AccessToken :无法使用RefreshToken获取新Azure
我正在构建一个需要访问我们客户的Office 365 Management Activities的应用程序。我遵循了this Azure Active Directory概述中概述的步骤，并且能够使用OAuth代码来获取初始访问令牌，以及使用该令牌来设置O365订阅。
但是，当我使用随初始令牌提供的refresh_token获取新的访问令牌时，我收到以下错误：
error{“error_description”：“错误:用户或管理员未同意使用ID为'8f72f805-dfd2-428d-8b0e-771a98d26c16‘的应用，请针对该用户和资源发起交互授权请求。\r\n跟踪ID: 0e0f2bcb-4b19-458a-8556-2a6d4e51379f\r\nTimestamp: ID：
2016-10-03 17:33:20Z"，”AADSTS65001“：”invalid_grant“}
因为我能够获取和使用初始访问令牌，所以我非常确定用户正在授予我的应用程序一些权限。是否需要特定权限才能使用刷新令牌获取新的访问令牌？
编辑：具体地说，我使用了com.microsoft.azure::adal4j java package、AuthenticationContext类、acquireTokenByAuthorizationCode和acquireTokenByRefreshToken方法：
public class AzureProvisioner {
private final AuthenticationContext authService = new AuthenticationContext(
"https://login.windows.net/common/oauth2/token", true, Executors.newSingleThreadExecutor());
private final ClientCredential clientCredential = new ClientCredential("azureAppId", "azureAppSecret");
public static final String resource = "https://manage.office.com";
// Internal implementation of REST interface; Microsoft didn't provide a Java Library
final Office365ManagementApi managementApi;
public void acquireToken(final String authCode, final URI redirectUri) {
final AuthenticationResult authResult = authService.acquireTokenByAuthorizationCode(
authCode, redirectUri, clientCredential, resource, null).get()
// internal library code, gets the "tid" field from parsing the JWT token
final String tenantId = JwtAccessToken.fromToken(authResult.getAccessToken()).getTid();
// works
createInitialSubscription(customerId, authResult.getAccessToken(), tenantId);
// throws an error
final AuthenticationResult refreshResult = authService.acquireTokenByRefreshToken(
authResult.getRefreshToken(), clientCredential, null).get();
}
private void createInitialSubscription(final String accessToken, final String tenantId) {
final String authHeader = "Authorization: Bearer " + accessToken;
final String contentType = "Audit.AzureActiveDirectory";
// internal implementation
final CreateWebhookRequest requestBody = new CreateWebhookRequest();
managementApi.createSubscription(authHeader, tenantId, contentType, requestBody);
}
}同样的代码，没有任何外部依赖，也不适用于我：
public class AzureProvisioner {
private final AuthenticationContext authService = new AuthenticationContext(
"https://login.windows.net/common/oauth2/token", true, Executors.newSingleThreadExecutor());
private final ClientCredential clientCredential = new ClientCredential("8f72f805-dfd2-428d-8b0e-771a98d26c16", "secret");
public final String resource = "https://manage.office.com";
private URI redirectUri = new URI("https://localhost");
private static final String oAuthUrl = "https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=8f72f805-dfd2-428d-8b0e-771a98d26c16&resource=https%3A%2F%2Fmanage.office.com&redirect_uri=https%3A%2F%2Flocalhost";
public AzureProvisioner() throws Exception {
// do nothing
}
public static void main(String... args) throws Exception {
final String authCode = "AQABAAAAAADRNYRQ3dhRSrm...";
new AzureProvisioner().acquireToken(authCode);
}
public void acquireToken(final String authCode) throws Exception {
final AuthenticationResult authResult = authService.acquireTokenByAuthorizationCode(
authCode, redirectUri, clientCredential, resource, null).get();
System.out.println(authResult.getAccessToken());
// throws an error
final AuthenticationResult refreshResult = authService.acquireTokenByRefreshToken(
authResult.getRefreshToken(), clientCredential, resource, null).get();
System.out.println(refreshResult.getAccessToken());
}
}使用代理，我跟踪了https刷新请求：
Method: POST
Protocol-Version: HTTP/1.1
Protocol: https
Host: login.windows.net
File: /common/oauth2/token
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
Content-Length: 876
refresh_token={token}
&resource=https%3A%2F%2Fmanage.office.com
&grant_type=refresh_token
&scope=openid
&client_secret={secret}
&client_id=8f72f805-dfd2-428d-8b0e-771a98d26c16回答 2
Stack Overflow用户
发布于 2016-10-26 05:10:46
事实证明，问题的根源在于我的应用程序权限。在My Application > Settings > Required Permissions > Office 365 Management APIs下，我选择了“应用程序权限”，其中我需要选择“委派权限”。交换这些代码后，我的代码立即开始按预期工作。
Stack Overflow用户
发布于 2016-09-28 06:39:41
ADAL自动和透明地使用存储的刷新令牌，您不需要执行任何显式操作。由于遗留原因，AcquireTOkenByRefreshToken位于ADAL表面，并已从版本3.x中删除。更多背景信息请访问http://www.cloudidentity.com/blog/2015/08/13/adal-3-didnt-return-refresh-tokens-for-5-months-and-nobody-noticed/
https://stackoverflow.com/questions/39671471
复制相似问题
腾讯云开发者
