怎么用Java的SDK获得用户的目录角色

[weixin_38053139]

怎么用Java的SDK获得用户的目录角色

[weixin_38095150]

Hi zhanyucao,
建议您使用
Microsoft Graph API - 获取目录角色：
//get Access token for Rest API public void GetToken() { ExecutorService service = Executors.newFixedThreadPool(1); AuthenticationContext ac = new AuthenticationContext("https://login.chinacloudapi.cn/<tenantID>", true, service); Future<AuthenticationResult> future = ac.acquireToken("https://management.core.chinacloudapi.cn/", "<tenantID>", "<username>", "<password>", null); AuthenticationResult result = future.get(); String token = result.getAccessToken(); rest(token); } public static void rest(String accessToken) throws IOException{ URL url = new URL(String.format("https://microsoftgraph.chinacloudapi.cn/v1.0/directoryRoles")); HttpsURLConnection conn = (HttpsURLConnection)url.openConnection(); conn.setRequestProperty("Authorization", "Bearer " + accessToken); int responseCode = conn.getResponseCode(); InputStream input = conn.getErrorStream(); if (input == null) { input = conn.getInputStream(); } if (responseCode != 200) { throw new RuntimeException(input); } }
参考文档：中国区
Azure 应用程序开发说明

[weixin_38060626]

Hi zhanyucao,
建议您使用
Microsoft Graph API - 获取目录角色：
//get Access token for Rest API public void GetToken() { ExecutorService service = Executors.newFixedThreadPool(1); AuthenticationContext ac = new AuthenticationContext("https://login.chinacloudapi.cn/<tenantID>", true, service); Future<AuthenticationResult> future = ac.acquireToken("https://management.core.chinacloudapi.cn/", "<tenantID>", "<username>", "<password>", null); AuthenticationResult result = future.get(); String token = result.getAccessToken(); rest(token); } public static void rest(String accessToken) throws IOException{ URL url = new URL(String.format("https://microsoftgraph.chinacloudapi.cn/v1.0/directoryRoles")); HttpsURLConnection conn = (HttpsURLConnection)url.openConnection(); conn.setRequestProperty("Authorization", "Bearer " + accessToken); int responseCode = conn.getResponseCode(); InputStream input = conn.getErrorStream(); if (input == null) { input = conn.getInputStream(); } if (responseCode != 200) { throw new RuntimeException(input); } }
参考文档：中国区
Azure 应用程序开发说明

[weixin_38103061]

感谢您的回答，前几天我在https://github.com/Azure-Samples/active-directory-java-native-headless/blob/master/src/main/java/PublicClient.java看到了，我的是国际版的。报错
Enter username: zhanyucao******.onmicrosoft.com Enter password: ********* log4j:WARN No appenders could be found for logger (com.microsoft.aad.adal4j.UserDiscoveryRequest). log4j:WARN Please initialize the log4j system properly. log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info. Exception in thread "main" java.util.concurrent.ExecutionException: com.microsoft.aad.adal4j.AuthenticationException: {"error":"invalid_request","error_description":"AADSTS90019: No tenant-identifying information found in either the request or implied by any provided credentials.\r\nTrace ID: 0dbfd615-****-****-a4b5-fbbc04733300\r\nCorrelation ID: e31f5dce-eb28-****-****-9c4c2a55cf2c\r\nTimestamp: 2017-12-26 01:27:37Z"} at java.util.concurrent.FutureTask.report(FutureTask.java:122) at java.util.concurrent.FutureTask.get(FutureTask.java:188) at PublicClient.getAccessTokenFromUserCredentials(PublicClient.java:45) at PublicClient.main(PublicClient.java:26) Caused by: com.microsoft.aad.adal4j.AuthenticationException: {"error":"invalid_request","error_description":"AADSTS90019: No tenant-identifying information found in either the request or implied by any provided credentials.\r\nTrace ID: 0dbfd615-****-****-a4b5-fbbc04733300\r\nCorrelation ID: e31f5dce-****-****-b364-9c4c2a55cf2c\r\nTimestamp: 2017-12-26 01:27:37Z"} at com.microsoft.aad.adal4j.AdalTokenRequest.executeOAuthRequestAndProcessResponse(AdalTokenRequest.java:107) at com.microsoft.aad.adal4j.AuthenticationContext.acquireTokenCommon(AuthenticationContext.java:818) at com.microsoft.aad.adal4j.AuthenticationContext.access$100(AuthenticationContext.java:66) at com.microsoft.aad.adal4j.AuthenticationContext$1.call(AuthenticationContext.java:174) at com.microsoft.aad.adal4j.AuthenticationContext$1.call(AuthenticationContext.java:163) at java.util.concurrent.FutureTask.run(FutureTask.java:262) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) at java.lang.Thread.run(Thread.java:745)
同一个订阅换一个用户，报错
Enter username: [e-mail] Enter password: ***********AADSTS70002: The request body must contain the following parameter: 'client_secret or client_assertion'.
我没有修改过，您知道怎么回事吗？

[weixin_38108060]

Hi Zhanyucao,
我在本地测试过该 samplecode, 是没有问题的, 可以获取到 Token。
您是否有将以下 AUTHORITY 中的 common 修改为您自己的 tenant id 或 tenant name（zhanyucaoyungoal.onmicrosoft.com） ？
private final static String AUTHORITY = "https://login.microsoftonline.com/common/";

[weixin_38079368]

Hi Zhanyucao,
我在本地测试过该 samplecode, 是没有问题的, 可以获取到 Token。
您是否有将以下 AUTHORITY 中的 common 修改为您自己的 tenant id 或 tenant name（zhanyucaoyungoal.onmicrosoft.com） ？
private final static String AUTHORITY = "https://login.microsoftonline.com/common/";

[weixin_38111164]

按照您说的，我将common改为tenant
id后，报了另一个错
AADSTS50034: To sign into this application the account must be added to the 729ca88c-****-****-a639-cd5a4da3f2c3 directory
我用户名写的是域名（zhanyucaoyungoal.onmicrosoft.com）如果写[e-mail]的话还是报错
AADSTS70002: The request body must contain the following parameter: 'client_secret or client_assertion'.
是哪配置错了吗？我现在还不能截图。

[weixin_38082021]

Hi zhanyucao,
Tenant Name 可以通过以下方式在 Portal 中找到:

> AADSTS50034: To sign into this application the account must be added to the 729ca88c-****-****-a639-cd5a4da3f2c3 directory
通过该错误提示表明应该是您注册的应用程序在 729ca88c-****-****-a639-cd5a4da3f2c3 目录下，而您登录的用户名并不是该目录下的。
> AADSTS70002: The request body must contain the following parameter: 'client_secret or client_assertion'
该示例代码只适用于 本机 类型的应用程序, 对于 Web 应用/API 类型 的应用程序是不支持直接使用用户名/密码的方式登录的，请参见

Using ADAL .NET to Authenticate Users via Username/Password 的 No web sites/confidential clients 部分。
所以请检查下您注册应用程序时，选择的应用类型：

[weixin_38116045]

Hi zhanyucao,
Tenant Name 可以通过以下方式在 Portal 中找到:

> AADSTS50034: To sign into this application the account must be added to the 729ca88c-****-****-a639-cd5a4da3f2c3 directory
通过该错误提示表明应该是您注册的应用程序在 729ca88c-****-****-a639-cd5a4da3f2c3 目录下，而您登录的用户名并不是该目录下的。
> AADSTS70002: The request body must contain the following parameter: 'client_secret or client_assertion'
该示例代码只适用于 本机 类型的应用程序, 对于 Web 应用/API 类型 的应用程序是不支持直接使用用户名/密码的方式登录的，请参见

Using ADAL .NET to Authenticate Users via Username/Password 的 No web sites/confidential clients 部分。
所以请检查下您注册应用程序时，选择的应用类型：

[weixin_38130814]

非常感谢您的回复帮我解决了问题！我改为本机 类型的应用程序后
用户[e-mail]可以得到Token，用域名当用户名好像是不行的。但我的程序是web程序，不过这里https://github.com/Azure-Samples/active-directory-java-graphapi-web的代码帮助了我。