我正在尝试使用以下端点访问 Microsoft Graph API 来查询用户所属组的列表
https://graph.microsoft.com/v1.0/users/{userID}/memberOf
但是自过去两天以来,我的查询失败,响应如下
{ error: {
code: 'Authorization_RequestDenied',
message: 'Insufficient privileges to complete the operation.',
innerError: {
'request-id': '7d8a5602-19ca-4cc7-a84d-60cc0c9c09d5',
date: '2020-04-28T11:44:24'
} } }
我已经获得了管理员所需的权限和权限,我授予的访问权限包括
Directory.Read.All
Directory.ReadWrite.All
Group.Read.All
正如微软文档中所述:https://learn.microsoft.com/en-us/graph/api/user-list-memberof?view=graph-rest-1.0&tabs=http
按照本文档 https://learn.microsoft.com/en-us/graph/auth-v2-service 使用访问 token 的授权 header (来自服务)发送 API 请求
解码后的 JWT token 在授权 header 中传递:
{
"aud": "https://graph.microsoft.com",
"iss": "https://sts.windows.net/TENANTID_REMOVED_FOR_SECURITY/",
"iat": 1588150105,
"nbf": 1588150105,
"exp": 1588154005,
"aio": "42dgYOCaN0c46++enU1fZx+98Lc3DQA=",
"app_displayname": "dspIT",
"appid": "MYAPPID_REMOVED_FOR_SECURITY",
"appidacr": "1",
"idp": "https://sts.windows.net/TENANTID_REMOVED_FOR_SECURITY/",
"oid": "fc709ea2-887e-4794-9417-ac578ab825e8",
"rh": "0.ATEAfGSULqtSkUqIuFyy2LRFJyPSTnvDYjVDlpuh_cMocSgxAAA.",
"roles": [
"User.ReadWrite.All",
"RoleManagement.Read.Directory",
"Group.Read.All",
"Directory.ReadWrite.All",
"Group.Create",
"Group.ReadWrite.All",
"User.Invite.All",
"Directory.Read.All",
"User.Read.All",
"GroupMember.Read.All",
"User.Export.All",
"PrivilegedAccess.Read.AzureADGroup",
"User.ManageIdentities.All",
"RoleManagement.ReadWrite.Directory",
"GroupMember.ReadWrite.All",
"Group.Selected",
"PrivilegedAccess.ReadWrite.AzureADGroup"
],
"sub": "fc709ea2-887e-4794-9417-ac578ab825e8",
"tid": "TENANTID_REMOVED_FOR_SECURITY",
"uti": "wvHXdAZomUefp2RpSGBPAA",
"ver": "1.0",
"xms_tcdt": 1519129156
}
感谢您的帮助。
最佳答案
根据您解码的 JWT token ,我进行了快速测试并找到了原因。
似乎有一个应用程序权限 Group.Selected
会影响此 API 端点 /memberOf
的调用。
此权限有问题,并且影响了其他一些端点。我之前回答过类似的帖子here .
因此,如果没有必要,只需将其从 Azure AD 应用程序中删除即可。然后这个错误就会消失。
如果需要此权限,恐怕您需要创建一个新的Azure AD应用程序来添加该权限才能使用。
关于azure - Microsoft Graph - 使用应用程序 token 获取 MemberOf 错误,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/61496146/