Microsoft图形-使用应用程序令牌获取MemberOf错误

Question

我正在尝试access Microsoft Graph API使用以下endpoint查询用户所属的组列表

https://graph.microsoft.com/v1.0/users/{userID}/memberof

但从过去两天开始，我的查询失败了，回复如下

{   error: {
    code: 'Authorization_RequestDenied',
    message: 'Insufficient privileges to complete the operation.',
    innerError: {
      'request-id': '7d8a5602-19ca-4cc7-a84d-60cc0c9c09d5',
      date: '2020-04-28T11:44:24'
    }   } }

Directory.Read.All
Directory.ReadWrite.All
Group.Read.All

{
  "aud": "https://graph.microsoft.com",
  "iss": "https://sts.windows.net/TENANTID_REMOVED_FOR_SECURITY/",
  "iat": 1588150105,
  "nbf": 1588150105,
  "exp": 1588154005,
  "aio": "42dgYOCaN0c46++enU1fZx+98Lc3DQA=",
  "app_displayname": "dspIT",
  "appid": "MYAPPID_REMOVED_FOR_SECURITY",
  "appidacr": "1",
  "idp": "https://sts.windows.net/TENANTID_REMOVED_FOR_SECURITY/",
  "oid": "fc709ea2-887e-4794-9417-ac578ab825e8",
  "rh": "0.ATEAfGSULqtSkUqIuFyy2LRFJyPSTnvDYjVDlpuh_cMocSgxAAA.",
  "roles": [
    "User.ReadWrite.All",
    "RoleManagement.Read.Directory",
    "Group.Read.All",
    "Directory.ReadWrite.All",
    "Group.Create",
    "Group.ReadWrite.All",
    "User.Invite.All",
    "Directory.Read.All",
    "User.Read.All",
    "GroupMember.Read.All",
    "User.Export.All",
    "PrivilegedAccess.Read.AzureADGroup",
    "User.ManageIdentities.All",
    "RoleManagement.ReadWrite.Directory",
    "GroupMember.ReadWrite.All",
    "Group.Selected",
    "PrivilegedAccess.ReadWrite.AzureADGroup"
  ],
  "sub": "fc709ea2-887e-4794-9417-ac578ab825e8",
  "tid": "TENANTID_REMOVED_FOR_SECURITY",
  "uti": "wvHXdAZomUefp2RpSGBPAA",
  "ver": "1.0",
  "xms_tcdt": 1519129156
}

谢谢你的帮助。

Answer 1

基于您解码的JWT令牌，我做了一个快速测试，并找到了原因。

似乎有一个应用程序权限group.selected影响此APIendpoint/MemberOf的调用。

此权限有问题，并且影响了其他一些endpoint。我之前在这里回复过一个类似的帖子。