azure - Microsoft Graph - 使用应用程序 token 获取 MemberOf 错误

Question

我正在尝试使用以下端点访问 Microsoft Graph API 来查询用户所属组的列表

https://graph.microsoft.com/v1.0/users/{userID}/memberOf

但是自过去两天以来，我的查询失败，响应如下

{   error: {
    code: 'Authorization_RequestDenied',
    message: 'Insufficient privileges to complete the operation.',
    innerError: {
      'request-id': '7d8a5602-19ca-4cc7-a84d-60cc0c9c09d5',
      date: '2020-04-28T11:44:24'
    }   } }

我已经获得了管理员所需的权限和权限，我授予的访问权限包括

Directory.Read.All
Directory.ReadWrite.All
Group.Read.All

正如微软文档中所述:https://learn.microsoft.com/en-us/graph/api/user-list-memberof?view=graph-rest-1.0&tabs=http

按照本文档 https://learn.microsoft.com/en-us/graph/auth-v2-service 使用访问 token 的授权 header (来自服务)发送 API 请求

解码后的 JWT token 在授权 header 中传递:

{
  "aud": "https://graph.microsoft.com",
  "iss": "https://sts.windows.net/TENANTID_REMOVED_FOR_SECURITY/",
  "iat": 1588150105,
  "nbf": 1588150105,
  "exp": 1588154005,
  "aio": "42dgYOCaN0c46++enU1fZx+98Lc3DQA=",
  "app_displayname": "dspIT",
  "appid": "MYAPPID_REMOVED_FOR_SECURITY",
  "appidacr": "1",
  "idp": "https://sts.windows.net/TENANTID_REMOVED_FOR_SECURITY/",
  "oid": "fc709ea2-887e-4794-9417-ac578ab825e8",
  "rh": "0.ATEAfGSULqtSkUqIuFyy2LRFJyPSTnvDYjVDlpuh_cMocSgxAAA.",
  "roles": [
    "User.ReadWrite.All",
    "RoleManagement.Read.Directory",
    "Group.Read.All",
    "Directory.ReadWrite.All",
    "Group.Create",
    "Group.ReadWrite.All",
    "User.Invite.All",
    "Directory.Read.All",
    "User.Read.All",
    "GroupMember.Read.All",
    "User.Export.All",
    "PrivilegedAccess.Read.AzureADGroup",
    "User.ManageIdentities.All",
    "RoleManagement.ReadWrite.Directory",
    "GroupMember.ReadWrite.All",
    "Group.Selected",
    "PrivilegedAccess.ReadWrite.AzureADGroup"
  ],
  "sub": "fc709ea2-887e-4794-9417-ac578ab825e8",
  "tid": "TENANTID_REMOVED_FOR_SECURITY",
  "uti": "wvHXdAZomUefp2RpSGBPAA",
  "ver": "1.0",
  "xms_tcdt": 1519129156
}

感谢您的帮助。

Answer 1

根据您解码的 JWT token ，我进行了快速测试并找到了原因。

似乎有一个应用程序权限 Group.Selected 会影响此 API 端点 /memberOf 的调用。

此权限有问题，并且影响了其他一些端点。我之前回答过类似的帖子here .

因此，如果没有必要，只需将其从 Azure AD 应用程序中删除即可。然后这个错误就会消失。

如果需要此权限，恐怕您需要创建一个新的Azure AD应用程序来添加该权限才能使用。