Access Outlook shared calendars using MS Graph sdk?-CodePudding

I'm trying to access the calendars that have been shared with a user using MS Graph sdk. I have a web app and the necessary permissions like Calendars.Read given. Using postman I manage to read the calendar events of a user using

https://login.microsoftonline.com/{app_id}/oauth2/v2.0/authorize

for authorization and then

https://graph.microsoft.com/v1.0/users/{user}/calendar/events

for reading calendar events. Everything works fine in postman, but I'm having issues to do the same thing using MSGraph framework. I tried using this example MS Example in order to replicate the postman calls in C# but I receive an error saying that

'Code: BadRequest /me request is only valid with delegated authentication flow'

when I used await graphClient.Me.Calendars.Request().GetAsync()

and

Access is denied. Check credentials and try again

when I used await graphClient.Users["[email protected]"].Calendars.Request().GetAsync()

From what I have read the first error with delegated authentication flow appears because I'm using application permissions model and I should be using delegated permissions in this context. The issue is that I don't know how to use ms graph library for delegated permissions model. The only examples that I found involves calling API directly, but I need to use the MS Graph library.

CodePudding user response：

There're 2 kinds of api permissions like you know, delegate/application api permission. For delegate permission, it requires users to use their account sign in first to obtain access token and allow users to query their own Calendar information, in this scenario /me/calendar is equal to /users/signed_in_user_id/calendar.

For application api permission, it allows the daemon application to query everyone's Calendar information. It only supports /users/user_id/calendar because no users sign in your app and your app doesn't who's "me".

The Ms example you shared in the question used client credential flow and require to give application permission. If you want to have a feature to query all users' informaton, you should continue to use it. And the code sample should look like this:

using Microsoft.Graph;
using Azure.Identity;

var scopes = new[] { "https://graph.microsoft.com/.default" };
var tenantId = "tenant_name.onmicrosoft.com";
var clientId = "aad_app_id";
var clientSecret = "client_secret";
var clientSecretCredential = new ClientSecretCredential(
                tenantId, clientId, clientSecret);
var graphClient = new GraphServiceClient(clientSecretCredential, scopes);
var res = await graphClient.Users["[email protected]"].Calendars.Request().GetAsync();

If you want to have a feature that allowing users to sign in first and they can query their own Calendar events, then you need to integrate OIDC first to integrate AAD for authentication, then you can use await graphClient.Me.Calendars.Request().GetAsync(). More details can be seen in this sample.