Microsoft GraphAPI 403 在 SPfx 应用程序中获取用户事件时出错

Question

I wrote a SharePoint SPfx Application hosted on SharePoint Online using the Microsoft GraphAPI to grab user profile information as well as calendar events. Per microsoft documents I declared my scopes inside the package-solution.json file and approved the request via the SharePoint APi management page. I am able to read everybody profile information, however, I get an error 403 when I try to access calendar events but my own. The users' calendar are not private, they open to the entire organization.

Package-solution.json Permission request

"webApiPermissionRequests": [
      {
        "resource": "Microsoft Graph",
        "scope": "User.Read"
      },
      {
        "resource": "Microsoft Graph",
        "scope": "User.ReadBasic.All"
      },
      {
        "resource": "Microsoft Graph",
        "scope": "People.Read"
      },
      {
        "resource": "Microsoft Graph",
        "scope": "Calendars.Read"
      }
    ]
  }

Admin Approved request image

Screen of approved app permissions

request code:

private _searchUserCalendar(keyword: string): Promise<any[]> {
    console.log("connection to GraphAPI event domain")
    return new Promise<any[]>((resolve, reject) => {
      this._context.msGraphClientFactory.getClient()
        .then((client: MSGraphClient): void => {
          client
            .api(`/users/${keyword}/calendar/events`) // The api i.e> /me | /users
            .version('v1.0')
            .select("showAs,start,subject, end")
            .top(5)
            .get((error, response: any, rawResponse?: any) => {
              if (error) {
                console.log("ooops somethign went wrong get events",error);
                reject(error);
              }
              var users:Array<any>=new Array<any>();

              // Map the JSON response to the output array
              if (response != null && response != undefined) {
                console.log(response);
                response.value.map((item: any) => {
                  console.log("found events for:", item)
                }); // mapping over users
              }
              resolve(users);  

            });
        });
    });
  }

Error response

{error: {code: "ErrorAccessDenied", message: "Access is denied. Check credentials and try again.",…}}
error: {code: "ErrorAccessDenied", message: "Access is denied. Check credentials and try again.",…}
code: "ErrorAccessDenied"
message: "Access is denied. Check credentials and try again."
innerError: {request-id: "5dca3d4f-ab4c-4237-8ff4-78d8cacbd43b", date: "2020-01-16T19:05:26"}
request-id: "5dca3d4f-ab4c-4237-8ff4-78d8cacbd43b"
date: "2020-01-16T19:05:26"

I've tried everything, any help would be greatly appreciated.

• I tested my request on graph explorer and that worked fine
• I uninstalled/re-installed the app
• I rejected and re-approved the permissions request on the API management dashboard
• I changed the request URL from using user id to using emails (only worked for my profile but still didn't work for anybody else)
• I had users share their calendar with me and give read/write permissions, still didn't work because the permission is application specific and not user delegated.

Answer 1

User.Read , and User.ReadBasic.All don't have the permissions to do what you are trying to do.

This URL talks about calendar reading shared events.

As an example, Garth has shared with John his default calendar and given John read access. If John has signed into your app and provided delegated permissions (Calendars.Read.Shared or Calendars.ReadWrite.Shared), your app will be able to access Garth's default calendar and events in that calendar as described below.

Can you try adding Calendar.Read.Shared

Answer 2

After trying different permission scopes including the ones suggested by @chad, it seems that Calendar.Read.Shared worked. However, it worked because it is a delegated permission forwhich the users must implicitly share their calendar with the entire organization or the signed-in user. This is misleading and contrary to what I read in the graphAPI documentations found here under Calendar > Application permission:

Calendars.Read | Read calendars in all mailboxes Allows the app to read events of all calendars without a signed-in user.

... and

Calendars.Read.Shared | Read user and shared calendars Allows the app to read events in all calendars that the user can access, including delegate and shared calendars.

Therefore, according to the previous statements, All i need is Calendars.Read in order to read all events in a user's calendar created by said user. The logic of using Calendars.Read.Shared would be to also read all events shared by the user, including those not created but shared with the user.

Finally, I marked this as answered because it is the only thing that worked for me (somewhat) and not because it solved the original issue. The documentation on this topic is contradictory and confusing. For now this is my answer unless Microsoft changed something or clarify the issue or you found something else or/and my logic is flawed. If my logic and understanding is flawed please post a response and let me know. Afterall, this is what the community is for.

Thank you