文章/答案/技术大牛

发布

社区首页 >问答首页 >用Connect-MsolService -AccessToken连接到Azure AD的“意外错误”

问用Connect-MsolService -AccessToken连接到Azure AD的“意外错误”
EN

Stack Overflow用户

提问于 2015-10-13 23:29:03

回答 1查看 10.2K关注 0票数 1

我正在使用Azure AD模块的新预览版本。我试图通过新的AccessToken参数进行连接：

Connect-MsolService - AccessToken ey...

但我得到了一个“意想不到的错误”。

Connect-MsolService : An unexpected error occurred.
At line:1 char:1
+ Connect-MsolService -AccessToken eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ik1 ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : OperationStopped: (:) [Connect-MsolService], MicrosoftOnlineException
+ FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.InvalidHeaderException,Microsoft.Online.Admin
istration.Automation.ConnectMsolService

Connect-MsolService : Exception of type 'Microsoft.Online.Administration.Automation.MicrosoftOnlineException' was
thrown.
At line:1 char:1
+ Connect-MsolService -AccessToken eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ik1 ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : OperationStopped: (:) [Connect-MsolService], MicrosoftOnlineException
+ FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.MicrosoftOnlineException,Microsoft.Online.Adm
inistration.Automation.ConnectMsolService

我知道我使用的访问令牌很好，因为我可以使用它从Postman调用Graph。有人成功了吗？

编辑：不确定投票被否决的原因，但为了证明我做了功课，下面是PS模块在幕后发出的请求/响应，用Fiddler跟踪捕获。它包含有帮助的消息“用户标识头无效”。

请求

POST https://provisioningapi.microsoftonline.com/provisioningwebservice.svc HTTP/1.1

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
  <s:Header>
    <a:Action s:mustUnderstand="1">http://provisioning.microsoftonline.com/IProvisioningWebService/MsolConnect</a:Action>
    <a:MessageID>urn:uuid:df0e35bd-ef05-48cd-a623-a1134b0b2ed6</a:MessageID>
    <a:ReplyTo>
      <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
    </a:ReplyTo>
    <UserIdentityHeader xmlns="http://provisioning.microsoftonline.com/" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
      <BearerToken xmlns="http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebService">Bearer ey...</BearerToken>
      <LiveToken i:nil="true" xmlns="http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebService"/>
    </UserIdentityHeader>
    <ClientVersionHeader xmlns="http://provisioning.microsoftonline.com/" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
      <ClientId xmlns="http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebService">50afce61-c917-435b-8c6d-60aa5a8b8aa7</ClientId>
      <Version xmlns="http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebService">1.1.8806.11</Version>
    </ClientVersionHeader>
    <ContractVersionHeader xmlns="http://becwebservice.microsoftonline.com/" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
      <BecVersion xmlns="http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebService">Version32</BecVersion>
    </ContractVersionHeader>
    <TrackingHeader xmlns="http://becwebservice.microsoftonline.com/">bf71f0c6-add7-4046-9209-bfd584ca3c28</TrackingHeader>
    <a:To s:mustUnderstand="1">https://provisioningapi.microsoftonline.com/provisioningwebservice.svc</a:To>
  </s:Header>
  <s:Body>
    <MsolConnect xmlns="http://provisioning.microsoftonline.com/">
      <request xmlns:b="http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebService" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
        <b:BecVersion>Version4</b:BecVersion>
        <b:TenantId i:nil="true"/>
        <b:VerifiedDomain i:nil="true"/>
      </request>
    </MsolConnect>
  </s:Body>
</s:Envelope>

响应

HTTP/1.1 500 Internal Server Error

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
  <s:Header>
    <a:Action s:mustUnderstand="1">http://provisioning.microsoftonline.com/IProvisioningWebService/MsolConnectInvalidHeaderExceptionFault</a:Action>
    <a:RelatesTo>urn:uuid:df0e35bd-ef05-48cd-a623-a1134b0b2ed6</a:RelatesTo>
  </s:Header>
  <s:Body>
    <s:Fault>
      <s:Code>
        <s:Value>s:Sender</s:Value>
      </s:Code>
      <s:Reason>
        <s:Text xml:lang="en-US">The creator of this fault did not specify a Reason.</s:Text>
      </s:Reason>
      <s:Detail>
        <InvalidHeaderException xmlns="http://schemas.datacontract.org/2004/07/Microsoft.Online.Administration.WebService" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
          <HelpLink i:nil="true"/>
          <Message>The user identity header is invalid.</Message>
          <OperationId i:nil="true"/>
          <Source>Microsoft.Online.Administration.PublicBecWebService</Source>
          <StackTrace>   at Microsoft.Online.Administration.WebService.BecWebServiceAuthenticationManager.ValidateJwtTokenV2(String bearerToken) in x:\bt\533229\repo\src\dev\om\administration\publicbecwebservice\BecWebServiceAuthenticationManager.cs:line 371&#xD;
    at Microsoft.Online.Administration.WebService.BecWebServiceAuthenticationManager.CheckAccessCore(OperationContext operationContext) in x:\bt\533229\repo\src\dev\om\administration\publicbecwebservice\BecWebServiceAuthenticationManager.cs:line 723</StackTrace>
        </InvalidHeaderException>
      </s:Detail>
    </s:Fault>
  </s:Body>
</s:Envelope>

下面是我如何获得访问令牌的方法。我使用的是客户端凭据流，因为最终我的目标是从Azure自动化运行它。

$clientId = "20bc779d-0edb-4a00-becf-xxx"
$redirectUri = new-object System.Uri("urn:ietf:wg:oauth:2.0:oob")
$resourceId = "https://graph.windows.net"
$authority = "https://login.windows.net/mydirectory.onmicrosoft.com"
$key = ConvertTo-SecureString $keyFromAzurePortal -AsPlainText -Force
$cred = New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.ClientCredential ($clientId, $key)

$authContext = New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext($authority)
$authResult = $authContext.AcquireToken($resourceId, $cred)

powershell

azure

azure-active-directory

azure-ad-graph-api

回答 1

Stack Overflow用户

发布于 2015-10-15 19:38:06

我无法复制你的问题。让我告诉你我做了什么让它起作用：

我首先获得了针对Graph的本地客户端应用程序的访问令牌：

$clientId = "<GUID>";
$tenantId = "<tenant>.onmicrosoft.com";
$resourceId = "https://graph.windows.net"
$redirectUri = new-object System.Uri("urn:ietf:wg:oauth:2.0:oob")
$login = "https://login.microsoftonline.com"

$authContext = New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext("{0}/{1}" -f $login,$tenantId);
$authenticationResult = $authContext.AcquireToken($resourceId,$clientID,$redirectUri);
$token = $authenticationResult.AccessToken

然后我在PowerShell中使用了这个令牌：

PS C:\Users\shtabriz> Connect-MsolService -AccessToken eyJ0eXAiOiJKV1QiLCJ...
PS C:\Users\shtabriz> Get-MsolUser

UserPrincipalName                                     DisplayName       isLicensed
-----------------                                     -----------       ----------
test@shawntest.onmicrosoft.com                        TestMe            False
shtabriz_microsoft.com#EXT#@shawntest.onmicrosoft.com Shawn Tabrizi     False
admin@shawntest.onmicrosoft.com                       ShawnTabriziAdmin False
Alex@shawntest.onmicrosoft.com                        Alex Wu           False
language@shawntest.onmicrosoft.com                    Language          False
languageportal@shawntest.onmicrosoft.com              Language Portal   False

你得到了什么样的访问令牌？你介意和我分享一下吗？或者至少有一个没有签名的JWT解压缩版本？

如果你想把这件事带到别处去，请随时与我们联系

AADPowerShellPreview@microsoft.com

请包括在这里找到的日志文件：

C:\Usersyouralias\AppData\Local\Microsoft\Office365\Powershell

票数 2

页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持

原文链接：

https://stackoverflow.com/questions/33114254

复制

相似问题

问用Connect-MsolService -AccessToken连接到Azure AD的“意外错误”
EN

回答 1

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问用Connect-MsolService -AccessToken连接到Azure AD的“意外错误”EN

回答 1

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问用Connect-MsolService -AccessToken连接到Azure AD的“意外错误”
EN