|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/microsoft-graph-authorization-and-authentication/
课程评论：没有评论
课程名称：Microsoft Graph API 的 OAuth、电子邮件等 课程概述：本课程将介绍调用 Microsoft Graph 所需的基本认证和授权知识。为了成功调用 Microsoft Graph，您的应用程序必须从 Microsoft 身份平台获取访问令牌。该访问令牌包含有关应用程序及其访问 Microsoft Graph 可用资源和 API 的权限信息。要获取访问令牌，应用程序需要在 Microsoft 身份平台注册，并获得用户或管理员的授权。 课程内容包括： 1. **应用程序注册**：在 Azure 门户中注册应用程序，以便与 Microsoft 身份平台集成，包括获取应用程序 ID、重定向 URI 和客户端密钥等信息。 2. **Microsoft Graph 权限**：了解 Microsoft Graph 如何公开细粒度的权限控制应用程序对资源（如用户、组和邮件）的访问。开发人员需决定请求哪些权限，并在用户登录时获得用户或管理员的同意。 3. **委托权限与应用程序权限**：学习两种权限类型： - **委托权限**：用于具有已登录用户的应用程序，由用户或管理员同意。这些应用程序可以以登录用户的身份进行 Microsoft Graph 调用。 - **应用程序权限**：用于未登录用户的应用程序，如后台服务或守护进程，仅可由管理员同意。 4. **有效权限**：有效权限是应用程序在请求 Microsoft Graph 时所拥有的权限，取决于授予应用程序的 Microsoft Graph 权限及当前登录用户或调用应用程序的特权。在组织内，用户或应用的角色和策略也会影响权限。 课程还探讨了在委托与仅应用程序权限场景下的有效权限差异，帮助学员理解如何管理和应用这些权限，以确保安全且有效地访问 Microsoft Graph。 本课程适合希望深入了解 Microsoft Graph API 的开发人员，尤其是涉及 OAuth 和权限管理的内容。
Authentication and authorization basics:To call Microsoft Graph, your app must acquire an access token from the Microsoft identity platform. The access token contains information about your app and the permissions it has to access the resources and APIs available through Microsoft Graph. To get an access token, your app must be registered with the Microsoft identity platform and be authorized by either a user or an administrator to access the Microsoft Graph resources it needs.Register your app with the Microsoft identity platformBefore your app can get a token from the Microsoft identity platform, it must be registered in the Azure portal. Registration integrates your app with the Microsoft identity platform and establishes the information that it uses to get tokens, including:Application ID: A unique identifier assigned by the Microsoft identity platform.Redirect URI/URL: One or more endpoints at which your app will receive responses from the Microsoft identity platform. (For native and mobile apps, the URI is assigned by the Microsoft identity platform.)Client secret: A password or a public/private key pair that your app uses to authenticate with the Microsoft identity platform. (Not needed for native or mobile apps.)Microsoft Graph permissionsMicrosoft Graph exposes granular permissions that control the access that apps have to resources, like users, groups, and mail. As a developer, you decide which Microsoft Graph permissions to request for your app. When a user signs in to your app they, or, in some cases, an administrator, are given a chance to consent to these permissions. If the user consents, your app is given access to the resources and APIs that it has requested. For apps that access resources and APIs without a signed-in user, permissions can be pre-consented to by an administrator when the app is installed.Delegated and application permissionsMicrosoft Graph has two types of permissions:Delegated permissions are used by apps that have a signed-in user present. For these apps, either the user or an administrator consents to the permissions that the app requests and the app can act as the signed-in user when making calls to Microsoft Graph. Some delegated permissions can be consented by non-administrative users, but some higher-privileged permissions require administrator consent.Application permissions are used by apps that run without a signed-in user present. For example, apps that run as background services or daemons. Application permissions can only be consented by an administrator.Effective permissionsEffective permissions are the permissions that your app has when making requests to Microsoft Graph. The effective permissions are determined by a combination of the Microsoft Graph permissions that you granted to the app and the privileges of the signed-in user or the calling app. Within organizations, the policy or membership in one or more roles determine the privileges of the signed-in user or an app. It's important to understand the difference between the delegated and application permissions your app has and its effective permissions when making calls to Microsoft Graph.Effective permissions in delegated versus application-only permission scenariosFor delegated permissions, the effective permissions of your app are the least-privileged intersection of the delegated permissions the app has been granted (by consent) and the privileges of the currently signed-in user. Your app can never have more privileges than the signed-in user.Suppose that your app has been granted the User.ReadWrite.All delegated permission and calls the Update user API. This permission nominally grants your app permission to read and update the profile of every user in an organization. However, because of effective permissions, the following restrictions apply to the privileges of the signed-in user:If the signed-in user is a global administrator, your app can update the profile of every user in the organization.If the signed-in user isn't in an administrator role, your app can update only the profile of the signed-in user. It won't update the profiles of other users in the organization because the signed-in user doesn't have those privileges.For application permissions, the effective permissions of your app are the full level of privileges implied by the permission. For example, an app that has the User.ReadWrite.All application permission can update the profile of every user in the organization.
