我们正在将 Microsoft Azure Active Directory 设置为我们的移动应用的 SSO 解决方案,但希望通过服务器端 Microsoft Graph API 管理用户的帐户创建。
对于域的内部用户,这非常有效,因为我们使用 Graph API 作为管理员用户来创建帐户。
但是,当尝试创建外部帐户(例如 [email protected] )时,会失败。
我们正在使用 API 调用:
POST https://graph.microsoft.com/v1.0/users
正文:
{
"accountEnabled": true,
"mailNickname": "joe.bloggs",
"displayName": "Joe Bloggs",
"givenName": "Joe",
"surname": "Bloggs",
"userPrincipalName": "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="52383d377c303e3d35352112353f333b3e7c313d3f" rel="noreferrer noopener nofollow">[email protected]</a>",
"passwordProfile" : {
"forceChangePasswordNextSignIn": false,
"password": "somepassword"
}
}
回应:
{
"error": {
"code": "Request_BadRequest",
"message": "Property userPrincipalName is invalid.",
"innerError": {
"request-id": "619450ec-e703-4a12-86e3-8f53c20d55fc",
"date": "2018-01-17T16:30:37"
},
"details": [
{
"target": "userPrincipalName",
"code": "InvalidValue"
}
]
}
}
它说“userPrincipalName”无效,但在查看文档后我不确定API是否支持外部帐户?
注意:我知道您可以使用“/beta/invitations”调用,但这不会创建帐户。
最佳答案
我假设您使用的是 Azure AD B2B 并且想要将新的 guest 用户添加到您的目录。
我想澄清的一件事是,您可以邀请 guest 用户加入您的目录,但不能直接在您的目录中创建 guest 用户。
因此,您可以使用 this Microsoft Graph API 邀请访客用户:
请求
POST https://graph.microsoft.com/beta/invitations
Content-type: application/json
Content-length: 551
{
"invitedUserEmailAddress": "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="96efefefd6e2f3e5e2b8f5f9fb" rel="noreferrer noopener nofollow">[email protected]</a>",
"inviteRedirectUrl": "https://myapp.com"
}
回应
HTTP/1.1 201 OK
Content-type: application/json
Content-length: 551
{
"id": "7b92124c-9fa9-406f-8b8e-225df8376ba9",
"inviteRedeemUrl": "https://invitations.microsoft.com/redeem/?tenant=04dcc6ab-388a-4559-b527-fbec656300ea&user=7b92124c-9fa9-406f-8b8e-225df8376ba9&ticket=VV9dmiExBsfRIVNFjb9ITj9VXAd07Ypv4gTg%2f8PiuJs%3d&lc=1033&ver=2.0",
"invitedUserDisplayName": "yyy",
"invitedUserEmailAddress": "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="ceb7b7b78ebaabbdbae0ada1a3" rel="noreferrer noopener nofollow">[email protected]</a>",
"sendInvitationMessage": false,
"invitedUserMessageInfo": {
"messageLanguage": null,
"ccRecipients": [
{
"emailAddress": {
"name": null,
"address": null
}
}
],
"customizedMessageBody": null
},
"inviteRedirectUrl": "https://myapp.com/",
"status": "Completed",
"invitedUser": [ { "id": "243b1de4-ad9f-421c-a933-d55305fb165d" } ]
}
另外,如果您想在没有邀请的情况下邀请访客用户,请引用this document .
希望这有帮助!
关于具有外部帐户和 Microsoft Graph API 的 Azure AD,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/48923171/