azure - Microsoft Graph API 在授予权限时出现未经授权的错误

Question

我正在尝试在后台功能中获取有关我的用户的信息。

我使用以下代码生成访问令牌，然后获取特定用户的信息：

  const endpoint = 'https://login.microsoftonline.com/<my-tenant-id>/oauth2/token'
  let clientId = 'my-client-id'
  let clientSecret = 'my-client-secret'
  let resource = 'https://graph.windows.net'

  try {
    const { data } = await axios({
      url: endpoint,
      method: 'post',
      data: `client_id=${clientId}&client_secret=${clientSecret}&grant_type=client_credentials&resource=${resource}&scope=https://graph.microsoft.com/.default`,
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
      },
    })

    let accessToken = data.access_token

    const { adUserInfo } = await axios({
      url: 'https://graph.microsoft.com/v1.0/users/12345-67890-123456-123456-123456',
      method: 'get',
      headers: {
        Authorization: `Bearer ${accessToken}`,
      },
    })

执行此代码时，我收到响应：

Error: Request failed with status code 401
    at createError (D:\Websites\site\backend\node_modules\axios\lib\core\createError.js:16:15)
    at settle (D:\Websites\site\backend\node_modules\axios\lib\core\settle.js:17:12)
    at IncomingMessage.handleStreamEnd (D:\Websites\site\backend\node_modules\axios\lib\adapters\http.js:260:11)
    at IncomingMessage.emit (events.js:327:22)
    at IncomingMessage.EventEmitter.emit (domain.js:485:12)
    at endReadableNT (_stream_readable.js:1223:12)
    at processTicksAndRejections (internal/process/task_queues.js:84:21) {
  config: {
    url: 'https://graph.microsoft.com/v1.0/users/<user-id>',
    method: 'get',
    headers: {
      Accept: 'application/json, text/plain, */*',
      Authorization: 'Bearer eyJ0eXAiOiJKV1QiLCJhbG...nVlANvJE16DRfr57A',
      'User-Agent': 'axios/0.21.1'
    },
    transformRequest: [ [Function: transformRequest] ],
    transformResponse: [ [Function: transformResponse] ],
    timeout: 0,
    adapter: [Function: httpAdapter],
    xsrfCookieName: 'XSRF-TOKEN',
    xsrfHeaderName: 'X-XSRF-TOKEN',
    maxContentLength: -1,
    maxBodyLength: -1,
    validateStatus: [Function: validateStatus],
    data: undefined
  },
  ...

这些是应用程序所有者授予我的权限：

我的想法是 User.Read 或 User.Read.All 应该足以调用 /users/ API 方法吗？

更新：我尝试使用 Postman 进行请求并得到以下结果，我不知道它是否相关：

{
    "error": {
        "code": "InvalidAuthenticationToken",
        "message": "Access token validation failure. Invalid audience.",
        "innerError": {
            "date": "2021-10-08T09:36:04",
            "request-id": "the-request-id",
            "client-request-id": "the-client-request-id"
        }
    }
}

标签： azureazure-active-directorymicrosoft-graph-api