Question

当我想从应用程序中获取来自图api的成员时 graph.windows.net/{aadDirectoryId}/users/{userId.Value} / $ links / memberOf？api-version = 1.6

我总是

Response: StatusCode: 403, ReasonPhrase: 'Forbidden', Version: 1.1, Content: System.Net.Http.StreamContent, Headers:
{
  Pragma: no-cache
  ocp-aad-diagnostics-server-name: aVvd1R49Sg=
  request-id: 67105ddc-2b5f-84bf-7ec43a4d3117
  client-request-id: fb1ef66f-451357f08975abd4
  x-ms-dirapi-data-contract-version: 1.6
  ocp-aad-session-key: _XjEM7ooA1Emw_l6FjiyMwKqtoEPSWgxw-04c_nX785foVv6fGM_lBejApG_gJW2fXC_LBNrZRJRryuBIOO7_O1bF2oEEiWMvnW9Ywx71OP0NJ5gRyZDGlLyNsjmsDvu.42WXAH4v8FjbaSNvNtH1Nnkm3z5on0J5ZsptMguA52A
  DataServiceVersion: 3.0;
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  Access-Control-Allow-Origin: *
  Duration: 853533
  Cache-Control: no-cache
  Date: Tue, 05 Mar 2019 14:01:17 GMT
  Server: Microsoft-IIS/10.0
  X-AspNet-Version: 4.0.30319
  X-Powered-By: ASP.NET
  Content-Length: 219
  Content-Type: application/json; odata=minimalmetadata; streaming=true; charset=utf-8
  Expires: -1
}

当我从https://graphexplorer.azurewebsites.net/调用此 get 时，一切正常。

在Azure AD中，我为 api permission

通话代码：

private static List<string> GetGroupsFromGraphAPI(ClaimsIdentity claimsIdentity)
        {
            _logger.Info($"Getting claims from Graph API for {claimsIdentity.Name}.");

            List<string> groupObjectIds = new List<string>();

            var aadClientId = ConfigurationManager.AppSettings["ida:ClientId"];
            var aadSecret = ConfigurationManager.AppSettings["ida:ClientSecret"];
            var aadDirectoryId = ConfigurationManager.AppSettings["ida:DirectoryId"];

            ClientCredential credential = new ClientCredential(aadClientId, aadSecret);
            AuthenticationContext authContext = new AuthenticationContext("https://login.microsoftonline.com/" + aadDirectoryId);
            string accessToken;
            try
            {
                _logger.Info($"Client ID: {aadClientId}");
                _logger.Info($"Secret: {aadSecret}");
                _logger.Info($"Directory id: {aadDirectoryId}");

                var token = authContext.AcquireToken("https://graph.windows.net", credential);
                _logger.Info($"Token: {token.ToString()}");
                accessToken = token.AccessToken;
                _logger.Info($"Get access token {accessToken}");
            }
            catch
            {
                _logger.Error("Cannot aquire token for Graph API.");
                throw;
            }

            var userId = claimsIdentity.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier");
            if (userId == null)
            {
                _logger.Warn($"No user ID to get group membership for. ({claimsIdentity.Name})");
                return groupObjectIds;
            }

            HttpClient client = new HttpClient();
            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
            HttpResponseMessage response;
            try
            {
                var link =
                    $"https://graph.windows.net/{aadDirectoryId}/users/{userId.Value}/$links/memberOf?api-version=1.6";
                _logger.Info($"GetAsync {link}");
                response = client.GetAsync(link).Result;
            }
            catch
            {
                _logger.Error("Failed to load group membership for " + claimsIdentity.Name);
                throw;
            }
}

Answer 1

发生Forbidden错误并需要管理员同意

查看您为获取令牌而共享的代码，您正在使用应用程序身份，因此应用程序所需的权限将是应用程序权限。
```
    ClientCredential credential = new ClientCredential(aadClientId, aadSecret);
    AuthenticationContext authContext = new AuthenticationContext("https://login.microsoftonline.com/" + aadDirectoryId);  
    ...
    var token = authContext.AcquireToken("https://graph.windows.net", credential);
```
在屏幕快照中，您已附加Azure AD Graph的Directory.Read.All权限，但它还表示未完成“管理员同意”。如果您查看该许可，则会清楚地显示“需要管理员同意是”。

因此，您的解决方法是授予管理员同意权限。如果您以管理员身份登录，则可以直接从Azure门户（分配权限的同一页面）执行此操作。另一种方法是利用AdminConsent端点
为什么https://graphexplorer.azurewebsites.net/上的它对您有用

Azure AD Graph Explorer正在使用Delegated Permissions并以登录用户的身份调用API，以便为您工作。在尝试从应用程序执行相同操作时，不同之处在于您正在使用尚未获得许可的应用程序身份进行调用。
仅在API权限下需要Azure AD Graph API

在您共享的代码中，您仅在调用https://graph.windows.net，因此您的应用程序仅需要Azure AD Graph API的权限。您可以安全地删除为Microsoft Graph API分配的权限（除非您在应用程序的其他位置使用Microsoft Graph API）

Azure AD Graph API返回禁止状态

1 个答案: