使用 Microsoft Graph 成功進行交互式身份驗證后，為什么會出現錯誤訪問被拒絕？

Question

我在本地應用程序和 Azure 門戶中設置了 Microsoft Graph。 我可以使用自己的帳戶成功登錄，但是當其他員工嘗試登錄時，我收到了成功的身份驗證和訪問令牌，但是當InitializeGraphClientAsync()被調用時， Microsoft.Graph.ServiceException會拋出以下內容......

Exception thrown: 'Microsoft.Graph.ServiceException' in System.Private.CoreLib.dll
Failed to initialized graph client.
Accounts in the msal cache: 1.
See exception message for details: Code: ErrorAccessDenied
Message: Access is denied. Check credentials and try again.

登入：

        public async Task<string> SignIn()
        {
            // First, attempt silent sign in
            // If the user's information is already in the app's cache,
            // they won't have to sign in again.
            var message = "";
            try
            {
                var accounts = await PCA.GetAccountsAsync();

                var silentAuthResult = await PCA.AcquireTokenSilent(Scopes, accounts.FirstOrDefault()).ExecuteAsync();

                Debug.WriteLine("User already signed in.");
                Debug.WriteLine($"Successful silent authentication for: {silentAuthResult.Account.Username}");
                Debug.WriteLine($"Access token: {silentAuthResult.AccessToken}");
                message = $"Successful silent authentication for: {silentAuthResult.Account.Username}";
            }
            catch (MsalUiRequiredException msalEx)
            {
                // This exception is thrown when an interactive sign-in is required.
                Debug.WriteLine("Silent token request failed, user needs to sign-in: " + msalEx.Message);
                message = "Silent token request failed, user needs to sign-in: " + msalEx.Message;
                // Prompt the user to sign-in
                var interactiveRequest = PCA.AcquireTokenInteractive(Scopes);

                if (AuthUIParent != null)
                {
                    interactiveRequest = interactiveRequest
                        .WithParentActivityOrWindow(AuthUIParent);
                }

                var interactiveAuthResult = await interactiveRequest.ExecuteAsync();
                Debug.WriteLine($"Successful interactive authentication for: {interactiveAuthResult.Account.Username}");
                Debug.WriteLine($"Access token: {interactiveAuthResult.AccessToken}");
                message = $"Successful interactive authentication for: {interactiveAuthResult.Account.Username}";
            }
            catch (Exception ex)
            {
                Debug.WriteLine("Authentication failed. See exception messsage for more details: " + ex.Message);
                message = "Authentication failed. See exception messsage for more details: " + ex.Message;
            }
            await InitializeGraphClientAsync();

            return message;
        }

初始化

        private async Task InitializeGraphClientAsync()
        {
            var currentAccounts = await PCA.GetAccountsAsync();
            try
            {
                if (currentAccounts.Count() > 0)
                {
                    // Initialize Graph client
                    GraphClient = new GraphServiceClient(new DelegateAuthenticationProvider(
                        async (requestMessage) =>
                        {
                            var result = await PCA.AcquireTokenSilent(Scopes, currentAccounts.FirstOrDefault())
                                .ExecuteAsync();

                            requestMessage.Headers.Authorization =
                                new AuthenticationHeaderValue("Bearer", result.AccessToken);
                        }));

                    await GetUserInfo();

                    IsSignedIn = true;
                }
                else
                {
                    IsSignedIn = false;
                }
            }
            catch (Exception ex)
            {
                Debug.WriteLine("Failed to initialized graph client.");
                Debug.WriteLine($"Accounts in the msal cache: {currentAccounts.Count()}.");
                Debug.WriteLine($"See exception message for details: {ex.Message}");
                await SignOut();
            }
        }

該代碼是直接從微軟的一個教程中提取的。

天藍色：

API 權限

我已將其配置為Accounts in any organizational directory (Any Azure AD directory - Multitenant)

Answer 1

您可以嘗試檢查並遵循以下解決方法來解決問題：

• 驗證您的應用收到的訪問令牌類型是否與尋求或授予的權限類型相匹配。
• 您可能在使用委托的交互式代碼流令牌而不是客戶端憑證流令牌時請求和批准應用程序權限，或者您可能在使用客戶端憑證流令牌而不是委托的代碼流令牌時請求和批准委托的權限。
• 確保您的應用程序在請求中向 Microsoft Graph 發送有效的訪問令牌。
• 根據您的應用調用的 Microsoft Graph API，檢查您請求的權限是否准確。

參考 ：
解決 Microsoft Graph 授權錯誤，
Microsoft Graph 權限參考