Question

尝试使用Graph API创建应用程序时，我从Azure AD获得403 Forbidden响应：

private static void CreateApplicationViaPost(string tenantId, string clientId, string clientSecret)
{
    var authContext = new AuthenticationContext(
        string.Format("https://login.windows.net/{0}",
        tenantId));

    ClientCredential clientCred = new ClientCredential(clientId, clientSecret);

    AuthenticationResult result = authContext.AcquireToken(
        "https://graph.windows.net",
        clientCred);

    HttpClient client = new HttpClient();
    client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken);

    const string json = @"{ displayName: ""My test app"", logoutUrl: ""http://logout.net"", identifierUris: [ ""http://identifier1.com"" ], replyUrls: [ ""http://replyUrl.net"" ] }";
    HttpResponseMessage response = client.PostAsync(
        string.Format("https://graph.windows.net/{0}/applications?api-version=1.6", tenantId),
        new StringContent(json, Encoding.UTF8, "application/json")).Result;

    Console.WriteLine(response.ToString());
}

在Azure AD中注册的客户端具有以下所有权限：

我错过了什么？

修改我在Azure AD中注册了一个本机客户端，并授予其写入Windows Azure Active Directory的权限。此代码在Azure AD中创建应用程序：

private static void CreateApplicationViaPost(string tenantId, string clientId, string redirectUri)
        {
            var authContext = new AuthenticationContext(
                string.Format("https://login.windows.net/{0}",
                tenantId));

            AuthenticationResult result = authContext.AcquireToken("https://graph.windows.net", clientId, new Uri(redirectUri), PromptBehavior.Auto);

            HttpClient client = new HttpClient();
            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken);

            const string json = @"{ displayName: ""My test app1"", homepage: ""http://homepage.com"", logoutUrl: ""http://logout1.net"", identifierUris: [ ""http://identifier11.com"" ], replyUrls: [ ""http://replyUrl1.net"" ] }";
            HttpResponseMessage response = client.PostAsync(
                string.Format("https://graph.windows.net/{0}/applications?api-version=1.6", tenantId),
                new StringContent(json, Encoding.UTF8, "application/json")).Result;

            Console.WriteLine(response.ToString());
        }

Answer 1

修改目录requires consent from an admin user。因此，您需要从用户那里获取访问令牌，例如通过OAuth，而不是客户端的令牌。

有很多samples at GitHub显示授权流程，例如https://github.com/AzureADSamples/WebApp-GraphAPI-DotNet

Answer 2

添加到@ MrBrink的答案 - 您需要确保在Azure Active Directory UI中添加权限的人实际上是管理员。如果您有权访问Azure Active Directory且不是管理员，则 WILL 仍然允许您分配权限 - 但是它们仅适用于用户范围。

Answer 3

另一种方法是使用Microsoft.Azure.ActiveDirectory.GraphClient NuGet包中的ActiveDirectoryClient。

private static async Task CreateApplication(string tenantId, string clientId,
    string redirectUri)
{
    var graphUri = new Uri("https://graph.windows.net");
    var serviceRoot = new Uri(graphUri, tenantId);
    var activeDirectoryClient = new ActiveDirectoryClient(serviceRoot,
        async () => AcquireTokenAsyncForUser("https://login.microsoftonline.com/" + tenantId,
            clientId, redirectUri));

    var app = new Application
        {
            Homepage = "https://localhost",
            DisplayName = "My Application",
            LogoutUrl = "https://localhost",
            IdentifierUris = new List<string> { "https://tenant.onmicrosoft.com/MyApp" },
            ReplyUrls = new List<string> { "https://localhost" }
        };

    await activeDirectoryClient.Applications.AddApplicationAsync(app);

    Console.WriteLine(app.ObjectId);
}

private static string AcquireTokenAsyncForUser(string authority, string clientId,
    string redirectUri)
{
    var authContext = new AuthenticationContext(authority, false);
    var result = authContext.AcquireToken("https://graph.windows.net",
        clientId, new Uri(redirectUri), PromptBehavior.Auto);

    return result.AccessToken;
}

403禁止使用Azure Graph API

3 个答案: