java - ARM REST API 需要哪些权限

Question

我正在尝试创建一个可以连接到 ARM ( https://management.azure.com ) 并从中检索一些信息的应用程序。我已经创建了一个使用 Microsoft Graph ( https://graph.microsoft.com ) 并且工作正常的应用程序，但现在我需要获取仅在 ARM 上可用的信息。

我在互联网上查找所需的权限，特别是在 Microsoft Docs 上，但是我找到的所有文档仅涉及 Microsoft Graph 或 Windows Graph。

您知道我应该通过门户请求哪些权限吗？

public String getAccessToken() throws MalformedURLException, InterruptedException, ExecutionException, ServiceUnavailableException, InvalidKeyException, IllegalBlockSizeException, BadPaddingException, NoSuchAlgorithmException, NoSuchPaddingException
{
    AuthenticationContext objContext;
    AuthenticationResult objToken;
    ExecutorService objService;
    Future<AuthenticationResult> objFuture;
    objService = null;
    objToken = null;
    try
    {
        objService = Executors.newFixedThreadPool(1);
        objContext = new AuthenticationContext(this.getAuthorize(), false, objService);
        objFuture = objContext.acquireToken("https://management.azure.com", this.getApplicationID(), this.getUsername(), SecureText.getInstance().decode(this.getPassword()), null);
        objToken = objFuture.get();
        this.getLogger().info("Connection to Azure Resource Manager".concat(this.getClass().getSimpleName().toLowerCase()).concat(" successfully stablished"));
    }
    finally
    {
        objService.shutdown();
    }
    if (objToken == null)
    {
        throw new ServiceUnavailableException("Authentication Service is not available");
    }
    return objToken.getAccessToken();
}

显示以下错误:

com.microsoft.aad.adal4j.AuthenticationException: {"error_description":"AADSTS65001: The user or administrator has not consented to use the application with ID 'e1b0615a-911d-4ccf-bf16-e8d0c1c2f8b5' named 'XXXXXXX'. Send an interactive authorization request for this user and resource.\r\nTrace ID: 9731e9b7-116d-4c5e-b219-ab96e12c4300\r\nCorrelation ID: faa9a023-3237-4367-9c66-eec9b77e2805\r\nTimestamp: 2019-09-26 11:20:54Z","error":"invalid_grant"}

Answer 1

过去曾见过类似的错误。

通过以下方式授予权限:

Azure Active Directory -> 应用注册 -> MyApp -> Api 权限 -> 授予管理员同意按钮

帮助了我。

类似帖子 - The user or administrator has not consented to use the application - Send an interactive authorization request for this user and resource