對非管理員的Microsoft Graph API權限？

Question

我想創建一個與我的Office365租戶中的所有用戶的下拉菜單。我在Azure AD中創建了一個應用程序，併爲其提供了所有必要的權限。我實際上給了它Microsoft Graph的所有權限，應用程序和委託。他們全部。

然後我寫了腳本來查詢所有用戶https://graph.microsoft.com/v1.0/users。

我讓我的租戶管理員進入並接受權限，然後輸出用戶界面中的用戶列表。做工精細的管理

我不是管理員，但是當我去的網頁我得到以下錯誤：

This application requires application permissions to another application. Consent for application permissions can only be performed by an administrator. Sign out and sign in as an administrator or contact one of your organization's administrators.

我需要知道這是否會爲用戶的工作和更低的權限。從我所瞭解的API請求和應用程序在Azure中給予應用程序的權限下運行。因此，即使用戶爲只讀，請求未在用戶下運行，它仍在我設置的應用程序下運行。那麼，爲什麼我會得到有關權限的錯誤？

這是我使用的代碼：

(function() { 
    "use strict"; 
    // Some samples will use the tenant name here like "tenant.onmicrosoft.com" 
    // I prefer to user the subscription Id 
    var subscriptionId = "metenant.onmicrosoft.com"; 
    // Copy the client ID of your AAD app here once you have registered one, configured the required permissions, and 
    // allowed implicit flow https://msdn.microsoft.com/en-us/office/office365/howto/get-started-with-office-365-unified-api 
    var clientId = "cccb1f2f-xxx-x-xxxxx-x-x-x-x-x-"; 

    window.config = { 
    // subscriptionId: subscriptionId, 
    clientId: clientId, 
    postLogoutRedirectUri: window.location.origin, 
    endpoints: { 
     graphApiUri: 'https://graph.microsoft.com' 
    }, 
    cacheLocation: 'localStorage' // enable this for IE, as sessionStorage does not work for localhost. 
    }; 

    var authContext = new AuthenticationContext(config); 

    // Check For & Handle Redirect From AAD After Login 
    var isCallback = authContext.isCallback(window.location.hash); 
    authContext.handleWindowCallback(); 

    if (isCallback && !authContext.getLoginError()) { 
    window.location = authContext._getItem(authContext.CONSTANTS.STORAGE.LOGIN_REQUEST); 
    } 

    // If not logged in force login 
    var user = authContext.getCachedUser(); 
    // NOTE: you may want to render the page for anonymous users and render 
    // a login button which runs the login function upon click. 
    if (!user) authContext.login(); 

    // Acquire token for Files resource. 
    authContext.acquireToken(config.endpoints.graphApiUri, function (error, token) { 
    // Handle ADAL Errors. 
    if (error || !token) { 
     console.log('ADAL error occurred: ' + error); 
     return; 
    } 
    // Execute GET request to Files API. 
    var filesUri = config.endpoints.graphApiUri + "/v1.0/users"; 
    $.ajax({ 
     type: "GET", 
     url: filesUri, 
     headers: { 
     'Authorization': 'Bearer ' + token, 
     } 
    }).done(function (response) { 
     console.log('Successfully fetched from Graph.'); 
     console.log(response); 

     var container = $(".container") 

     container.empty(); 

     $.each(response.value, function(index, item) { 
     container.append($('<li>').text(item.displayName + " " + item.mail + " " + item.mobilePhone)) 
     }) 
    }).fail(function (response) { 
     var err = JSON.parse(response.responseText) 
     console.log('Failed:', err.error.message); 
    }); 
    }); 
})(); 

Answer 1

有兩種對微軟圖形許可/範圍。一個是需要管理員的同意。另一個不是必需的。

你爲這個應用程序配置了什麼權限？要列出用戶無需管理員的同意，我們可以使用的範圍User.ReadBasic.All如下面的圖：

你可以得到有關從here權限/範圍的更多細節。

修改：

目前，adal.js不提供管理員同意。如果要使用此功能，您可以修改代碼以添加一個prameter象下面這樣：

AuthenticationContext.prototype.login = function (prompt) { 
// Token is not present and user needs to login 
var expectedState = this._guid(); 
this.config.state = expectedState; 
this._idTokenNonce = this._guid(); 
this._logstatus('Expected state: ' + expectedState + ' startPage:' + window.location); 
this._saveItem(this.CONSTANTS.STORAGE.LOGIN_REQUEST, window.location); 
this._saveItem(this.CONSTANTS.STORAGE.LOGIN_ERROR, ''); 
this._saveItem(this.CONSTANTS.STORAGE.STATE_LOGIN, expectedState); 
this._saveItem(this.CONSTANTS.STORAGE.NONCE_IDTOKEN, this._idTokenNonce); 
this._saveItem(this.CONSTANTS.STORAGE.FAILED_RENEW, ''); 
this._saveItem(this.CONSTANTS.STORAGE.ERROR, ''); 
this._saveItem(this.CONSTANTS.STORAGE.ERROR_DESCRIPTION, ''); 


var urlNavigate = this._getNavigateUrl('id_token', null) + '&nonce=' + encodeURIComponent(this._idTokenNonce); 

if (prompt && prompt === "admin_consent") { 
    urlNavigate = urlNavigate + "&prompt=admin_consent" 
} 


this.frameCallInProgress = false; 
this._loginInProgress = true; 
if (this.config.displayCall) { 
    // User defined way of handling the navigation 
    this.config.displayCall(urlNavigate); 
} else { 
    this.promptUser(urlNavigate); 
} 
// callback from redirected page will receive fragment. It needs to call oauth2Callback 
}; 

如果你使用角度，我們還需要修改阿達爾 - angular.js：

this.$get = ['$rootScope', '$window', '$q', '$location', '$timeout', function ($rootScope, $window, $q, $location, $timeout) { 
... 
return { 
       // public methods will be here that are accessible from Controller 
       config: _adal.config, 
       login: function (prompt) { 
       _adal.login(prompt); 
     }, 
... 
} 

然後我們可以爲用戶登錄提供兩個按鈕。一個按鈕用於用戶自己登錄。另一個是管理員同意該組織。下面是代碼重定向到登錄頁面，在角的控制管理員同意：

$scope.login = function() { 
    adalService.login("admin_consent"); 
};