如何以编程方式获取 Azure AD 应用程序的 Graph API 权限指南？

Question

我正在尝试向 Azure AD 应用程序添加所需的权限。我已经知道如何通过 PATCH REST 调用从下载的清单中复制信息，例如

"requiredResourceAccess": [
{
  "resourceAppId": "00000003-0000-0000-c000-000000000000",
  "resourceAccess": [
    {
      "id": "7b9103a5-4610-446b-9670-80643382c1fa",
      "type": "Scope"
    },
    {
      "id": "5df07973-7d5d-46ed-9847-1271055cbd51",
      "type": "Scope"
    }
  ]
}
]          

正如 Christer Ljung 在他的博客 http://www.redbaronofazure.com/?page_id=181 中所解释的那样。

但谜团仍然是我如何将诸如 Mail.Read 之类的人类可读范围“转换”为这些晦涩的 guid。我在http://blah.winsmarts.com/2015-1-Programmatically_register_native_apps_in_Azure_AD_or_Office_365.aspx 阅读了 Sahil Malik 的以下博客，其中解释了如何获取特定 ServicePrincipal 的可用 guid 列表。例如。通过 http 访问 https://graph.windows.net/<tenant-id>/servicePrincipals()?api-version=1.6&$filter=appId%20eq%20'00000002-0000-0ff1-ce00-000000000000'> (Exchange) 但是当我尝试获取 ServicePrincipal 00000003-0000-0000-c000-000000000000 的可用范围列表时 (我相信是 Graph API)，返回值只是空的。

有趣的是，在通过 Azure 门户添加权限时，我能够使用 Fiddler 捕获包含所有 guid 的 http post 请求。

有人知道我如何以编程方式执行此操作吗？

Answer 1

经过调查，我发现了一种使用 azure-cli 获取权限 guid 的方法。在这里分享以防有人发现：

1. 通过显示名称、应用 ID 或对象 ID 获取某个服务主体的所有权限及其 GUID。 （注意 display-name 不是唯一的，可以映射多个服务主体）

$ az ad sp list --filter "displayName eq 'Microsoft Graph'" --query '[].oauth2Permissions[].{Value:value, Id:id, UserConsentDisplayName:userConsentDisplayName}' -o table
Value                                                    Id                                    UserConsentDisplayName
-------------------------------------------------------  ------------------------------------  -----------------------------------------------------------------------------------------
ServiceHealth.Read.All                                   55896846-df78-47a7-aa94-8d3d4442ca7f  Read service health
ServiceMessage.Read.All                                  eda39fa6-f8cf-4c3c-a909-432c683e4c9b  Read service messages
TermStore.ReadWrite.All                                  6c37c71d-f50f-4bff-8fd3-8a41da390140  Read and write term store data
TermStore.Read.All                                       297f747b-0005-475b-8fef-c890f5152b38  Read term store data
TeamMember.ReadWriteNonOwnerRole.All                     2104a4db-3a2f-4ea0-9dba-143d457dc666  Add and remove members with non-owner role for all teams
Team.Create                                              7825d5d6-6049-4ce7-bdf6-3b8d53f4bcd0  Create teams
TeamsAppInstallation.ReadWriteForUser                    093f8818-d05f-49b8-95bc-9d2a73e9a43c  Manage your installed Teams apps
TeamsAppInstallation.ReadWriteSelfForUser                207e0cb1-3ce7-4922-b991-5a760c346ebc  Allow the Teams app to manage itself for you
...

$ az ad sp list --filter "appId eq '00000003-0000-0000-c000-000000000000'" --query '[].oauth2Permissions[].{Value:value, Id:id, UserConsentDisplayName:userConsentDisplayName}' -o table | head
Value                                                    Id                                    UserConsentDisplayName
-------------------------------------------------------  ------------------------------------  -----------------------------------------------------------------------------------------
ServiceHealth.Read.All                                   55896846-df78-47a7-aa94-8d3d4442ca7f  Read service health
ServiceMessage.Read.All                                  eda39fa6-f8cf-4c3c-a909-432c683e4c9b  Read service messages
TermStore.ReadWrite.All                                  6c37c71d-f50f-4bff-8fd3-8a41da390140  Read and write term store data
TermStore.Read.All                                       297f747b-0005-475b-8fef-c890f5152b38  Read term store data
TeamMember.ReadWriteNonOwnerRole.All                     2104a4db-3a2f-4ea0-9dba-143d457dc666  Add and remove members with non-owner role for all teams
Team.Create                                              7825d5d6-6049-4ce7-bdf6-3b8d53f4bcd0  Create teams
TeamsAppInstallation.ReadWriteForUser                    093f8818-d05f-49b8-95bc-9d2a73e9a43c  Manage your installed Teams apps
TeamsAppInstallation.ReadWriteSelfForUser                207e0cb1-3ce7-4922-b991-5a760c346ebc  Allow the Teams app to manage itself for you
...

1. 运行以下命令获取特定服务主体的完整信息，包括其 oauth2Permissions 和 servicePrincipalNames 等。

az ad sp show --id 00000003-0000-0000-c000-000000000000 >microsoft_graph_permission_list.json

# microsoft_graph_permission_list.json
{
  ...
  "appDisplayName": "Microsoft Graph",
  "appId": "00000003-0000-0000-c000-000000000000",
  "objectId": "b19d498e-6687-4156-869a-2e8a95a9d659",
  "servicePrincipalNames": [
    "https://dod-graph.microsoft.us",
    "https://graph.microsoft.com/",
    "https://graph.microsoft.us",
    "00000003-0000-0000-c000-000000000000/ags.windows.net",
    "00000003-0000-0000-c000-000000000000",
    "https://canary.graph.microsoft.com",
    "https://graph.microsoft.com",
    "https://ags.windows.net"
  ],
  "appRoles": [...],
  "oauth2Permissions": [
    {
      "adminConsentDescription": "Allows the app to read and write the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user.",
      "adminConsentDisplayName": "Read and write all users' full profiles",
      "id": "204e0828-b5ca-4ad8-b9f3-f32a958e7cc4",
      "isEnabled": true,
      "type": "Admin",
      "userConsentDescription": "Allows the app to read and write the full set of profile properties, reports, and managers of other users in your organization, on your behalf.",
      "userConsentDisplayName": "Read and write all users' full profiles",
      "value": "User.ReadWrite.All"
    },
    {
      "adminConsentDescription": "Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user.",
      "adminConsentDisplayName": "Read all users' full profiles",
      "id": "a154be20-db9c-4678-8ab7-66f6cc099a59",
      "isEnabled": true,
      "type": "Admin",
      "userConsentDescription": "Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on your behalf.",
      "userConsentDisplayName": "Read all users' full profiles",
      "value": "User.Read.All"
    },
    ...
  ]
  ...
}

Answer 2

关于这个话题没什么好说的。

首先，需要注意的是，所有OAuth2Permission Scopes 都注册在开发者租户的主应用程序对象上。因此，一般而言，您将无权访问该信息，因为它位于您不是用户的租户中。因此，作为外部开发人员，这些权限范围无法通过我们的 API 发现。

其次，您可以看到 Azure 门户有权访问此信息，因为它具有查询所有租户中所有资源的 OAuth2Permissions 的提升访问权限。这就是我们的 UX 能够为您要在租户中使用的所有各种外部和内部资源填充所有权限的方式。门户将首先检查您的租户中有哪些服务主体（一旦您同意使用应用程序，服务主体最常被预配），然后它将查找与该服务主体对应的应用程序对象，并查找所有权限范围。这种行为有望让您只看到与您相关的资源应用程序，而不是用所有可能的资源填充您的屏幕。

最后，我们希望从必须静态注册客户端调用资源应用程序所需的权限中后退一步。相反，我们将推送一个新的Incremental and Dynamic Consent framework。您会注意到，在这里我们依赖于范围名称，而不是像过去那样依赖这些权限的 ObjectID GUID。但是，我总体上同意您的观点，即资源暴露范围的可发现性在很大程度上取决于它们自己的公共文档。我想将来可能会有一个端点公开特定资源上可用的所有范围，但我知道在不久的将来没有这样的工作可以做到这一点。

如果这有帮助，请告诉我！