无法通过Graph API获取会议转录内容的技术求助

我们尝试调用Graph API获取会议转录内容，按官方文档操作后遇到权限禁止错误，具体信息如下：

有用信息 #

MicrosoftAppType=MultiTenant
MicrosoftAppId=2dacff5b-9494-45b4-90f1-df6953d401aa
MicrosoftAppTenantId=91e213e9-498d-46b9-bc35-cd0aa9390b45
SubscriptionId=1106df7f-3a2b-4b98-80ff-7ab8738177d
MeetingID=MSpiYTc2OWFjOC0wOTc1LTRiOTctYTlmOS03NWFlYzZiNjEwMDQqMCoqMTk6bWVldGluZ19OV1ZsTmpoaU9Ua3RNV000WWkwME1HSmhMV0ZoT1RZdE0yUmlObVk0WmpnMk9HUTVAdGhyZWFkLnYy
TranscriptID=VjIjIzFiYTc2OWFjOC0wOTc1LTRiOTctYTlmOS03NWFlYzZiNjEwMDQ5MWUyMTNlOS00OThkLTQ2YjktYmMzNS1jZDBhYTkzOTBiNDUwNDAwMDAwMDgyMDBFMDAwNzRDNUI3MTAxQTgyRTAwODAwMDAwMDAwNDQ4MzI0ZjY2ZGQyZGEwMTAwMDAwMDAwMDAwMDAwMDAxMDAwMDAwMGEzMWUzOWY1MDhhZWM5NGVhZWM2ZDlkYzEwMjIzNWQ3IyMwZjM1MWUxNy1mMjRjLTRiZmUtYTM4NC0zZDdmN2ZmODliMzE=

应用配置与GraphClient创建 #

已在应用清单中添加所需RSC权限，使用应用凭据创建GraphClient：

// @azure/identity
const credential = new ClientSecretCredential(
  process.env.MicrosoftAppTenantId,
  process.env.MicrosoftAppId,
  process.env.MicrosoftAppPassword
);

// @microsoft/microsoft-graph-client/authProviders/azureTokenCredentials
const authProvider = new TokenCredentialAuthenticationProvider(credential, { 
  scopes: ['https://graph.microsoft.com/.default']
});

const graphClient = Client.initWithMiddleware({ authProvider: authProvider });

订阅创建与事件接收 #

成功创建转录内容订阅：

const transcriptSubscription = {
  changeType: 'created',
  notificationUrl: 'https://6ebd-2405-201-1021-7808-298c-d664-4dae-fff3.ngrok-free.app/notificationClient',
  lifecycleNotificationUrl: 'https://6ebd-2405-201-1021-7808-298c-d664-4dae-fff3.ngrok-free.app/api/lifecycleNotifications',
  resource: 'communications/onlineMeetings/getAllTranscripts?useResourceSpecificConsentBasedAuthorization=true',
  includeResourceData: true,
  encryptionCertificate: '{valid certificate}',
  encryptionCertificateId:'{validId}',
  expirationDateTime: '2024-07-11T11:00:00.0000000Z',
  clientState: '{secretClientState}'
};

await graphClient.api('/subscriptions')        
     .post(transcriptSubscription).then((res) => 
     {
       console.log('Subscription:', res);
     }).catch((err) => {
       console.log('Error:', err);
     });

订阅创建成功返回：

res: {
  '@odata.context': 'https://graph.microsoft.com/v1.0/$metadata#subscriptions/$entity',
  id: '1106df7f-3a2b-4b98-80ff-7ab8738177d9',
  resource: 'communications/onlineMeetings/getAllTranscripts?useResourceSpecificConsentBasedAuthorization=true',
  applicationId: '2dacff5b-9494-45b4-90f1-df6953d401aa',
  changeType: 'created',
  clientState: '{secretClientState}',
  notificationUrl: 'https://6ebd-2405-201-1021-7808-298c-d664-4dae-fff3.ngrok-free.app/notificationClient',
  notificationQueryOptions: null,
  lifecycleNotificationUrl: 'https://6ebd-2405-201-1021-7808-298c-d664-4dae-fff3.ngrok-free.app/api/lifecycleNotifications',
  expirationDateTime: '2024-07-11T11:00:00Z',
  creatorId: 'b3d2c52d-3d02-43bf-bd27-6408d62af8a1',
  includeResourceData: true,
  latestSupportedTlsVersion: 'v1_2'
  // 其他数据
}

成功接收到转录创建事件通知：

subscriptionId: '1106df7f-3a2b-4b98-80ff-7ab8738177d9',
changeType: 'created',
clientState: '{secretClientState}',
subscriptionExpirationDateTime: '2024-07-11T11:00:00+00:00',
resource: "communications/onlineMeetings('MSpiYTc2OWFjOC0wOTc1LTRiOTctYTlmOS03NWFlYzZiNjEwMDQqMCoqMTk6bWVldGluZ19OV1ZsTmpoaU9Ua3RNV000WWkwME1HSmhMV0ZoT1RZdE0yUmlObVk0WmpnMk9HUTVAdGhyZWFkLnYy')/transcripts('VjIjIzFiYTc2OWFjOC0wOTc1LTRiOTctYTlmOS03NWFlYzZiNjEwMDQ5MWUyMTNlOS00OThkLTQ2YjktYmMzNS1jZDBhYTkzOTBiNDUwNDAwMDAwMDgyMDBFMDAwNzRDNUI3MTAxQTgyRTAwODAwMDAwMDAwNDQ4MzI0ZjY2ZGQyZGEwMTAwMDAwMDAwMDAwMDAwMDAxMDAwMDAwMGEzMWUzOWY1MDhhZWM5NGVhZWM2ZDlkYzEwMjIzNWQ3IyMwZjM1MWUxNy1mMjRjLTRiZmUtYTM4NC0zZDdmN2ZmODliMzE=')"
// 其他数据

API调用错误 #

调用获取转录内容的API时：

await graphClient
.api(`users/${ process.env.MicrosoftAppId }/onlineMeetings/${ meetingId }/transcripts/${ transcriptId }`)
.get()
.then((dataFromResponse) => {
  console.log('### dataFromResponse:', dataFromResponse);
})
.catch((error) => {
  console.log('### error:', error);
});

收到禁止错误：

body: {
  "code":"Forbidden",
  "message":"Application is not allowed to perform operations on the user '2dacff5b-9494-45b4-90f1-df6953d401aa', neither is allowed access through RSC permission evaluation.",
  "innerError":{
    "date":"2024-07-10T02:45:09",
    "request-id":"81fbbe48-d368-41d0-b5ab-f1a3e59f237a",
    "client-request-id":"34e6cbfd-a622-0969-e57e-cc9c3c4e04c0"
  }
}

注：应用是会议参与者，已尝试beta版本，结果一致。

解决方案 #

1. 修正API路径
   你错误地将MicrosoftAppId作为用户ID传入users/{id}节点，应用权限模式下无需通过用户路径访问会议转录，应直接使用以下API路径：

   await graphClient
   .api(`communications/onlineMeetings/${ meetingId }/transcripts/${ transcriptId }`)
   .get()
   

   这个路径与你订阅事件中返回的resource字段格式一致，是应用权限下的正确调用方式。

2. 确认RSC权限配置

   • 确保应用已添加OnlineMeetings.Read.All（应用类型）的RSC权限，且该权限已在会议所在租户的Teams管理员中心完成授予。多租户应用需要目标租户明确授予RSC权限才能访问其会议资源。
   • 检查应用清单中是否正确声明了RSC权限，权限格式应为：

     "resourceSpecificApplicationPermissions": [
       {
         "permission": "OnlineMeetings.Read.All",
         "type": "Application"
       }
     ]
     

3. 验证应用访问权限
   确认会议组织者所在租户已允许你的多租户应用访问会议转录内容，可通过Teams管理员中心的"Manage apps"功能检查应用的权限状态。

内容的提问来源于stack exchange，提问作者shweta chikhalikar