Exception access Azure AD B2C using ADAL library f

2019-09-16 06:46发布

问题:

Since Microsoft Graph API doesn't have the feature to manage B2C AD Users, from one of the docs we have been asked to use ADAL which required to create a special application in the Azure AD B2C tenant. Created an application key to provide API access from the xamarin.ios app.

 AuthenticationContext authContext = new AuthenticationContext(authority);
            credential = new ClientCredential(clientId, GraphClientSecret);
            authResult = await authContext.AcquireTokenAsync(graphResourceUri, credential);

At the AcquireTokenAsync call we are getting an exception

 AcquireTokenHandlerBase.cs: System.NullReferenceException: Object reference not set to an instance of an object at Microsoft.IdentityModel.Clients.ActiveDirectory.BrokerHelper.get_CanInvokeBroker () [0x0000c] in <786d1e888b334ad993ac80d2bc3b6e92>:0 
  at Microsoft.IdentityModel.Clients.ActiveDirectory.AcquireTokenHandlerBase+<RunAsync>d__55.MoveNext () [0x00389] in <97581c6894a642ef95d008cded8ad4ac>:0 

If I change that call to removing the credentials, I just get a login screen.

Packages used:

Sample was taken from Sample from Docs

Any help would be greatly appreciated.

回答1:

You should NOT call the Graph API using Client Credentials from a native client application (such as a Xamarin/iOS app). This is a HUGE security hole. Client applications are inherently insecure, anyone can reflect the code and grab a hold of your client_id and client_secret which they can use to create/update/delete users in your Azure AD B2C tenant.

Your native client application should call a web API which would in turn call the Graph API. This web API (link to sample) is an API you build which has authorization logic to scope the user management operations.

Once user management in Azure AD B2C is supported via the Microsoft Graph and MSAL, you won't need this API and will be able to use delegated permissions (vs application permissions using client credentials) to have your native client application talk directly to the Microsoft Graph. In the interim, you'll have to stand up your own Web API as per the guidance above.