使用MSAL获取Graph API令牌调用SharePoint API遇AADSTS650053错误

问题详情 #

尝试读取SharePoint数据时，频繁触发以下错误：

AADSTS650053: The application 'Application' asked for scope 'AllSites.Read' that doesn't exist on the resource
读写操作均出现相同错误，且Graph API方案不适用于当前场景。

现有配置 #

权限范围（Scope） #

"User.Read",
        "Files.Read.All",
        "Files.Read",
        "Sites.Read.All", 
        "AllSites.Read",   
        "AllSites.Write",  
        "AllSites.Manage"  
    )

登录实现代码 #

private fun signIn() {
    val parameters = SignInParameters.builder()
        .withScopes(scopes)
        .withCallback(object : AuthenticationCallback {
            override fun onSuccess(authenticationResult: IAuthenticationResult) {
                mAccount = authenticationResult.account
                Log.d("MainActivity", "登录成功，访问令牌: ${authenticationResult.accessToken}")
                Log.d("MainActivity", "账户: ${authenticationResult.account.username}")

                // 登录成功后获取用户数据
            }

            override fun onError(exception: MsalException) {
                Log.e("MainActivity", "登录失败: ${exception.message}")
            }

            override fun onCancel() {
                Log.d("MainActivity", "登录已取消")
            }
        })
        .withActivity(this)
        .build()

    mSingleAccountApp?.signIn(parameters)
}

MSAL初始化代码 #

PublicClientApplication.createSingleAccountPublicClientApplication(
    this.applicationContext,
    R.raw.auth_config,
    object : IPublicClientApplication.ISingleAccountApplicationCreatedListener {
        override fun onCreated(application: ISingleAccountPublicClientApplication) {
            mSingleAccountApp = application
            loadAccount()
        }

        override fun onError(exception: MsalException) {
            Log.d("MainActivity", "MSAL初始化失败: ${exception.message}")
        }
    })

解决步骤 #

1. 清理无效权限范围
   AllSites.Read、AllSites.Write、AllSites.Manage属于旧版SharePoint REST API权限，当前认证资源不兼容这些范围。保留Sites.Read.All、Files.Read.All等有效范围即可。

2. 修正资源绑定
   若直接调用SharePoint REST API，需将权限范围绑定到目标SharePoint站点的资源ID，格式为https://<租户域名>.sharepoint.com/Sites.Read.All，而非通用Graph API范围。

3. 验证权限授予状态
   在Azure AD应用注册后台，确认已为应用分配所需的委派/应用权限，且管理员已完成权限同意（应用权限需此步骤）。

内容的提问来源于stack exchange，提问作者IEatGemstones