从 ASP.Net Core 调用 Microsoft Graph 时缺少必需的范围 Web Api

Question

I have setup a web api to call from Microsoft Graph using a username/password credential passed to it via a vuejs client application. As I tried to extend it out and add new permissions (namely Team.ReadBasic.All). I get a:

Missing scope permissions on the request. API requires one of 'Team.ReadBasic.All, TeamSettings.Read.All, TeamSettings.ReadWrite.All, User.Read.All, Directory.Read.All, User.ReadWrite.All, Directory.ReadWrite.All'. Scopes on the request 'AllSites.Read, openid, profile, Tasks.ReadWrite, User.Read, User.ReadBasic.All, email'

However I have updated my Azure Ad Application with the correct API Permissions (Delegated Team.ReadBasic.All) and I have added the scope like so

appsettings.json

  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "mydomain",
    "TenantId": "mytenantId",
    "ClientId": "myclientId",
    "ClientSecret": "myclientsecret",
    "Scopes": "User.Read,Tasks.ReadWrite,Team.ReadBasic.All",
    "CallbackPath": "/signin-oidc"
  },
  "DownstreamApi": {
    "BaseUrl": "https://graph.microsoft.com/v1.0",
    "Scopes": "User.Read,Tasks.ReadWrite,Team.ReadBasic.All"

With my startup using middleware to test the api.

services.AddAuthentication(sharedOptions =>
            {
                sharedOptions.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
            }).AddJwtBearer(options =>
            {
                Configuration.Bind("AzureAd", options);
                options.Authority = $"{Configuration["AzureAd:Instance"]}{Configuration["AzureAd:TenantId"]}/v2.0";
                options.TokenValidationParameters.ValidAudiences = new string[] { Configuration["AzureAd:ClientId"], $"api://{Configuration["AzureAd:ClientId"]}" };
            });

var userPassCodeCredentail = new UsernamePasswordCredential("", "", Configuration["AzureAd:TenantId"], Configuration["AzureAd:ClientId"]);
services.AddSingleton(_ => new GraphServiceClient(userPassCodeCredentail, Configuration.GetValue<string>("DownstreamApi:Scopes")?.Split(',')));
AddSwagger(services);

With Add Swagger Being

services.AddOpenApiDocument(document =>
            {
                document.AddSecurity("bearer", Enumerable.Empty<string>(), new NSwag.OpenApiSecurityScheme
                {
                    Type = OpenApiSecuritySchemeType.OAuth2,
                    Description = "Azure AAD Authentication",
                    Flow = OpenApiOAuth2Flow.Implicit,
                    Flows = new NSwag.OpenApiOAuthFlows()
                    {
                        Implicit = new OpenApiOAuthFlow()
                        {
                            Scopes = new Dictionary<string, string>
                            {
                                { $"api://{Configuration["AzureAd:ClientId"]}/user_impersonation", "Access Application" },
                                { $"api://{Configuration["AzureAd:ClientId"]}/Team.ReadBasic.All", "Access Team" },
                            },
                            AuthorizationUrl = $"{Configuration["AzureAd:Instance"]}{Configuration["AzureAd:TenantId"]}/oauth2/v2.0/authorize",
                            TokenUrl = $"{Configuration["AzureAd:Instance"]}{Configuration["AzureAd:TenantId"]}/oauth2/v2.0/token",
                        },  
                    },
                });
                document.OperationProcessors.Add(new AspNetCoreOperationSecurityScopeProcessor("bearer"));

Attempting to authorize this way doesn't allow me to consent to the new permission to then use the api call. As the consent panel won't appear when I complete the Microsoft page login process.

Edited: I have added the api permissions to the Azure Ad and ensured that the redirect urls and user consent is set to "Allow consent for all apps"

Answer 1

Try changing the user consent settings

• Go to Azure Active Directory and then Enterprise applications from their consent and permissions now select User Consent settings
• Under User consent for applications choose the consent settings you want to provide to user

Answer 2

Can you follow the tutorial here and ensure you have successfully completed all the steps?

Add Azure AD authentication