ASP.NET Web Api AddMicrosoftGraph

[brianpmccullough]

Hello, I've been following along to add Microsoft Graph to an ASP.NET Core 6 Web Api: https://github.com/AzureAD/microsoft-identity-web/blob/jmprieur/Graph5/src/Microsoft.Identity.Web.GraphServiceClient/Readme.md

I have tried different permutations of adding the config, but getting the following when attempting to access the Graph using the GraphServiceClient to simply get the current user's details (name, photo, etc).

If it helps any, I am generating the initial Bearer token using AadHttpClient within SharePoint Framework (SPFx). See: https://learn.microsoft.com/en-us/sharepoint/dev/spfx/use-aadhttpclient

I have confirmed my project is using the following references (latest for .NET Core 6):

    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="6.0.20" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="6.0.20" />
    <PackageReference Include="Microsoft.Identity.Web" Version="2.13.0" />
    <PackageReference Include="Microsoft.Identity.Web.GraphServiceClient" Version="2.13.0" />

MSAL.NetCore.4.54.1.0.MsalClientException:

ErrorCode: Client_Credentials_Required_In_Confidential_Client_Application

Microsoft.Identity.Client.MsalClientException: One client credential type required either: ClientSecret, Certificate, ClientAssertion or AppTokenProvider must be defined when creating a Confidential Client. Only specify one. See https://aka.ms/msal-net-client-credentials.

[jmprieur]

Hello @brianpmccullough

what is your appsettings.json? (in particular do you have ClientSecret or ClientCertificates or ClientCredentials?

Also, you don't need to reference these explicitly:

    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="6.0.20" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="6.0.20" />

[brianpmccullough]

I don't yet. I did see some references to Client Secret/Certificate or Azure Key Vault in what I thought was older versions of the documentation, but not in the latest version (referenced in original post). Are those still needed? What cert/secret is needed - the App Registration use for the Web API? Or another?

The Web API wouldn't be hosted in Azure, and we use a different secret service by default. If the secrets are injected in as environment variables ahead of the .AddMicrosoftGraph() setup routine, would I be OK? Or does the config need to come from AKV or AppSettings.json?