Microsoft 图形 API:无法使用生成的访问令牌获取用户 [英] Microsoft graph API: Unable to fetch users with the generated access token
问题描述
我已经在 Azure 门户中注册了应用程序，并且我已经生成了 client_secret.我需要客户端授权流程，并且我也授予了应用程序权限.我自己也是管理员，因此我已授予管理员同意.
我能够使用给定的 url 生成访问令牌:
https://login.microsoftonline.com/47be0abf-c6a1-4f04-a665-dceb081c4ff1/oauth2/v2.0/token?client_id=********&client_secret=******&grant_type=client_credentials&scope=User.ReadBasic.All%20User.Read%20User.ReadWrite%20User.Read.All%20User.ReadWrite.All%20Directory.Read.All%20Directory.ReadWrite.All%20Directory.AccessAsUser.All但是，当我使用生成的令牌访问以下 url 时，我收到了权限不足的消息.
https://graph.microsoft.com/v1.0/users授权承载eyJ0eXAiOiJKV1QiLCJub25jZSI6IkFRQUJBQUFBQUFEQ29NcGpKWHJ4VHE5Vkc5dGUtN0ZYNndkRlV3aTBKbGlHcWhEWkgybFRlYWh6SUhUX0VsazFaYTFuUHRzNWo3SW5xMDBmbnNNRkpNUWRYdWdVZnpaZ0cxT19uenNPTXpwN2tpUFFIR2VHTnlBQSIsImFsZyI6IlJTMjU2IiwieDV0IjoiQ3RmUUM4TGUtOE5zQzdvQzJ6UWtacGNyZk9jIiwia2lkIjoiQ3RmUUM4TGUtOE5zQzdvQzJ6UWtacGNyZk9jIn0.eyJhdWQiOiJodHRwczovL2dyYXBoLm1pY3Jvc29mdC5jb20iLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC80N2JlMGFiZi1jNmExLTRmMDQtYTY2NS1kY2ViMDgxYzRmZjEvIiwiaWF0IjoxNTYwMjUzMDE1LCJuYmYiOjE1NjAyNTMwMTUsImV4cCI6MTU2MDI1NjkxNSwiYWlvIjoiNDJaZ1lQajhVdnBwWGMySEU1WGZwbnZxSG43akFnQT0iLCJhcHBfZGlzcGxheW5hbWUiOiJUdXRvcmlhbCBTYW1wbGUgQXBwIiwiYXBwaWQiOiI2NzMxZGU3Ni0xNGE2LTQ5YWUtOTdiYy02ZWJhNjkxNDM5MWUiLCJhcHBpZGFjciI6IjEiLCJpZHAiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC80N2JlMGFiZi1jNmExLTRmMDQtYTY2NS1kY2ViMDgxYzRmZjEvIiwib2lkIjoiNjg0ZjkzMjUtNjUyNS00Yjk5LTgwNzktOTEyOGZjZWNlNGViIiwic3ViIjoiNjg0ZjkzMjUtNjUyNS00Yjk5LTgwNzktOTEyOGZjZWNlNGViIiwidGlkIjoiNDdiZTBhYmYtYzZhMS00ZjA0LWE2NjUtZGNlYjA4MWM0ZmYxIiwidXRpIjoiSkZjUE9SSHRGVTJMMWludEpkY2RBQSIsInZlciI6IjEuMCIsInhtc190Y2R0IjoxMzQ0Njc5MzA0fQ.fXEs7eClm5SYXychcKXbTfcc5gtvyyMa5fDWuGu2vqQ4Zc6V0jJSHSeksRiOzYE8SOJXRTmI9vJtbs2XIMFr0CRHeTgoCDReV8JWJ8yhOKiDnc-_2AHtSoBnqt6ibF0eX4AzkyioJd24-uYTSkheC_zDpd6GS3T5T077BU_1M7kpngXDfEICi38VkddcpdBUG8FgHUSPq0S9fCosIB4_JPwspq3QC6jJyoRrj1Yj2oR8FwBA1dpgWq_e0QoGnWXgT6EhBKedjY0hwHGY-F73ndvRlAKKW63JYucdOtRyC2zFDc4DPwhN1nyPlh86_Y0Zru8UTb0QgWRFKbGZwQcEOg我已尝试更改权限并添加和删除权限.
<代码>{错误": {"code": "Authorization_RequestDenied","message": "权限不足，无法完成操作.",内部错误":{请求 ID":aa38f822-7325-44ad-9127-3cb4779578bf"，日期":2019-06-11T11:42:16"}}}
更新:包含权限截图配置
令牌的 JWT 调试器输出:
<代码>{"aud": "https://graph.microsoft.com","iss": "https://sts.windows.net/f77804fb-8607-4e96-9fae-231360cc82b7/","iat": 1560273380,nbf":1560273380，exp":1560277280，"aio": "42ZgYKjulnV3u/vJZNN0gz3ld2ZpAwA=","app_displayname": "clmapp","appid": "82ad79f2-27c7-4304-92f6-e3ffdb637e72",appidacr":1"，"idp": "https://sts.windows.net/f77804fb-8607-4e96-9fae-231360cc82b7/","tid": "f77804fb-8607-4e96-9fae-231360cc82b7",uti":BpTbRLEb5ECSO3qjslIgAA"，版本":1.0"，xms_tcdt":1376441181}你可以试试下面的方法:
权限:
确保您已关注
在 Azure 门户上授予权限:
步骤:1
在 API 权限 菜单上选择 Application Permission
步骤:2
选择 Application Permission 部分下的 User.ReadWrite.All 但 User.Read.All 也可以.
令牌请求格式:
网址:https://login.microsoftonline.com/YourTenant.onmicrosoft.com/oauth2/token
对于 V2.0 网址:https://login.microsoftonline.com/YourTenant.onmicrosoft.com/oauth2/v2.0/token
HTTP 动词:POST
grant_type:client_credentialsclient_id:b603c7be-a866-4-e6921e61f925client_secret:Vxf1SluKbguf3wE5oGl/2XDSeZ8wL/Yp8ns4sc=资源:https://graph.microsoft.com<块引用>
对于 V2.0 范围将是:scope:https://graph.microsoft.com/.default
请看下面的屏幕截图:
解码令牌 &确认权限:
您可以使用
请求用户列表:
在此端点 https://graph.microsoft.com/v1.0/users 上使用您的 Token 请求.请参阅下面的屏幕截图.我已成功获取所有用户列表.
I have registered the application in Azure portal and i have generated the client_secret. I require the client grant flow and i have given application permissions also. I have granted the admin consent also as I am the admin myself.
I am able to generate the access token with the given url:
https://login.microsoftonline.com/47be0abf-c6a1-4f04-a665-dceb081c4ff1/oauth2/v2.0/token?client_id=********&client_secret=******&grant_type=client_credentials&scope=User.ReadBasic.All%20User.Read%20User.ReadWrite%20User.Read.All%20User.ReadWrite.All%20Directory.Read.All%20Directory.ReadWrite.All%20Directory.AccessAsUser.All
However, when i use the token generated to access the following url, I get the insufficient privileges message.
https://graph.microsoft.com/v1.0/users
Authorization Bearer eyJ0eXAiOiJKV1QiLCJub25jZSI6IkFRQUJBQUFBQUFEQ29NcGpKWHJ4VHE5Vkc5dGUtN0ZYNndkRlV3aTBKbGlHcWhEWkgybFRlYWh6SUhUX0VsazFaYTFuUHRzNWo3SW5xMDBmbnNNRkpNUWRYdWdVZnpaZ0cxT19uenNPTXpwN2tpUFFIR2VHTnlBQSIsImFsZyI6IlJTMjU2IiwieDV0IjoiQ3RmUUM4TGUtOE5zQzdvQzJ6UWtacGNyZk9jIiwia2lkIjoiQ3RmUUM4TGUtOE5zQzdvQzJ6UWtacGNyZk9jIn0.eyJhdWQiOiJodHRwczovL2dyYXBoLm1pY3Jvc29mdC5jb20iLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC80N2JlMGFiZi1jNmExLTRmMDQtYTY2NS1kY2ViMDgxYzRmZjEvIiwiaWF0IjoxNTYwMjUzMDE1LCJuYmYiOjE1NjAyNTMwMTUsImV4cCI6MTU2MDI1NjkxNSwiYWlvIjoiNDJaZ1lQajhVdnBwWGMySEU1WGZwbnZxSG43akFnQT0iLCJhcHBfZGlzcGxheW5hbWUiOiJUdXRvcmlhbCBTYW1wbGUgQXBwIiwiYXBwaWQiOiI2NzMxZGU3Ni0xNGE2LTQ5YWUtOTdiYy02ZWJhNjkxNDM5MWUiLCJhcHBpZGFjciI6IjEiLCJpZHAiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC80N2JlMGFiZi1jNmExLTRmMDQtYTY2NS1kY2ViMDgxYzRmZjEvIiwib2lkIjoiNjg0ZjkzMjUtNjUyNS00Yjk5LTgwNzktOTEyOGZjZWNlNGViIiwic3ViIjoiNjg0ZjkzMjUtNjUyNS00Yjk5LTgwNzktOTEyOGZjZWNlNGViIiwidGlkIjoiNDdiZTBhYmYtYzZhMS00ZjA0LWE2NjUtZGNlYjA4MWM0ZmYxIiwidXRpIjoiSkZjUE9SSHRGVTJMMWludEpkY2RBQSIsInZlciI6IjEuMCIsInhtc190Y2R0IjoxMzQ0Njc5MzA0fQ.fXEs7eClm5SYXychcKXbTfcc5gtvyyMa5fDWuGu2vqQ4Zc6V0jJSHSeksRiOzYE8SOJXRTmI9vJtbs2XIMFr0CRHeTgoCDReV8JWJ8yhOKiDnc-_2AHtSoBnqt6ibF0eX4AzkyioJd24-uYTSkheC_zDpd6GS3T5T077BU_1M7kpngXDfEICi38VkddcpdBUG8FgHUSPq0S9fCosIB4_JPwspq3QC6jJyoRrj1Yj2oR8FwBA1dpgWq_e0QoGnWXgT6EhBKedjY0hwHGY-F73ndvRlAKKW63JYucdOtRyC2zFDc4DPwhN1nyPlh86_Y0Zru8UTb0QgWRFKbGZwQcEOg
I have tried changing the permission and added and removed the permissions.
{
"error": {
"code": "Authorization_RequestDenied",
"message": "Insufficient privileges to complete the operation.",
"innerError": {
"request-id": "aa38f822-7325-44ad-9127-3cb4779578bf",
"date": "2019-06-11T11:42:16"
}
}
}
Updated : Included the permission screenshot configuration
JWT Debugger output for tokens:
{
"aud": "https://graph.microsoft.com",
"iss": "https://sts.windows.net/f77804fb-8607-4e96-9fae-231360cc82b7/",
"iat": 1560273380,
"nbf": 1560273380,
"exp": 1560277280,
"aio": "42ZgYKjulnV3u/vJZNN0gz3ld2ZpAwA=",
"app_displayname": "clmapp",
"appid": "82ad79f2-27c7-4304-92f6-e3ffdb637e72",
"appidacr": "1",
"idp": "https://sts.windows.net/f77804fb-8607-4e96-9fae-231360cc82b7/",
"tid": "f77804fb-8607-4e96-9fae-231360cc82b7",
"uti": "BpTbRLEb5ECSO3qjslIgAA",
"ver": "1.0",
"xms_tcdt": 1376441181
}
You could try following way:
Permission:
Make sure you have following permission:
Grant permission On Azure Portal:
Step:1
Select Application Permission On API permissions menu
Step:2
Select User.ReadWrite.All under Application Permission part But User.Read.All also alright.
Token Request Format:
URL:https://login.microsoftonline.com/YourTenant.onmicrosoft.com/oauth2/token
For V2.0 URL:
https://login.microsoftonline.com/YourTenant.onmicrosoft.com/oauth2/v2.0/token
HTTP Verb: POST
grant_type:client_credentials
client_id:b603c7be-a866-4-e6921e61f925
client_secret:Vxf1SluKbguf3wE5oGl/2XDSeZ8wL/Yp8ns4sc=
resource:https://graph.microsoft.com
For V2.0 scope Will be :
scope:https://graph.microsoft.com/.default
See the screen shot below:
Decode Token & Confirm permission:
You can use https://jwt.io/ to decode your token to make sure you have required permission: See the below screen shot:
Request For User List:
With your Token Request on this endpoint https://graph.microsoft.com/v1.0/users. See the screen shot below. I have successfully get all the user list.
这篇关于Microsoft 图形 API:无法使用生成的访问令牌获取用户的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
