如何使用.NET Core为Azure应用注册添加App Role

你之前用PostAsync方法会创建新应用注册，是因为该方法是新建应用的接口。要给已有的应用注册添加新App Role，需要先定位到目标应用，再调用更新接口（PatchAsync），具体操作如下：

1. 定位目标应用注册 #

先通过应用名称App_One查询获取它的Object ID：

// 查询App_One的应用注册，只获取ID和现有AppRoles
var targetApp = await graphClient.Applications
    .GetAsync(requestConfiguration =>
    {
        requestConfiguration.QueryParameters.Filter = "displayName eq 'App_One'";
        requestConfiguration.QueryParameters.Select = new[] { "id", "appRoles" };
    });

var appId = targetApp.Value.FirstOrDefault()?.Id;
if (appId == null)
{
    throw new Exception("未找到名称为App_One的应用注册");
}

2. 构造新的App Role #

创建新的App Role实例，注意生成唯一Guid作为Id（不能和已有角色重复）：

var newAppRole = new AppRole()
{
    DisplayName = "新增外部API权限",
    Description = "允许应用访问额外的外部资源",
    AllowedMemberTypes = new List<string>() { "Application" },
    Value = "Resource.External.Extra",
    IsEnabled = true,
    Id = Guid.NewGuid() // 必须是新的唯一Guid
};

3. 更新应用注册的App Roles #

获取应用现有App Roles列表，添加新角色后调用PatchAsync提交更新：

// 拿到现有AppRoles，为空则初始化空列表
var existingAppRoles = targetApp.Value.FirstOrDefault()?.AppRoles ?? new List<AppRole>();
existingAppRoles.Add(newAppRole);

// 构造更新请求体
var updateRequestBody = new Application
{
    AppRoles = existingAppRoles
};

// 调用更新接口
var result = await graphClient.Applications[appId].PatchAsync(updateRequestBody);

完整代码示例 #

整合后的完整运行代码：

var scopes = new[] { "https://graph.microsoft.com/.default" };
var tenantId = "-Confidential-";
var clientId = "-Confidential-";
var clientSecret = "-Confidential-";

var options = new TokenCredentialOptions
{
    AuthorityHost = AzureAuthorityHosts.AzurePublicCloud
};

var clientSecretCredential = new ClientSecretCredential(tenantId, clientId, clientSecret, options);
var graphClient = new GraphServiceClient(clientSecretCredential, scopes);

try
{
    // 1. 查询目标应用
    var targetApp = await graphClient.Applications
        .GetAsync(requestConfiguration =>
        {
            requestConfiguration.QueryParameters.Filter = "displayName eq 'App_One'";
            requestConfiguration.QueryParameters.Select = new[] { "id", "appRoles" };
        });

    var appId = targetApp.Value.FirstOrDefault()?.Id;
    if (appId == null)
    {
        Console.WriteLine("未找到名称为App_One的应用注册");
        return;
    }

    // 2. 创建新的App Role
    var newAppRole = new AppRole()
    {
        DisplayName = "新增外部API权限",
        Description = "允许应用访问额外的外部资源",
        AllowedMemberTypes = new List<string>() { "Application" },
        Value = "Resource.External.Extra",
        IsEnabled = true,
        Id = Guid.NewGuid()
    };

    // 3. 更新应用的App Roles
    var existingAppRoles = targetApp.Value.FirstOrDefault()?.AppRoles ?? new List<AppRole>();
    existingAppRoles.Add(newAppRole);

    var updateRequestBody = new Application
    {
        AppRoles = existingAppRoles
    };

    var result = await graphClient.Applications[appId].PatchAsync(updateRequestBody);
    Console.WriteLine("App Role添加成功，应用ID：" + result.Id);
}
catch (Exception ex)
{
    Console.WriteLine("操作失败：" + ex.Message);
}

关键注意事项 #

• 必须用PatchAsync而非PostAsync：PostAsync是创建新应用的接口，PatchAsync才是针对指定应用ID的更新接口。
• 新App Role的Id必须唯一：不能与应用中已有的任何App Role的Id重复。
• 保留原有角色：直接替换AppRoles列表会覆盖原有角色，因此需要先获取现有列表再添加新角色。

内容的提问来源于stack exchange，提问作者Afsar AF撒入