Adding application permission to an client application using MS Graph SDK - Java

user_14279707 0
Viewed 174

I have registered an application with name "API" and for this application I added two App Role in Manifest

"appRoles": [
        {
            "allowedMemberTypes": [
                "Application"
            ],
            "description": "Demo Role for application.",
            "displayName": "Demo Role",
            "id": "42ee481e-b4bc-4afa-9499-586bc2a079be",
            "isEnabled": true,
            "lang": null,
            "origin": "Application",
            "value": "demo.role"
        },
        {
            "allowedMemberTypes": [
                "Application"
            ],
            "description": "Test Role for application.",
            "displayName": "Test Role",
            "id": "42ee481e-b4bc-4afa-9499-586bc2a079bd",
            "isEnabled": true,
            "lang": null,
            "origin": "Application",
            "value": "test.role"
        }
    ]

Now I have registered another app called "Client Application" and I want to assign this application above two app roles which I defined in application "API"

From searching the docs I found that we assigning permissions is done to the application service principal, not the Application object.

https://docs.microsoft.com/en-us/graph/api/serviceprincipal-post-approleassignedto?view=graph-rest-1.0&tabs=java

Here is the sample code that I found in the documents...

AppRoleAssignment appRoleAssignment = new AppRoleAssignment();
appRoleAssignment.principalId = UUID.fromString("33ad69f9-da99-4bed-acd0-3f24235cb296");
appRoleAssignment.resourceId = UUID.fromString("9028d19c-26a9-4809-8e3f-20ff73e2d75e");
appRoleAssignment.appRoleId = UUID.fromString("ef7437e6-4f94-4a0a-a110-a439eb2aa8f7");

graphClient.servicePrincipals("9028d19c-26a9-4809-8e3f-20ff73e2d75e").appRoleAssignedTo()
    .buildRequest()
    .post(appRoleAssignment);

principalId: The id of the user, group or client servicePrincipal to which you are assigning the app role. -- Where can I find principalId? Is this the objectId of the "Client Application"?

resourceId: The id of the resource servicePrincipal which has defined the app role. Where can I find resourceId? -- Is this the object ID of "API" Application which has app roles defined?

appRoleId: The id of the appRole (defined on the resource service principal) to assign to a user, group, or service principal. -- I found the app role id - the guid mentioned in app role in manifest of "API" application.

Please assist.

azure-ad-b2c microsoft-graph-api azure-active-directory
2 Answers

Principal id is the ObjectId but not the actual one which you see in portal but it is the object Id of the service principal and similarly resource Id is objectId of serviceprincipal of resource app.

See the difference from below provided info:

Portal:resourceApp:

App id:51100c0f-xxxx-xxxx-xxxx-xxxxxxxa59, ObjectId:2275ec6c-xxxx-xxxx-xxxx-xxxxxx2b76e

From powershell commands:

$ResourceId= (Get-AzureAdServicePrincipal -Filter "displayName eq 'testapp'").ObjectId

#output :ResourceId: 36929cef-xxxx-xxxx-xxxx-xxxx989dac7

enter image description here

Portal:client app:

App id:329cd48e-xxxx-xxxx-xxxx-xxxxxxxx2b88, objectId:9d5e7540-xxxx-xxxx-xxxx-xxxxxxxxx9e1

$principalId=(Get-AzureAdServicePrincipal -Filter "displayName eq 'client app'").ObjectId

#Output : Principal id: 85a53d22-xxxx-xxxx-xxxx-xxxxx300b2

In an app role assignment, resourceId is the id of the servicePrincipal for the resource app ( API app in your case). To find the id of a service principal for which you know the appId through graph api for resource app and client app:see the below request

GET https://graph.microsoft.com/v1.0/servicePrincipals?$filter=appId eq '{app-id}'

(or)

GET https://graph.microsoft.com/v1.0/servicePrincipals/<App id>

Or

 GET https://graph.microsoft.com/beta/serviceprincipals?$filter=startswith(displayName, 'Application-Name')

The response will contain the id property of the servicePrincipal object, and you can use that when creating the app role assignment.

Reference: graph/api/serviceprincipal

user_159975090

When you create/register an application from portal UI, a service principal is created for you automatically however it is not the case when you create application using API calls.

When you register an application using API, you will have to explicitly create service principal for that application...

to create a service principal you need a graph client and object Id of the application you created (please note object Id and app client id is diff) - you can see your object Id from portal UI.

        Application application = graphClient.applications(objId)
                .buildRequest()
                .get();
        
        ServicePrincipal servicePrincipal = new ServicePrincipal();
        servicePrincipal.appId = application.appId;

        graphClient.servicePrincipals()
            .buildRequest()
            .post(servicePrincipal);

Now you have created a service principal for you application...next up is finding the ID which you can do like this...

        ServicePrincipalCollectionPage servicePrincipals = graphClient.servicePrincipals()
                .buildRequest()
                .get();
        
        List<ServicePrincipal> list = servicePrincipals.getCurrentPage();

Go through the list and choose your application based on display name, and you can find ID too.

ServicePrincipal.Id --> This is what you need...

and based on your need...

The principalId is the client app which you created - so you need servicePrincipal.Id of that application.

The resourceId is the app where you defined your approles - so you need servicePrincipal.Id of that application.

user_130811510
Related