azure ad b2c应用程序注册的差异

Question

步骤

1. 手动创建应用程序并添加了一些权限(application.readwrite.all、application.readwrite.ownedby、directory.readwrite.all、policy.readwrite.trustframework.trustframeworkkeyset.read.all、trustframeworkkeyset.readwrite.all、user.read.all)
2. 然后我使用上面创建的应用程序客户端id和客户端机密（用于调用graph api）编写下面的脚本。

$tenantid ='xxxxxxxxxxxxxxxx'
$appid='xxxxxxxxxxxxxxxxxxxx'
$appsecret = 'xxxxxxxxxxxxxxxx'  
$Uri = 'https://login.microsoftonline.com/' + $tenantid +'/oauth2/v2.0/token'
    
$Form = @{
        client_id     = $appid
        scope         = 'https://graph.microsoft.com/.default'
        client_secret = $appsecret
        grant_type    = 'client_credentials'
      }
$Result = Invoke-RestMethod -Uri $Uri -Method Post -Form $Form -contenttype 'application/json'
$access_token=$Result.access_token
$url = 'https://graph.microsoft.com/v1.0/applications'
$headers = @{Authorization = "Bearer $access_token" }
$method = "Post"
$json = $bodyjsonstring | ConvertFrom-Json | ConvertTo-Json -Depth 10
$response = Invoke-RestMethod -Uri $url -Body $json -Method $method -Headers $headers -contenttype 'application/json'

$appId = $response.appId
$urlforappsp = 'https://graph.microsoft.com/v1.0/serviceprincipals'
  $dataforsp = '{
  "appId": "' + $appId + '",
}'
  $headers = @{Authorization = "Bearer $access_token" }
  $method = "Post"
  $json = $bodyjsonstring | ConvertFrom-Json | ConvertTo-Json -Depth 10
  # Write-Host $json
  $response = Invoke-RestMethod -Uri $urlforappsp -Body $json -Method $method -Headers $headers -contenttype 'application/json'
  $responsesp = HTTP_POST_CALL -bearer_token $accesstoken -url $urlforappsp -bodyjsonstring $dataforsp

4.然后我调用链接

null

html prettyprint-override">{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#applications/$entity",
    "id": "xxxxxxxxx",
    "deletedDateTime": null,
    "appId": "xxxxxxxx",
    "applicationTemplateId": null,
    "createdDateTime": "2020-12-14T18:23:26Z",
    "displayName": "userapp",
    "description": null,
    "groupMembershipClaims": null,
    "identifierUris": [],
    "isDeviceOnlyAuthSupported": null,
    "isFallbackPublicClient": null,
    "notes": null,
    "optionalClaims": null,
    "publisherDomain": "xxxxxxxxxxxx",
    "signInAudience": "AzureADMyOrg",
    "tags": [],
    "tokenEncryptionKeyId": null,
    "verifiedPublisher": {
        "displayName": null,
        "verifiedPublisherId": null,
        "addedDateTime": null
    },
    "spa": {
        "redirectUris": []
    },
    "defaultRedirectUri": null,
    "addIns": [],
    "api": {
        "acceptMappedClaims": null,
        "knownClientApplications": [],
        "requestedAccessTokenVersion": null,
        "oauth2PermissionScopes": [],
        "preAuthorizedApplications": []
    },
    "appRoles": [],
    "info": {
        "logoUrl": null,
        "marketingUrl": null,
        "privacyStatementUrl": null,
        "supportUrl": null,
        "termsOfServiceUrl": null
    },
    "keyCredentials": [],
    "parentalControlSettings": {
        "countriesBlockedForMinors": [],
        "legalAgeGroupRule": "Allow"
    },
    "passwordCredentials": [],
    "publicClient": {
        "redirectUris": []
    },
    "requiredResourceAccess": [],
    "web": {
        xxxxx
        }
    }
}

 requiredResourceAccess and approle are empty.then how do i call 

“/approleassignedto”

Answer 1

我试图调用Update application graph api，通过更改RequiredResourceAccess属性集来修改权限类型。虽然它成功了，并且确实在Azure portal中将权限类型更改为application permission，但它也将权限名称更改为ID。，所以我不建议你使用这种方法。

同时，我发现您在自动执行权限时调用https://graph.microsoft.com/v1.0/oauth2PermissionGrantsapi。此api通常用于分配委托权限，因此如果您正在分配应用程序权限，请不要使用它。

最简单的方法是调用appRoleAssignment graph api，它将直接为您的应用程序分配应用程序权限。

在门户->清单->RequiredResourceAccess中导航到广告应用程序，获取resourceAppId和id，将id标记为approleID。