通过Microsoft.Graph邀请用户会出现错误

Question

Expected behavior

Should invite a user then update the user with some more information https://docs.microsoft.com/en-us/graph/api/invitation-post?view=graph-rest-1.0

Actual behavior

Source

"Microsoft.Graph.Core"

Message

"Code: Unauthorized\r\nMessage: Insufficient privileges to perform requested operation by the application '00000003-0000-0000-c000-000000000000'. ControllerName=MSGraphInviteAPI, ActionName=CreateInvite, URL absolute path=/api/9cXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/invites\r\n\r\nInner error\r\n"

Stacktrace

   at Microsoft.Graph.HttpProvider.SendAsync(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
   at Microsoft.Graph.BaseRequest.SendRequestAsync(Object serializableObject, CancellationToken cancellationToken, HttpCompletionOption completionOption)
   at Microsoft.Graph.BaseRequest.SendAsync[T](Object serializableObject, CancellationToken cancellationToken, HttpCompletionOption completionOption)
   at Web.Api.Infrastructure.Infrastructure.Repositories.AzureRepository.CreateUser(CreateUserCommand user) in C:\Users\SamPrecious\source\repos\Adept\src\adept-web-api\Web.Api.Infrastructure\Infrastructure\Repositories\AzureRepository.cs:line 166

Steps to reproduce the behavior

SDK Version: netcoreapp2.2
"Microsoft.Graph" Version="1.13.0" "Microsoft.Graph.Core" Version="1.13.0"

IDE Version: VS Code - 1.31.1 Vsiual Studio Enterprise 2017 - 4.7.03056

I have this method (moving the code to create a GraphServiceClient into the method to prove a point) The client authenticates with the App registration (I get an access token back) but when the code to Invite runs, the authenticationContext.AcquireTokenAsync triggers again and I get an error with the stack trace above. The client application has User.Invite.All, User.ReadWrite.All, Directory.ReadWrite.All as per the API documentation.

Why is the AppId changing in the code to the one in the above Message?

public async Task<string> CreateUser(CreateUserCommand user)
        {
            try
            {
                var clientCredential = new ClientCredential(_configuration["appId"], _configuration["secret"]);
                var authenticationContext = new AuthenticationContext(_configuration["authority"]);
                var authenticationResult = authenticationContext.AcquireTokenAsync("https://graph.microsoft.com", clientCredential).Result;

                var delegateAuthProvider = new DelegateAuthenticationProvider((requestMessage) =>
                {
                    requestMessage.Headers.Authorization = new AuthenticationHeaderValue("bearer", authenticationResult.AccessToken);

                    return Task.FromResult(0);
                });

                var con = new GraphServiceClient(delegateAuthProvider);

                //invite user
                Invitation invitation = new Invitation();
                invitation.InvitedUserDisplayName = user.Name;
                invitation.SendInvitationMessage = true;
                invitation.InvitedUserEmailAddress = user.Email;
                invitation.InviteRedirectUrl = "http://localhost";
                var result = await con.Invitations.Request().AddAsync(invitation);

                //update user
                var aadUser = _connection.GetConnection().ActiveDirectoryUsers.GetById(result.Id);
                var updateUser = result.InvitedUser;
                updateUser.DisplayName = user.Name;
                updateUser.Surname = user.Surname;
                updateUser.Mail = user.Email;
                updateUser.MobilePhone = user.Phone;
                await con.Users[result.InvitedUser.Id].Request().UpdateAsync(updateUser);
                return aadUser.UserPrincipalName;
            }
            catch (System.Exception)
            {

                throw;
            }


        }

The CreateUserCommand:

public class CreateUserCommand
    {
        public string Name { get; set; }
        public string Surname { get; set; }
        public string Email { get; set; }
        public string Phone { get; set; }
    }

Here is a capture of the app registration

Permissions:

App Id in the IConfiguration object

Answer 1

Delegated permissions only matter when you are calling an API in a user context.

Since you are using client credentials, there is no user. Only application permissions apply, so set the correct permissions there.

Also, since you have an async function, it's better to await the token as well:

var authenticationResult = await authenticationContext.AcquireTokenAsync("https://graph.microsoft.com", clientCredential);