使用圖形 API 訪問 SharePoint 網站

Question

我正在嘗試使用后台服務將文件上傳到 SharePoint 站點，到目前為止我什至無法成功列出站點。 我相信我這邊的權限/訪問存在問題，以下是我正在使用的核心代碼：

var application = ConfidentialClientApplicationBuilder
    .Create("APP_ID")
    .WithClientSecret("APP_SECRET")
    .WithTenantId("TENANT_GUID")
    .Build();

ClientCredentialProvider authProvider = new ClientCredentialProvider(application, "https://*****.sharepoint.com/.default");
GraphServiceClient graphClient = new GraphServiceClient(authProvider);

var sites = await graphClient.Sites.Request().GetAsync();

但在這種情況下拋出異常：

Access token validation failure. Invalid audience.

如果我從 ClientCredentialProvider 中刪除范圍，則會出現下一個異常：

Code: AccessDenied Message: Either scp or roles claim need to be present in the token.

應用程序本身具有所有必需的權限：

任何想法我在這里做錯了什么

Answer 1

    IConfidentialClientApplication confidentialClientApplication = ConfidentialClientApplicationBuilder
        .Create(clientId)
        .WithTenantId(tenantID)
        .WithClientSecret(clientSecret)
        .Build();
    
    ClientCredentialProvider authProvider = new ClientCredentialProvider(confidentialClientApplication);

    GraphServiceClient graphClient = new GraphServiceClient( authProvider );
    //To access the root SharePoint site：
    var site1 = await graphClient.Sites["root"]
               .Request()
               .GetAsync();
    //To access the Specified SharePoint site：
    var site2 = await graphClient.Sites["{site-id}"]
               .Request()
               .GetAsync();

正如@Shiva- MSFT Identity 所說，請在 MicrosoftGraph 權限下而不是在 Sharepoint 權限下添加應用程序權限Sites.ReadWrite.All 。

Answer 2

我的測試代碼供您參考：

string clientID = "cde921c5-abcd-abcd-a450-6dabcd46fec5"; // Put the Application ID from above here.
            string clientSecret = "N7b1sxnxGCxLLWx9m0~UJUxBx.PNGrqb.K"; // Put the Client Secret from above here.

            string graphApiResource = "https://graph.microsoft.com";
            Uri microsoftLogin = new Uri("https://login.microsoftonline.com/");
            string tenantID = "2e83cc45-652e-418b-a85v-80c281v30c09"; // Put the Azure AD Tenant ID from above here.

            // The authority to ask for a token: your azure active directory.
            string authority = new Uri(microsoftLogin, tenantID).AbsoluteUri;
            AuthenticationContext authenticationContext = new AuthenticationContext(authority);
            ClientCredential clientCredential = new ClientCredential(clientID, clientSecret);

            // Picks up the bearer token.
            AuthenticationResult authenticationResult = authenticationContext.AcquireTokenAsync(graphApiResource, clientCredential).Result;

            GraphServiceClient graphClient = new GraphServiceClient(new DelegateAuthenticationProvider(
                async (requestMessage) =>
                {
                    // This is adding a bearer token to the httpclient used in the requests.
                    requestMessage.Headers.Authorization = new AuthenticationHeaderValue("bearer", authenticationResult.AccessToken);
                }));
            
            var sites =  graphClient.Sites.Request().GetAsync();