由于401未经授权,使用Graph API(按应用程序)访问Office 365 Planner数据时出现问题

由于401未经授权,使用Graph API(按应用程序)访问Office 365 Planner数据时出现问题

问题描述:

我一直在努力使用已在Azure中设置的应用程序从Office 365访问计划程序数据.我已经能够成功检索许可和用户信息,但是无法从Planner获取用户任务列表.

I have been struggling with accessing planner data from office 365 using an application which I have setup in Azure. I have been able to successfully retrieve licensing and user information, but am unable to get a list of user tasks (from Planner).

进一步的澄清:

  • 我正在尝试访问其他用户的计划员数据任务,而不是我自己的任务.
  • 这不是面向用户的应用程序,用户从不登录.我正在使用REST界面,使用我已注册的应用程序客户端/密钥,以获得用于后续请求的令牌.我不是以用户身份登录的,而是以应用程序身份登录的,因此无法像在图api资源管理器中那样使用我".
  • 通信成功,并且我能够读写其他所有用户数据而没有问题.该问题似乎很清楚地表明,所使用的应用程序无权查看计划程序数据,但是我已赋予该应用程序所有特权,并且在尝试读取计划程序数据时仍然获得401.
  • 我不确定所使用的技术是否相关,但是为了提供尽可能多的细节,我使用的是nodejs和adal-node(
  • I am trying to access other users planner data tasks, not my own.
  • This is not a user facing application, a user never logs in. I am using the REST interface using my registered apps client/secret key in order to obtain a token which is used for subsequent requests. I am not logging in as a user, i am logging in as an application, there for using 'me' would not work as it does in the graph api explorer.
  • Communication is succeeding, and I am able to read and write any OTHER user data without issue. The problem seems to be spelled out clearly that the application being used does not have authorization to view the planner data, but I have given this application all privileges and still get a 401 when trying to read planner data.
  • I'm not sure the technologies used are relevant, but for the sake of providing as much detail as possible, I am using nodejs and the adal-node (https://github.com/AzureAD/azure-activedirectory-library-for-nodejs)

图文档: https://图. microsoft.io/en-us/docs/api-reference/beta/api/user_list_tasks

文档清楚地说明了执行此操作所需的作用域是Group.ReadWrite.All AND Tasks.ReadWrite(已提供给应用程序)(以及成堆的其他权限,因为我变得绝望和恼火).为下面列出的每个应用程序检查了所有应用程序权限和所有委派的权限.完成这项工作后,我将删除必要的内容,但我认为这将有助于减轻您是否尝试过检查此..或那个..响应"

The document clearly states the required scopes to execute this are Group.ReadWrite.All AND Tasks.ReadWrite which I have supplied to the application (as well as tons of other permissions, as I was becoming desperate and annoyed). All Application Permissions and all Delegated Permissions are checked for each of the applications listed below. I will remove the necessary ones after I get this working, but I figured this will help alleviate the "Have you tried checking this.. or that.. responses"

我意识到这是beta版本,但我希望能利用它,并以为其他人可能会比较幸运.

I realize this is in beta, but was hoping to make use of it, and thought maybe someone else had better luck.

我尝试通过以下两种方式形成请求: https://graph.microsoft.com/beta/users/[用户名]/计划 https://graph.microsoft.com/beta/tasks ?$ filter = createdBy eq' [用户名]'

I have attempting forming the request both of the following ways: https://graph.microsoft.com/beta/users/[username]/plans https://graph.microsoft.com/beta/tasks?$filter=createdBy eq '[username]'

两者都会产生以下结果(由于长度原因,大部分邮件已被删除):

Both produce the following result (most of message has been removed due to length):

{ error: 
   { code: 'UnknownError',
     message: '...<h2>401 - Unauthorized: Access is denied due to invalid credentials.</h2>\r\n  <h3>You do not have permission to view this directory or page using the credentials that you supplied.</h3>...',
     innerError: 
      { 'request-id': '09ef3a04-7fc2-48a0-9570-7f04171e45ed',
        date: '2016-05-11T14:18:12' } } }

我查看了跟踪日志以了解发生了什么.如上所述,您正在使用仅应用程序流(在OAuth2.0术语中也称为client_credential流)对Microsoft Graph(以及此处的任务API)进行调用,但是基本上,该应用程序本身是在没有任何用户的情况下进行调用语境).当仅使用应用程序流时,用于控制对API的访问的权限是您在中间列的UX屏幕快照中选择的权限(应用程序权限).

I took a look at the trace logs to see what was going on here. As you noted above, you are making calls to the Microsoft Graph (and here the tasks APIs) using the application-only flow (also known in OAuth2.0 parlance as the client_credential flow, but basically the app is calling as itself without any user context). The permissions that govern access to the API when using the application only flow are the ones you've selected in the UX screenshot in the middle column (application permissions).

Microsoft Graph当前不支持仅应用程序对Tasks API的访问.这就是为什么您获得401 Unauthorized的原因.为了访问Microsoft Graph下的Tasks API(在一个组中),您需要在"Delegated Permissions"(在UX的右手列)下选择Group.ReadWrite.All AND Tasks.ReadWrite权限并使用代码流以获取带有已登录用户上下文的访问令牌. node.js的ADAL应该支持以应用程序+用户模式进行调用的功能.

Microsoft Graph currently doesn't support application only access to the Tasks APIs. This is why you are getting a 401 Unauthorized. In order to get access to the Tasks APIs (in a group) under Microsoft Graph, you'll need to select the Group.ReadWrite.All AND Tasks.ReadWrite permissions under "Delegated Permissions" (right hand column in the UX) AND use the code flow to acquire an access token with signed in user context. ADAL for node.js should support the ability to call in app+user mode.

如果您的方案需要仅应用程序访问Microsoft Graph,请提交 uservoice Microsoft Graph的功能请求,以支持组和任务仅应用程序的访问.

If your scenario requires app-only access to Microsoft Graph, then please file a uservoice feature request for Microsoft Graph to support groups and tasks app-only access.

希望这会有所帮助,