如何使用 Microsoft Graph api 为天蓝色广告中的用户分配角色
How to use microsoft graph api for assigning role to the user in azure ad
我在 app registration manifest
中创建了以下角色:
"appRoles": [
{
"allowedMemberTypes": [
"User"
],
"displayName": "Student",
"id": "d1c2ade8-98f8-45fd-aa4a-6d06b947c66f",
"isEnabled": true,
"description": "Student",
"value": "Student"
}
],
现在我正在使用 appRoleAssignment
api 为用户分配角色。我正在关注这个 documentation。在此页面中,它表示我们需要在 api 下方使用 json 正文:
POST https://graph.microsoft.com/v1.0/servicePrincipals/{id}/appRoleAssignments
Content-Type: application/json
Content-Length: 110
{
"principalId": "principalId-value",
"resourceId": "resourceId-value",
"appRoleId": "appRoleId-value"
}
我无法理解我应该在 principalId
、resourceId
和 appRoleId
中使用什么。根据该页面,它说:
principalId: The id of the client service principal to which you are assigning the app role.
resourceId: The id of the resource servicePrincipal (the API) which has defined the app role (the application permission).
appRoleId: The id of the appRole (defined on the resource service principal) to assign to the client service principal.
但我能理解的是principalId is the ID of the user I have in the active directory for which I want to assign the role.
在我的例子中是下图中的 ObjectId:
这是正确的吗?
resourceId
是租户 ID,appRoleId
是我在上面创建应用程序角色时使用的 ID,即 d1c2ade8-98f8-45fd-aa4a-6d06b947c66f
如果我在 python
中提出请求,则将它们放在一起
token = get_token()
headers = {'Authorization': 'Bearer ' + token, 'Content-Type': 'application/json'}
user_data = {
"principalId": "1bc79085-12qw-4fad-8da8-647f4b4b2927",
"resourceId": "c01b6482-3ccd-4533-8c98-a7c5e8067cc8",
"appRoleId": "d1c2ade8-98f8-45fd-aa4a-6d06b947c66f"
}
j_data = json.dumps(user_data)
conn = http.client.HTTPSConnection('graph.microsoft.com')
conn.request("POST", "/v1.0/servicePrincipals/1bc79085-12qw-4fad-8da8-647f4b4b2927/appRoleAssignments", j_data, headers)
response = conn.getresponse()
rdata = response.read()
我收到以下回复:
{
"error": {
"code": "Request_ResourceNotFound",
"message": "Resource '1bc79085-12qw-4fad-8da8-647f4b4b2927' does not exist or one of its queried reference-property objects are not present.",
"innerError": {
"date": "2020-10-26T05:16:35",
"request-id": "1c87a140-7bc9-499d-82dd-bc1dcb54e075",
"client-request-id": "1c87a140-7bc9-499d-82dd-bc1dcb54e075"
}
}
}
谁能帮我调试一下。请帮忙。谢谢
编辑:
错误:
{
"error": {
"code": "Request_ResourceNotFound",
"message": "Resource '261eda4b-6eee-45ba-a176-259960603409' does not exist or one of its queried reference-property objects are not present.",
"innerError": {
"date": "2020-10-26T07:09:38",
"request-id": "8dc2ea73-63e5-45b5-8127-445df777c1e1",
"client-request-id": "8dc2ea73-63e5-45b5-8127-445df777c1e1"
}
}
}
Json:
{
"principalId": "f923e078-ca9d-4611-a80e-bebb712ad7d1",
"resourceId": "261eda4b-6eee-45ba-a176-259960603409",
"appRoleId": "d1c2ade8-98f8-45fd-aa4a-6d06b947c66f"
}
GET Url 获取对象id: https://graph.microsoft.com/v1.0/serviceprincipals?$select=id&$filter=displayName eq '{useracces}'
POST https://graph.microsoft.com/v1.0/servicePrincipals/{id}/appRoleAssignedTo
Content-Type: application/json
Content-Length: 110
{
"principalId": "principalId-value",
"resourceId": "resourceId-value",
"appRoleId": "appRoleId-value"
}
在此示例中,{id}
和 {resourceId-value}
都是资源服务主体的对象 ID,它是与您在其中创建 appRoles 的 Azure AD 应用关联的企业应用。
而 {principalId-value}
将是用户的对象 ID。
{appRoleId-value}
是你在manifest中创建的app角色的id。
更新:
获取服务主体对象id的步骤是正确的。
如果你想用GraphAPI得到它,你可以这样做:
GET https://graph.microsoft.com/v1.0/serviceprincipals?$select=id&$filter=displayName eq '{app name}'
我在 app registration manifest
中创建了以下角色:
"appRoles": [
{
"allowedMemberTypes": [
"User"
],
"displayName": "Student",
"id": "d1c2ade8-98f8-45fd-aa4a-6d06b947c66f",
"isEnabled": true,
"description": "Student",
"value": "Student"
}
],
现在我正在使用 appRoleAssignment
api 为用户分配角色。我正在关注这个 documentation。在此页面中,它表示我们需要在 api 下方使用 json 正文:
POST https://graph.microsoft.com/v1.0/servicePrincipals/{id}/appRoleAssignments
Content-Type: application/json
Content-Length: 110
{
"principalId": "principalId-value",
"resourceId": "resourceId-value",
"appRoleId": "appRoleId-value"
}
我无法理解我应该在 principalId
、resourceId
和 appRoleId
中使用什么。根据该页面,它说:
principalId: The id of the client service principal to which you are assigning the app role.
resourceId: The id of the resource servicePrincipal (the API) which has defined the app role (the application permission).
appRoleId: The id of the appRole (defined on the resource service principal) to assign to the client service principal.
但我能理解的是principalId is the ID of the user I have in the active directory for which I want to assign the role.
在我的例子中是下图中的 ObjectId:
这是正确的吗?
resourceId
是租户 ID,appRoleId
是我在上面创建应用程序角色时使用的 ID,即 d1c2ade8-98f8-45fd-aa4a-6d06b947c66f
如果我在 python
中提出请求,则将它们放在一起token = get_token()
headers = {'Authorization': 'Bearer ' + token, 'Content-Type': 'application/json'}
user_data = {
"principalId": "1bc79085-12qw-4fad-8da8-647f4b4b2927",
"resourceId": "c01b6482-3ccd-4533-8c98-a7c5e8067cc8",
"appRoleId": "d1c2ade8-98f8-45fd-aa4a-6d06b947c66f"
}
j_data = json.dumps(user_data)
conn = http.client.HTTPSConnection('graph.microsoft.com')
conn.request("POST", "/v1.0/servicePrincipals/1bc79085-12qw-4fad-8da8-647f4b4b2927/appRoleAssignments", j_data, headers)
response = conn.getresponse()
rdata = response.read()
我收到以下回复:
{
"error": {
"code": "Request_ResourceNotFound",
"message": "Resource '1bc79085-12qw-4fad-8da8-647f4b4b2927' does not exist or one of its queried reference-property objects are not present.",
"innerError": {
"date": "2020-10-26T05:16:35",
"request-id": "1c87a140-7bc9-499d-82dd-bc1dcb54e075",
"client-request-id": "1c87a140-7bc9-499d-82dd-bc1dcb54e075"
}
}
}
谁能帮我调试一下。请帮忙。谢谢
编辑:
错误:
{
"error": {
"code": "Request_ResourceNotFound",
"message": "Resource '261eda4b-6eee-45ba-a176-259960603409' does not exist or one of its queried reference-property objects are not present.",
"innerError": {
"date": "2020-10-26T07:09:38",
"request-id": "8dc2ea73-63e5-45b5-8127-445df777c1e1",
"client-request-id": "8dc2ea73-63e5-45b5-8127-445df777c1e1"
}
}
}
Json:
{
"principalId": "f923e078-ca9d-4611-a80e-bebb712ad7d1",
"resourceId": "261eda4b-6eee-45ba-a176-259960603409",
"appRoleId": "d1c2ade8-98f8-45fd-aa4a-6d06b947c66f"
}
GET Url 获取对象id: https://graph.microsoft.com/v1.0/serviceprincipals?$select=id&$filter=displayName eq '{useracces}'
POST https://graph.microsoft.com/v1.0/servicePrincipals/{id}/appRoleAssignedTo
Content-Type: application/json
Content-Length: 110
{
"principalId": "principalId-value",
"resourceId": "resourceId-value",
"appRoleId": "appRoleId-value"
}
在此示例中,{id}
和 {resourceId-value}
都是资源服务主体的对象 ID,它是与您在其中创建 appRoles 的 Azure AD 应用关联的企业应用。
而 {principalId-value}
将是用户的对象 ID。
{appRoleId-value}
是你在manifest中创建的app角色的id。
更新:
获取服务主体对象id的步骤是正确的。
如果你想用GraphAPI得到它,你可以这样做:
GET https://graph.microsoft.com/v1.0/serviceprincipals?$select=id&$filter=displayName eq '{app name}'