dongxian7194 2018-04-22 00:44 采纳率: 0%
浏览 47
已采纳

在没有oAuth的情况下针对Azure AD验证用户凭据

I am looking to use Azure AD as my authentication system but do not want to bounce my users out to the Microsoft login page as it is disruptive and the fact that users may or may not have personal and or work accounts seems to make it quite confusing for most.

I have researched this quite a bit over the past few days but only find resources that show me AAD libraries in .NET, Azure Graph and Microsoft Graph API's. All of which seem to be convoluted systems that do the oAuth bounce through the Microsoft sign in window.

I am using Golang, but am an MSCA in .NET. If there are references to source code in .net that do not require proprietary / closed source DLL files I can use that as a starting point, or otherwise, if there is some reference point perhaps that shows how to use the MS Graph API to send username and password (entered on my site) and receive some positive or negative response indicating if the credentials provided match an account in my Azure AD would be great.

For example, I know of using https://msdn.microsoft.com/en-us/library/azure/ad/graph/api/users-operations to create, get, list, update and delete users. But it doesn't seem to have a validate or authorize procedure (unless of course I'm simply missing it).

My question is, is there a way to validate credentials without using oAuth through the Microsoft account sign in? If so can someone provide reference and or a bit of psuedo code to get me going in the right direction? Thanks in advance!

  • 写回答

1条回答 默认 最新

  • duankuangxie9070 2018-04-22 09:04
    关注

    Basically no. No other OAuth/OpenIdConnect identity provider that I am aware of offers this either. What if the account requires Multi-Factor Authentication?

    There is Resource Owner Password Credentials grant flow, but I would recommend not using it, since it does not work for accounts with MFA for instance. That flow allows "non-interactive" authentication. But if interaction is needed, it fails.

    OAuth/OpenId Connect being "convoluted" is a matter of personal opinion. Certain things are the way they are to make the process secure. The redirect is necessary because the user is signing in to Office 365, not your app. They should not give their passwords to you.

    Seems people have been looking for a MS Graph library for Go: https://github.com/microsoftgraph/MSGraph-SDK-Code-Generator/issues/53. No official one exists at the moment though :/

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论

报告相同问题?

悬赏问题

  • ¥15 执行 virtuoso 命令后,界面没有,cadence 启动不起来
  • ¥50 comfyui下连接animatediff节点生成视频质量非常差的原因
  • ¥20 有关区间dp的问题求解
  • ¥15 多电路系统共用电源的串扰问题
  • ¥15 slam rangenet++配置
  • ¥15 有没有研究水声通信方面的帮我改俩matlab代码
  • ¥15 ubuntu子系统密码忘记
  • ¥15 信号傅里叶变换在matlab上遇到的小问题请求帮助
  • ¥15 保护模式-系统加载-段寄存器
  • ¥15 电脑桌面设定一个区域禁止鼠标操作