如何在范围中包含 Microsoft 图形？

Question

I am working on Azure AD and .net core application. I have a swagger application which will do authentication and authorization. Below is my swagger config.

services.AddSwaggerGen(c =>
{
    c.SwaggerDoc("v1", new Info { Title = "My API", Version = "v1" });

    c.AddSecurityDefinition("oauth2", new OAuth2Scheme
    {
        Type = "oauth2",
        Flow = "implicit",
        AuthorizationUrl = swaggerUIOptions.AuthorizationUrl,
        TokenUrl = swaggerUIOptions.TokenUrl,
        Scopes = new Dictionary<string, string>
        { 
            { "Read", "https://graph.microsoft.com/user.read" }
        }
    });

    c.AddSecurityRequirement(new Dictionary<string, IEnumerable<string>>
    { 
        { "oauth2", new [] { "readAccess", "writeAccess" } }
    });
});

Below is my config in Configure.

app.UseSwaggerUI(c =>
{
    c.RoutePrefix = "swagger";
    c.OAuthClientId(swaggerUIOptions.ClientId);
    c.OAuthClientSecret(swaggerUIOptions.ClientSecret);
    c.OAuthRealm(azureActiveDirectoryOptions.ClientId);
    c.OAuthAppName("Swagger");
    c.SwaggerEndpoint("/swagger/v1/swagger.json", "My API V1");
});

Below are my AuthorizationUrl and TokenUrl

"AuthorizationUrl": "https://login.microsoftonline.com/tenantid/oauth2/v2.0/authorize",
"TokenUrl": "https://login.microsoftonline.com/tenantid/oauth2/v2.0/token"

Below is API permission set in azure ad.

When I try to get token(I selected scope checkmark) in swagger I get below error.

The application swagger asked for Read that doesn't exist on the resource

Also, I have one more app for back end APIs. When we try to get access token, can we the same token to call Graph APIs and backend APIs?

Answer 1

The application swagger asked for Read that doesn't exist on the resource.

There is no Read permission under Microsoft Graph api. You can use User.Read or https://graph.microsoft.com/User.Read

Also, I have one more app for back end APIs. When we try to get access token, can we the same token to call Graph APIs and backend APIs?

You can use this token to call Graph APIs, but need to add the permissions for the api. You can not use the same token to call different apis under different resources.