尝试访问Azure Graph API时权限不足错误 [英] Insufficient privileges error when trying to access Azure Graph APIs

问题描述

我已经设置了要与Web应用程序一起使用的Azure AD应用程序.我已通过以下步骤获得了oAuth令牌:

I have set up an Azure AD application that I want to use with my web application. I have obtained an oAuth token using the following steps:

首先，我请求我的授权码:

First I requested my authorization code:

https://login.windows.net/common/oauth2/authorize?redirect_uri={REDIRECT_URI}&client_id={CLIENT_ID}&response_type=code&state=o365&prompt=admin_consent

这会将用户带到login.windows.net页面，他们必须在其中接受我的应用程序将在其AD上使用的权限.

This takes the user to the login.windows.net page where they must accept permissions that my application is going to use on their AD.

此后，我使用此端点 https://login.windows.net/common/oauth2/token获得了oAuth令牌与此有效载荷一起使用C#:

After that I get the oAuth Token using this endpoint https://login.windows.net/common/oauth2/token with this payload using C#:

{"code": {AUTH_CODE}},
{"state", {STATE}},
{"grant_type", "authorization_code"},
{"redirect_uri", "{REDIRECT_URI}"},
{"client_id", "1ff78c4b-414f-44c7-834b-09bdae96f440"},
{"client_secret", "{CLIENT_SECRET}"},
{"resource", "https://graph.windows.net"}

一切恢复正常，我得到了我的oAuth令牌.但是，当我尝试使用令牌卷曲Graph API时，会出现此错误

Everything comes back just fine and I get my oAuth Token. However when I try to curl the Graph API using the token I get this error

curl https://graph.windows.net/{tenant}/users?api-version=1.5 -H "Authorization: Bearer [AUTH_TOKEN]"

{"odata.error":{"code":"Authorization_RequestDenied","message":{"lang":"en","value":"Insufficient privileges to complete the operation."}}}

我已经尝试了{tenant}，"me"别名和"myorganization"别名的实际域，但是它们都不起作用. "me"别名返回一个错误，指出用户"资源不存在.我对这里的问题感到困惑

I have tried the actual domain for the {tenant}, the "me" alias and the "myorganization" alias and they all don't work. The "me" alias returns an error saying the 'users' resource doesn't exist. I am confused on what the problem is here

推荐答案

您的应用程序缺少特权，该特权禁止使用Azure AD读取自定义AD中存在的用户的详细信息.这是您需要做的:

Privileges are missing for your application which is barring the azure AD to read the details of users present in your custom AD. Here is what you need to do:

在Windows Azure管理门户上转到自定义AD->单击应用程序"选项卡->单击AD应用程序的名称以转到其详细信息视图.在详细信息视图上，转到配置"选项卡.

Go to your custom AD on windows azure management portal -> Click applications tab -> Click on the name of your AD application to go to its details view. On the details view go to configure tab.

现在向下滚动到页面底部以找到其他应用程序的权限"部分.在那里，您将在委派权限多选列表框中看到当前分配给"Windows Azure Active Directory"应用程序的所有权限，如下所示:

Now scroll down to the bottom of the page to reach "permissions to other applications" section. There you will see all permissions currently assigned to "Windows Azure Active Directory" application in delegated permissions multi-select list box as shown below:

选中访问组织目录"和读取目录数据"旁边的框.单击底部工具栏中的保存以保存更改.在页面上进行任何更改后，保存"按钮就会自动出现.在上面的屏幕截图中，保存"按钮不可见，因为我在保存屏幕截图时已经保存了更改.

Check the box against "Access your organization's directory" and "Read directory data". Click save in bottom tool bar to save the changes. Save button appears automatically as soon as you make any changes on the page. Save button is not visible in the screenshot above as I had already saved the changes when I took the screenshot.

现在，再次尝试使用图形API访问您的AD用户详细信息.它不应再给出权限不足"错误.希望这可以帮助！

Now try again accessing your AD user details using graph API. It should not give the "Insufficient privileges" error any more. Hope this helps!

这篇关于尝试访问Azure Graph API时权限不足错误的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！