java - 使用 azure.identity.UsernamePasswordCredential 和错误 : AADSTS65001: The user or administrator has not consented to use the application with ID

Question

我正在使用 microsoft graph-sdk-java 通过使用 UsernamePasswordCredential 授权从具有用户范围的 Outlook 读取 canlendar。首先，我尝试获取用户的信息。

        final UsernamePasswordCredential usernamePasswordCredential = new UsernamePasswordCredentialBuilder()
                .clientId(CLIENT_ID)
                .username(username)
                .password(password)
                .build();

        final TokenCredentialAuthProvider tokenCredentialAuthProvider = new TokenCredentialAuthProvider(getScopes(), usernamePasswordCredential);

        final GraphServiceClient<Request> graphClient = GraphServiceClient
                        .builder()
                        .authenticationProvider(tokenCredentialAuthProvider)
                        .buildClient();

        final User me = graphClient.me().buildRequest().get();

然后，我运行该程序并遇到以下问题。

com.microsoft.aad.msal4j.MsalInteractionRequiredException: AADSTS65001: The user or administrator has not consented to use the application with ID <application_id>. Send an interactive authorization request for this user and resource.

应用程序已在租户的 Azure AD 中注册。我认为应用的 API 权限存在问题。

如何处理此错误并在没有交互授权的情况下获取日历的事件？

Answer 1

我尝试在我的环境中重现相同的结果，并得到如下结果:

Note that: To get/read the calendar, the Azure AD Application must have Calendars.Read API permission.

我创建了一个 Azure AD 应用程序并授予了 API 权限，如下所示:

现在我使用以下参数通过 Postman 生成访问 token :

https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:ClientID
client_secret:ClientSecret
username:<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="285d5b4d5a19685050505006474645414b5a475b474e5c064b4745" rel="noreferrer noopener nofollow">[email protected]</a>
password:****
grant_type:password
scope:https://graph.microsoft.com/.default 

在解码 token 时，请确保存在 Calendars.Read API 权限，如下所示:

我能够成功获取日历详细信息，如下所示:

https://graph.microsoft.com/v1.0/me/calendar