Microsoft Graph-Grant_Type client_credentials calendarview-访问被拒绝。检查凭据，然后重试

Question

我正在使用PowerShell从MS Graph获取日历事件。

赠款类型：client_credentials

from sklearn.utils import compute_class_weight
class_weights = compute_class_weight("balanced", np.unique(Y_train), Y_train)

授予类型：密码

$clientId = "xxx"
$tenantName = "xxx"
$clientSecret = "xxx"
$resource = "https://graph.microsoft.com/"
$ReqTokenBody = @{
Grant_Type    = "client_credentials"
Scope         = "https://graph.microsoft.com/.default"
client_Id     = $clientID
Client_Secret = $clientSecret
} 
$TokenResponse = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$TenantName/oauth2/v2.0/token" -Method POST -Body $ReqTokenBody

获取日历事件：

$clientID = "xxx"
$tenantName = "xxx"
$ClientSecret = "xxx"
$Username = "xxx@xxx.com"
$Password = "xxx"

$ReqTokenBody = @{
Grant_Type    = "Password"
client_Id     = $clientID
Client_Secret = $clientSecret
Username      = $Username
Password      = $Password
Scope         = "https://graph.microsoft.com/.default"
} 
$TokenResponse = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$TenantName/oauth2/v2.0/token" -Method POST -Body $ReqTokenBody

如果我通过“密码授予类型”进行身份验证，则会显示结果。 但是，如果我通过“客户端凭据授予类型”进行身份验证，则会引发以下错误：

$apiUrl = "https://graph.microsoft.com/v1.0/groups/xxxxxxxxxx/calendarview?startdatetime=$mystartdate1&enddatetime=$myenddate1&orderby=start/DateTime ASC&top=100"
$Data = Invoke-RestMethod -Headers @{Authorization = "Bearer $($Tokenresponse.access_token)"} -Uri $apiUrl -Method Get
$Groups = ($Data | select-object Value).Value
#$Groups | Format-Table subject, start -AutoSize
$Groups | Select-Object -Property subject, Start, End

使用“客户凭证授予类型”，我可以毫无问题地获得结果

Invoke-RestMethod : {
  "error": {
    "code": "ErrorAccessDenied",
    "message": "Access is denied. Check credentials and try again.",
    "innerError": {
      "request-id": "cc111097-c8c2-4a35-af21-52cbbced33b7",
      "date": "2019-11-29T09:37:51"
    }
  }
}
At line:10 char:9
+ $Data = Invoke-RestMethod -Headers @{Authorization = "Bearer $($Token ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

我做错了什么，还是客户端凭据身份验证无法提取日历事件。

Answer 1

使用客户端凭据流获取Microsoft Graph的访问令牌时，AD App中的Application permission-> API permissions是必需的。

但是在这种情况下，List calendarView API不支持Application permission。没有此权限，您获得的令牌将无法成功调用此API。