调用Graph API向Teams聊天发消息遇Precondition Failed错误（C#）

错误信息 #

Microsoft.Graph.ServiceException: "Code: PreconditionFailed
Message: Requested API is not supported in application-only context
Inner error:
AdditionalData:
date: 2022-10-20T12:07:44
request-id: 88e01bd9-370c-4739-b0bd-0244892475e2
client-request-id: 88e01bd9-370c-4739-b0bd-0244892475e2
ClientRequestId: 88e01bd9-370c-4739-b0bd-0244892475e2
"

已配置权限 #

委派权限 #

• Chat.ReadBasic
• Chat.Read
• Chat.ReadWrite
• Chat.Create
• ChatMember.Read
• ChatMember.ReadWrite
• ChatMessage.Send
• Chat.ReadWrite
• Channel.Delete.All
• Group.ReadWrite.All
• Directory.ReadWrite.All

应用权限 #

• ChatMember.Read.All
• ChatMember.ReadWrite.All
• Chat.ReadBasic.All
• Chat.Read.All
• Chat.Create
• Chat.ReadWrite.All
• Channel.Delete.Group
• Channel.Delete.All
• Group.ReadWrite.All
• Directory.ReadWrite.All

使用代码 #

/* ------------------------------------------------------------- */
/// <summary>
/// 
/// </summary>
/// <param name="userId"></param>
/// <param name="chatID"></param>
/// <param name="messageText"></param>
/// <param name="scopes"></param>
/// <returns></returns>
public ChatMessage SendMessageToChat(string userId, string chatID, string messageText, string[] scopes = null)
{
  return SendMessageToChatAsync(userId, chatID, messageText, scopes).GetAwaiter().GetResult();
}

/* ------------------------------------------------------------- */

private async Task<ChatMessage> SendMessageToChatAsync(string userId, string chatID, string messageText, string[] scopes = null)
{
  GraphServiceClient graphClient = this.GetAuthenticatedGraphClient(scopes);

  var chatMessage = new ChatMessage
  {
    Body = new ItemBody
    {
      Content = messageText
    }
  };

  return await graphClient.Users[userId].Chats[chatID].Messages
    .Request()
    .AddAsync(chatMessage);

}

解决思路 #

1. 错误根源：当前使用的是应用-only上下文（客户端凭据认证流，基于应用权限），但代码中调用的/users/{userId}/chats/{chatId}/messages端点不支持应用权限模式，仅支持委派权限。

2. 方案一：改用委派权限认证

   • 确保GetAuthenticatedGraphClient使用委派权限的认证方式（如授权码流），而非应用权限的客户端凭据流。
   • 确认已授予ChatMessage.Send委派权限并完成用户授权流程。

3. 方案二：调整API端点并补充应用权限

   • 若要继续使用应用权限，修改API调用路径为/chats/{chatId}/messages，代码调整如下：

     return await graphClient.Chats[chatID].Messages
       .Request()
       .AddAsync(chatMessage);
     

   • 在Azure AD中为应用添加ChatMessage.Send.All应用权限，并获取管理员同意。

内容的提问来源于stack exchange，提问作者Th3TV