azure - SharePoint 在线 OAuth2 token invalid_scope

Question

我正在尝试为我注册的 Azure AD 应用程序获取不记名 token ，以通过 API 读取我的所有共享点网站

我按照微软的指南进行了 a) grant permissions for the app和b get myself a token

所以我现在 a) 拥有所有必需的权限: b) 使用范围 https://graph.microsoft.com/.default

时收到 token

所以这是我的问题:当我尝试获取 token 时，可以说https://microsoft.sharepoint-df.com/Sites.Read.All:

https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token

Body:x-www-form-urlencoded
client_id={appId}
scope=https://microsoft.sharepoint-df.com/Sites.Read.All
client_secret={secret},
grant_type=client_credentials

我得到的只是一个错误:

"error": "invalid_scope",
"error_description": "AADSTS70011: The provided request must include a 'scope' input parameter. The provided value for the input parameter 'scope' is not valid. The scope https://microsoft.sharepoint-df.com/Sites.ReadWrite.All is not valid.\r\nTrace ID: ...\r\nCorrelation ID: ...\r\nTimestamp: 2019-06-09 07:35:21Z",
"error_codes": [
    70011
],

我做错了什么吗？我还尝试了范围 https://{{tenantName}}.sharepoint.com/Sites.Read.All

Answer 1

您正在使用客户端凭据流来获取访问 token 。范围必须是

https://graph.microsoft.com/.default

The value passed for the scope parameter in this request should be the resource identifier (application ID URI) of the resource you want, affixed with the .default suffix. For the Microsoft Graph example, the value is https://graph.microsoft.com/.default. This value tells the Microsoft identity platform endpoint that of all the direct application permissions you have configured for your app, the endpoint should issue a token for the ones associated with the resource you want to use.

如果您必须使用特定范围，例如https://microsoft.sharepoint-df.com/Sites.Read.All，您可以使用 auth code grant flow获取访问 token 。