Azure Active Directory：同意框架已停止授予同意

Question

我的Azure Active Directory应用程序需要以下委派权限：

• 读取目录数据
• 启用登录和读取用户配置文件
• 访问组织的目录

现在，在我完成了同意框架（通过以管理员用户的身份从表单发布到applyforactority)之后，以非管理员用户的身份登录失败，出现错误消息AADSTS90093（此操作只能由管理员执行）。无益的是，错误消息没有说明“这个操作”实际上是什么，但我怀疑它是第三个操作（访问您的组织的目录）。

null

这是现有的代码：

private static readonly string ClientId = ConfigurationManager.AppSettings["ida:ClientID"];

[HttpPost]
public ActionResult ApplyForConsent()
{
    string signupToken = Guid.NewGuid().ToString();
    string replyUrl = Url.Action("ConsentCallback", "Account", new { signupToken }, Request.Url.Scheme);
    DatabaseIssuerNameRegistry.CleanUpExpiredSignupTokens();
    DatabaseIssuerNameRegistry.AddSignupToken(signupToken, DateTimeOffset.UtcNow.AddMinutes(5));
    return new RedirectResult(CreateConsentUrl(ClientId, "DirectoryReaders", replyUrl));
}

[HttpGet]
public ActionResult ConsentCallback()
{
    string tenantId = Request.QueryString["TenantId"];
    string signupToken = Request.QueryString["signupToken"];
    if (DatabaseIssuerNameRegistry.ContainsTenant(tenantId))
    {
        return RedirectToAction("Validate");
    }

    string consent = Request.QueryString["Consent"];
    if (!String.IsNullOrEmpty(tenantId) && String.Equals(consent, "Granted", StringComparison.OrdinalIgnoreCase))
    {
        if (DatabaseIssuerNameRegistry.TryAddTenant(tenantId, signupToken))
        {
            return RedirectToAction("Validate");
        }
    }

    const string error = "Consent could not be provided to your Active Directory.  Please contact SharpCloud for assistance.";
    var reply = Request.Url.GetLeftPart(UriPartial.Authority) + Url.Action("Consent", new { error });
    var config = FederatedAuthentication.FederationConfiguration.WsFederationConfiguration;
    var signoutMessage = new SignOutRequestMessage(new Uri(config.Issuer), reply);
    signoutMessage.SetParameter("wtrealm", config.Realm);
    FederatedAuthentication.SessionAuthenticationModule.SignOut();
    return Redirect(signoutMessage.WriteQueryString());
}

private static string CreateConsentUrl(string clientId, string requestedPermissions, string consentReturnUrl)
{
    string consentUrl = String.Format(CultureInfo.InvariantCulture, ConsentUrlFormat, HttpUtility.UrlEncode(clientId));

    if (!String.IsNullOrEmpty(requestedPermissions))
    {
        consentUrl += "&RequestedPermissions=" + HttpUtility.UrlEncode(requestedPermissions);
    }
    if (!String.IsNullOrEmpty(consentReturnUrl))
    {
        consentUrl += "&ConsentReturnURL=" + HttpUtility.UrlEncode(consentReturnUrl);
    }

    return consentUrl;
}

Answer 1

我认为这个链接解决了您的问题：

http://blogs.msdn.com/b/aadgraphteam/archive/2015/03/19/update-to-graph-api-actority-permissions.aspx

简单总结一下，现在只有管理员才可以批准一个网络应用程序“•访问你的组织的目录”。