Question

我写了一个应该读取用户组的应用程序。我使用的是Asp.net核心。我在azure门户中创建了一个应用程序，并为GraphAPI授予了所有应用程序权限，并单击了Grant权限按钮。然后我使用了一些类似于WebApp-GroupClaims-DotNet的代码来检索用户组：

public async Task<IEnumerable<string>> GetGroupIdsFromGraphApiAsync(string userId)
{
    var groupObjectIds = new List<string>();

    // Acquire the Access Token
    var credential = new ClientCredential(_configHelper.ClientId, _configHelper.AppKey);
    var authContext = new AuthenticationContext(_configHelper.Authority);
    var result = await authContext.AcquireTokenAsync(_configHelper.GraphResourceId, credential);
    var accessToken = result.AccessToken;

    var requestUrl =
        $"{_configHelper.GraphResourceId}/{_configHelper.Domain}/users/{userId}/getMemberGroups?api-version=1.6";

    // Prepare and Make the POST request
    var client = new HttpClient();
    var request = new HttpRequestMessage(HttpMethod.Post, requestUrl);
    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
    var content = new StringContent("{\"securityEnabledOnly\":false}");
    content.Headers.ContentType = new MediaTypeHeaderValue("application/json");
    request.Content = content;
    var response = await client.SendAsync(request);

    // Endpoint returns JSON with an array of Group ObjectIDs
    if (response.IsSuccessStatusCode)
    {
        var responseContent = await response.Content.ReadAsStringAsync();
        var groupsResult = (Json.Decode(responseContent)).value;

        foreach (string groupObjectId in groupsResult)
            groupObjectIds.Add(groupObjectId);
    }
    else
    {
        var responseContent = await response.Content.ReadAsStringAsync();
        throw new WebException(responseContent);
    }

    return groupObjectIds;
}

不幸的是，我总是得到以下回复：

{"odata.error":{"code":"Authorization_RequestDenied","message":{"lang":"en","value":"Insufficient privileges to complete the operation."}}}

应用程序无法向AD查询此信息吗？

Answer 1

根据您的代码，您正在制作Azure广告图api调用，然后您需要授予Windows Azure Active Directory（azure广告图API）的权限。

https://graph.windows.net是Azure AD Graph APi的端点，在azure门户网站中名称为Windows Azure Active Directory。 https://graph.microsoft.com是Microsoft Graph api的端点，在azure门户网站中名称为Microsoft Graph

getMemberGroups“没有足够的权限来完成操作”

1 个答案: