从Azure AD Graph Education API获取禁止/拒绝访问错误 [英] Getting Forbidden/Access Denied error from Azure AD Graph Education API
问题描述
我正在使用Graph Education API,需要有关用户的所有信息 轮廓. 在响应/JSON对象中获得错误 禁止的 拒绝访问 没有提供必需的声明值.
I am using Graph education API, want all information about the user profile. Getting below error in response/json objects Forbidden AccessDenied Required claim values are not provided.
public async Task<ActionResult> GetUserDetails()
{
List<User> listUser = new List<User>();
List<UserRole> userRole = new List<UserRole>();
string clientId = configuration.GetValue<string>("AzureAd:ClientId");
string clientSecret = configuration.GetValue<string>("AzureAd:ClientSecret");
//var email = User.Identity.Name;
//AuthenticationContext authContext = new AuthenticationContext("https://login.windows.net/LPExamDev.onmicrosoft.com/oauth2/token");
AuthenticationContext authContext = new AuthenticationContext("https://login.windows.net/LPExamStaging.onmicrosoft.com/oauth2/token");
ClientCredential creds = new ClientCredential(clientId, clientSecret);
AuthenticationResult authResult = await authContext.AcquireTokenAsync("https://graph.microsoft.com/", creds);
HttpClient http = new HttpClient();
string url = $"https://graph.microsoft.com/v1.0/education/users"; // Microsoft Education Graph
//string url = $"https://graph.microsoft.com/v1.0/users"; // Microsoft Graph // Working fine.
////string url = "https://graph.windows.net/LPExamStaging.onmicrosoft.com/users?api-version=1.6";
// Append the access token for the Graph API to the Authorization header of the request by using the Bearer scheme.
HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, url);
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", authResult.AccessToken);
HttpResponseMessage response = await http.SendAsync(request);
var json = await response.Content.ReadAsStringAsync();
var jsonResponse = response.ToString();
bool responseCode = response.IsSuccessStatusCode;
//ViewBag.userData = json;
//SaveAPIData(json);
if (responseCode)
{
SaveAPIData(json);
}
}
推荐答案
您需要授予您的应用程序EduRoster.Read.All
权限,然后单击授予管理员同意按钮.
You need to grant your application EduRoster.Read.All
permission and click grant admin consent button.
登录Azure门户->单击"Azure Active Directory"->单击应用程序注册(预览)"->单击您的应用程序->单击"API权限"->添加权限->选择应用程序权限
Login azure portal->click Azure Active Directory->click App registrations(preview)->click your application->click API permissions->add a permission->choose Application permissions
然后单击授予管理员同意"按钮.
Then click Grant admin consent button.
您可以使用 https://jwt.io/来解码访问令牌,以检查您是否已经得到了那个许可.
You can decoded your access token by using https://jwt.io/ to check if you have already got that permission.
这篇关于从Azure AD Graph Education API获取禁止/拒绝访问错误的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!