MSAL没有在缓存中存储令牌

Question

这是代码：

using Microsoft.Identity.Client;

var scopes = new string[] { "user.read" };
var clientId = "4a1aa1d5-c567-49d0-ad0b-cd957a47f842";
var tenant = "common";
var authority = "https://login.microsoftonline.com/" + tenant;
IPublicClientApplication publicClientApp;
AuthenticationResult authResult;

publicClientApp = PublicClientApplicationBuilder.Create(clientId)
  .WithAuthority(authority)
  .WithRedirectUri("http://localhost:8080")
  .Build();

var accounts = await publicClientApp
  .GetAccountsAsync()
  .ConfigureAwait(false);
IAccount? firstAccount = accounts.FirstOrDefault();

authResult = await publicClientApp
  .AcquireTokenInteractive(new string[] { "user.read" })
  .ExecuteAsync()
  .ConfigureAwait(false);

authResult = await publicClientApp
  .AcquireTokenSilent(new string[] { "user.read" }, firstAccount)
  .ExecuteAsync();

这是正在抛出的异常：

Unhandled exception. MSAL.NetCore.4.44.0.0.MsalUiRequiredException: 
        ErrorCode: user_null
Microsoft.Identity.Client.MsalUiRequiredException: No account or login hint was passed to the AcquireTokenSilent call. 
   at Microsoft.Identity.Client.Internal.Requests.Silent.SilentRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.Silent.SilentRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.ApiConfig.Executors.ClientApplicationBaseExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenSilentParameters silentParameters, CancellationToken cancellationToken)
   at Program.<Main>$(String[] args) in /home/adrian/temp/microsoft-identity-platform/simpler-version-public/Program.cs:line 25
   at Program.<Main>(String[] args)
        StatusCode: 0 
        ResponseBody:  
        Headers:

csproj文件：

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net6.0</TargetFramework>
    <RootNamespace>simpler_version_public</RootNamespace>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.Identity.Client" Version="4.44.0" />
  </ItemGroup>

</Project>

我的理解是，调用AcquireTokenInteractive()应该自动将令牌存储在缓存中，而AcquireTokenSilent()则从缓存中获取令牌。那我为什么要犯错误呢？我在WSL中运行这段代码，dotnet --version返回6.0.300。

Answer 1

在GetAccountsAsync之前调用AcquireTokenInteractive，它不会返回任何帐户。没有帐户传递给AcquireTokenSilent，而且此方法不知道应该为哪个帐户获取访问令牌。

在打电话给GetAccountsAsync之后，需要打电话给AcquireTokenInteractive。在这种情况下，它将返回帐户，AcquireTokenSilent将从指定帐户的缓存中获取令牌。

authResult = await publicClientApp
  .AcquireTokenInteractive(new string[] { "user.read" })
  .ExecuteAsync()
  .ConfigureAwait(false);

var accounts = await publicClientApp
  .GetAccountsAsync()
  .ConfigureAwait(false);
IAccount? firstAccount = accounts.FirstOrDefault();    

authResult = await publicClientApp
  .AcquireTokenSilent(new string[] { "user.read" }, firstAccount)
  .ExecuteAsync();

Answer 2

根据微软在Github存储库中提供的示例，您只需将app.AddInMemoryTokenCache()与ConfidentialClientApplicationBuilder一起使用，new StorageCreationPropertiesBuilder(...).WithLinuxKeyring(...)与PublicClientApplicationBuilder一起使用即可。