403 on Get-Members - Githubissues

evenevan / export-ms-teams-chats

Export Microsoft Teams Chats to a local HTML file

MIT License

52 stars 6 forks source link

403 on Get-Members #6

Open dogacsenol opened 1 month ago

dogacsenol commented 1 month ago

Great work! Thank you for the fixes and contributions you made to the original script.

Any idea why, after exporting lots of other chats without a problem, the script fails with a 403: Forbidden in Get-Members.ps1 line 13 of this specific chat? I would expected a 429 if it were throttling. Sorry I don't get much other info.

Namely "Invoke-RestMethod -Method Get -Uri $membersUri -Headers @{"

Exporting C:\Users\xxx\teams\out\XXX XXX, XXX XXX, XXX XXX (FA5E5D93).html... Invoke-RestMethod : Der Remoteserver hat einen Fehler zurückgegeben: (403) Unzulässig. In C:\Users\xxx\AppData\Local\Temp\export-ms-teams-chats\export-ms-teams-chats-main\functions\chat\Get-Members.ps m1:13 Zeichen:13

Invoke-RestMethod -Method Get -Uri $membersUri -Headers @ ...


+ CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebException
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

evenevan commented 1 month ago

Hey! Sorry to hear about the issues.

Would you be able to run the scipt in verbose mode? Instructions can be found here. That would help a lot for debugging.

dogacsenol commented 1 month ago

Hi, thank you for the insight and quick reply.

Offtopic on - I have meanwhile dug deeper into the issue. First tried verbose mode and also tried to switch this to use application permissions instead of delegation so that I could export all the accounts myself automatically, without user intervention.

I succeeded and excited but the problem with application permissions is that if the user has been added to a chat as a guest, the initiator is on another tenant and the contents are not reachable by API. Lots in our case so disappointment (but still thinking of a PR in the future - lots of admins without lots of contacts from other tenants can like that better than the device - delegation mode). I would very much like to hear your feedback on this.

Offtopic off -

It was a little bit offtopic but not completely irrelevant to the case as doing the conversion I have noticed that there were some strange records that are not allowed by the Graph API, even in device - delegation mode. The chats seemed pretty irrelevant to me (probably some guest chats with a tenant with strict rules, or maybe a tenant that does not exist anymore etc.) so I just modified the code to skip those chats.

evenevan commented 1 month ago

Fascinating, thanks for your investigation. Regarding application vs delegation, I don't understand enough about Microsoft Graph and/or permissions (and unfortunately don't have time to dig into that) to make any useful remarks currently. It seems interesting though. About the chats you skipped, perhaps the code could be changed to continue exporting other chats if one fails. Glad it seems to have worked out to some extent for you though.