使用Terraform为企业应用添加Graph API委派权限的问题

背景代码 #

应用创建代码 #

resource "azuread_application" "enterprise_app_oidc" {
  display_name = var.ent_app_display_name
  owners = distinct(var.ad_group_owners)

  required_resource_access {
    resource_app_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph

    resource_access {
      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["openid"]
      type = "Scope"
    }

    resource_access {
      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["User.Read"]
      type = "Scope"
    }
  }
}

服务主体代码 #

resource "azuread_service_principal" "enterprise_app_sp_oidc" {
  client_id                     = azuread_application.enterprise_app_oidc.client_id
  owners                        = azuread_group.ad_group_oidc[0].owners
  preferred_single_sign_on_mode = "oidc"
  app_role_assignment_required  = true

  feature_tags {
    enterprise = true
  }
}

后续添加Graph API权限代码 #

data "azuread_application_published_app_ids" "well_known" {}

output "data_from_well_known" {
  value = data.azuread_application_published_app_ids.well_known.result
}

resource "azuread_service_principal" "msgraph" {
  client_id    = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph
  use_existing = true
}

resource "azuread_service_principal_delegated_permission_grant" "example" {
  service_principal_object_id          = azuread_service_principal.enterprise_app_sp_oidc.object_id
  resource_service_principal_object_id = azuread_service_principal.msgraph.object_id
  claim_values                         = ["openid", "User.Read.All"]
}

问题 #

1. 为何会出现红色圈注的「其他权限」，如何移除该分类？
2. 如何在蓝色圈注的「委派权限」区域添加email、profile、offline_access等权限？

解答 #

问题1：「其他权限」的成因与移除方法 #

「其他权限」出现的核心原因是你使用azuread_service_principal_delegated_permission_grant资源直接给服务主体授予权限，这种方式属于无关联应用注册的直接权限授予，不会被归类到应用注册声明的权限范围内，因此会单独显示为「其他权限」。

移除该分类的操作步骤：

1. 删除azuread_service_principal_delegated_permission_grant资源，停止直接授予权限的方式。
2. 将需要的权限（比如User.Read.All）迁移到azuread_application资源的required_resource_access块中，让权限与应用注册的声明绑定，这样权限就会显示在「委派权限」区域。

修改后的应用创建代码示例：

resource "azuread_application" "enterprise_app_oidc" {
  display_name = var.ent_app_display_name
  owners = distinct(var.ad_group_owners)

  required_resource_access {
    resource_app_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph

    resource_access {
      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["openid"]
      type = "Scope"
    }

    resource_access {
      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["User.Read"]
      type = "Scope"
    }

    resource_access {
      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["User.Read.All"]
      type = "Scope"
    }
  }
}

部署后完成管理员权限同意（可手动在Azure门户操作，或使用azuread_application_delegated_permission_grant资源实现自动化同意）即可生效。

问题2：添加email、profile、offline_access到「委派权限」 #

要将这些权限纳入「委派权限」区域，只需在azuread_application的required_resource_access块中添加对应的resource_access条目，通过Microsoft Graph服务主体的oauth2_permission_scope_ids获取对应权限的ID即可。

修改后的完整应用创建代码示例：

resource "azuread_application" "enterprise_app_oidc" {
  display_name = var.ent_app_display_name
  owners = distinct(var.ad_group_owners)

  required_resource_access {
    resource_app_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph

    resource_access {
      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["openid"]
      type = "Scope"
    }

    resource_access {
      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["User.Read"]
      type = "Scope"
    }

    resource_access {
      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["User.Read.All"]
      type = "Scope"
    }

    resource_access {
      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["email"]
      type = "Scope"
    }

    resource_access {
      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["profile"]
      type = "Scope"
    }

    resource_access {
      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["offline_access"]
      type = "Scope"
    }
  }
}

部署后这些权限会自动出现在「委派权限」区域，完成管理员同意后即可正常使用。

内容的提问来源于stack exchange，提问作者New Programmer