使用Python和Graph API为应用注册授予SharePoint权限遇请求错误

我正尝试用Python给应用注册授予SharePoint站点的写入权限，实现文件自动上传，但一直收到"invalid request"错误。已经排查了以下内容：

• 访问令牌使用了正确的scope：https://graph.microsoft.com/.default
• 生成令牌的应用注册已配置Sites.FullControl.All应用权限
• Site ID确认正确：myOrg.sharepoint.com,b63cg86c-ef1b-4ed0-b15a-46f668e76331,d891dc88-9c07-5hf6-a620-a85ca546t3a7
• 尝试过多种请求体和请求头组合，均无效

以下是我的代码：

# 获取Graph API访问令牌
def get_access_token_graph(Tenant_ID, Client_ID, Client_Secret):
    url = f"https://login.microsoftonline.com/{Tenant_ID}/oauth2/v2.0/token"
    data = {
        'grant_type': 'client_credentials',
        'client_id': Client_ID,
        'client_secret': Client_Secret,
        'scope': 'https://graph.microsoft.com/.default'
    }
    response = requests.post(url, data=data)
    response.raise_for_status()
    return response.json()['access_token']

# 获取站点ID
def get_site_id(Access_Token, site_url):
    print("get_site_id")
    # site_id_url = f"https://graph.microsoft.com/v1.0/sites/{site_url.replace('https://', '').replace('/', ':')}"
    site_id_url = f"https://graph.microsoft.com/v1.0/sites/{site_url}"

    headers = {
        'Authorization': f'Bearer {Access_Token}',
        'Content-Type': 'application/json' 
    }
    site_response = requests.get(site_id_url, headers=headers)

    if site_response.status_code == 200:
        site_id = site_response.json().get('id')
        print(f"Site ID obtained: {site_id}")
    else:
        print(f"Error fetching site ID: {site_response.status_code} - {site_response.text}")

    return site_id

# 为应用注册授予站点权限
def grant_permissions_2(access_token, site_id, app_id):
    url = f"https://graph.microsoft.com/v1.0/sites/{site_id}/permissions"
    headers = {
        'Authorization': f'Bearer {access_token}',
        'Content-Type': 'application/json'
        }
    payload = {
        "grantee": {
            "id": app_id,  # 应用注册的Object ID
            "type": "Application"
        },
        "roles": ["write"]  # 可分配的角色包括"owner", "write"等
        }

    response = requests.post(url, json=payload, headers=headers)

    print(f"Response from API: {response.json()}")

    if response.status_code == 200:
        print("Permissions granted successfully.")
    else:
        print(f"Error: {response.status_code} - {response.text}")

# 调用函数
TENANT_ID = '905041a7-a812-4634-ab43-30f9db212g14'
GRANTOR_CLIENT_ID = "27ef4773-433b-46dd-9859-795024293dbe"
GRANTOR_CLIENT_SECRET = "~a25T~8nbHcbBDauPsWh.eG2X95iHEJ4d3FgybdYc"
GRANTOR_OBJECT_ID = "6f8d2588-69ac-4a78-bd81-9bac9481e852"
SITE_URL = "myOrg.sharepoint.com:/sites/mySiteName"

Access_Token_graph = get_access_token_graph(TENANT_ID, GRANTOR_CLIENT_ID, GRANTOR_CLIENT_SECRET)
site_id = get_site_id(Access_Token_graph, SITE_URL)
grant_permissions_2(Access_Token_graph, site_id, GRANTOR_OBJECT_ID)

解决建议 #

1. 确认应用权限已获得管理员同意
   已配置的Sites.FullControl.All必须是应用权限而非委派权限，且需由全局管理员或SharePoint管理员完成同意操作，未同意的权限会直接导致请求失败。

2. 修正请求Payload的角色值
   Microsoft Graph中站点权限的角色值需使用预设的标准名称，write并非有效取值，对应写入权限的正确角色是contribute，修改payload：

   "roles": ["contribute"]
   

   其他可选有效角色包括read、fullcontrol。

3. 验证站点ID的可访问性
   在调用权限接口前，先通过GET https://graph.microsoft.com/v1.0/sites/{site_id}接口验证站点是否能正常访问，确保站点ID无误且令牌拥有访问权限。

4. 尝试使用Beta版本API端点
   部分权限管理功能在Beta版本中支持更完善，可替换接口地址测试：

   url = f"https://graph.microsoft.com/beta/sites/{site_id}/permissions"
   

5. 调试并查看完整错误详情
   打印完整的响应文本，Microsoft Graph通常会在detail字段给出具体错误原因，方便定位问题：

   print(f"Full error info: {response.text}")
   

内容的提问来源于stack exchange，提问作者wilson_smyth