码控制Azure订阅资源的目的。