Warm tip: This article is reproduced from serverfault.com, please click
microsoft-graph-api sharepoint sharepoint-online spfx

(spfx) Can the granted permissins extend beyond the permissions of the currently logged in user?

发布于 2020-12-21 12:56:44

I use the SharePoint Framework because I want to access Teams messages through the Graph API using the MSGraphClient.

I have two end goals:

  • Building a webpart with delegated permissions
  • Archive messages from a Teams channel using some kind of app permissions instead (?)

I know that the permission scopes have to be approved by an admin in the Sharepoint Admin center. However, I am a little confused regarding the actual scope of these permissions, bear in mind that I need to abide by the local data protection laws, so my app/webpart may not have access to just everything.

I would like to know whether the permissions granted to my MSGraphClient by the Sharepoint Admin can extend beyond the permissions of the currently logged in user. I cannot tell from the documentation in which cases the permissions are delegated and in which cases their are actual application permissions.

For example, if my MSGraphClient is granted the permission "ChannelMessage.Read.All", can the currently logged in user read "all" messages of all users, or only those messages that he actually has access to? Are all of the permissions granted through the Sharepoint Admin Center delegated? Appart from that, if I wanted to have access to messages regardless of the permissions of the currently logged in user, would I need to use an app token from Azure? If so, is it possible to restrict these permissions to only include reading privileges of specific Teams channels?

Questioner
gabbo
Viewed
0
分享
Nikolay 2020-12-22 05:10:52

The permissions of SPFx web part cannot extend beyond the currently logged-in user. To have extended permissions, you need server-side code. In share point, the thing you are looking for is probably called app-only permissions.

For SPFx web part, running in the browser, this is not possible (and does not make any sense because this would immediately compromise the security). Means, SPFx web part cannot do more than a user can do.

For your case, I would build a service, that has all necessary permissions granted. Basically, a normal web app, that is hosted on a server (can be in a form of azure function or a normal web app, i.e. a website), that, when called, would go and archive these messages. This app should have access to all channels it needs to archive. Then this app can provide some API that can be called from your web part (in case you still want a web part)

Then in that server app you can validate if the user has appropriate permissions to do what he's intended to do. You do that in server-side code, to which user has no access. Doing that it in the browser (in JavaScript) does not make any sense because the user has full access to JavaScript in the browser and can edit it any way he wants.

热门github

1
Implementation of paper - YOLOv9: Learning What You Want to Learn Using Programmable Gradient Information
2
A Windows and Office activator using HWID / Ohook / KMS38 / Online KMS activation methods, with a focus on open-source code and fewer antivirus detections.
3
Get up and running with Llama 2, Mistral, Gemma, and other large language models.
4
该项目可以让你通过订阅的方式使用Cloudflare WARP+，自动获取流量。This project enables you to use Cloudflare WARP+ through subscription, automatically acquiring traffic.
5
Multi functional app to find duplicates, empty folders, similar images etc.
6
Xray panel supporting multi-protocol multi-user expire day & traffic & ip limit (Vmess & Vless & Trojan & ShadowSocks & Wireguard)
7
The Free Software Media System
8
lightweight, standalone C++ inference engine for Google's Gemma models.
9
📚 Freely available programming books
10
A collective list of free APIs
11
1️⃣🐝🏎️ The One Billion Row Challenge -- A fun exploration of how quickly 1B rows from a text file can be aggregated with Java
12
🎓 Path to a free self-taught education in Computer Science!
13
Curso para aprender el lenguaje de programación Python desde cero y para principiantes. 75 clases, 37 horas en vídeo, código, proyectos y grupo de chat. Fundamentos, frontend, backend, testing, IA...
14
This repository contains System Design resources which are useful while preparing for interviews and learning Distributed Systems
15
Mamba is a new state space model architecture showing promising performance on information-dense data such as language modeling, where previous subquadratic models fall short of Transformers. It is based on the line of progress on structured state space models, with an efficient hardware-aware design and implementation in the spirit of FlashAttention.