代码之家 › 专栏 › 技术社区 › Andrew

JWT CSOM/REST Azure Active Directory

bearer-token csom azure-active-directory authentication rest

Andrew · 技术社区 · 8 年前

我们一直在尝试使用带有令牌的CSOM/REST身份验证承载头请求向sharepoint发出请求。这与以下问题有关:

C# CSOM Sharepoint Bearer request from azure active directory

只有一个链接/示例有效,其他所有链接/示例(包括android ADAL方法)均无效。

https://samlman.wordpress.com/2015/02/27/using-adal-access-tokens-with-o365-rest-apis-and-csom/

它们似乎不会像令牌一样长时间返回,当我们在JWT解析器中查看令牌时,我们可以看到价值是不同的,失败的有 ,但正在工作的这个 MBaud url也不同,这是一个问题还是两个问题,我如何使其工作?

{
  "aud": "https://srmukdev.onmicrosoft.com/3Squared-Api-Test",
  "iss": "...",
  "iat": ...,
  "nbf": ...,
  "exp": ..,
  "acr": "...",
  "aio": "...",
  "amr": [
    "pwd",
    "mfa"
  ],
  "appid": "...",
  "appidacr": "0",
  "e_exp": ...,
  "family_name": "...",
  "given_name": "...",
  "ipaddr": "...",
  "name": "...",
  "oid": "...",
  "onprem_sid": "...",
  "platf": "3",
  "scp": "user_impersonation",
  "sub": "...",
  "tid": "...",
  "unique_name": "...",
  "upn": "...",
  "ver": "1.0"
}

这就是有效的方法:

{
  "aud": "https://srmukdev.sharepoint.com/",
  "iss": "...",
  "iat": ...,
  "nbf": ...,
  "exp": ...,
  "acr": "...",
  "aio": "...",
  "amr": [
    "pwd",
    "mfa"
  ],
  "app_displayname": "...",
  "appid": "...",
  "appidacr": "0",
  "e_exp": ...,
  "family_name": "...",
  "given_name": "...",
  "ipaddr": "...",
  "name": "...",
  "oid": "...",
  "onprem_sid": "...",
  "platf": "3",
  "puid": "...",
  "scp": "AllSites.Manage AllSites.Read AllSites.Write MyFiles.Read MyFiles.Write",
  "sub": "...",
  "tid": "...",
  "unique_name": "...",
  "upn": "...",
  "ver": "1.0"
}

1 回复 | 直到 8 年前

Fei Xue 8 年前

访问令牌通过检查其 aud

为了获得特定资源的令牌,我们可以使用参数 resource 指定要请求令牌的资源。例如,如果我想获取Microsoft Graph资源的令牌,我们可以构建如下请求:

POST /{tenant}/oauth2/token HTTP/1.1
Host: https://login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded
grant_type=authorization_code
&client_id=2d4d11a2-f814-46a7-890a-274a72a7309e
&code=AwABAAAAvPM1KaPlrEqdFSBzjqfTGBCmLdgfSTLEMPGYuNHSUYBrqqf_ZT_p5uEAEJJ_nZ3UmphWygRNy2C3jJ239gV_DBnZ2syeg95Ki-374WHUP-i3yIhv5i-7KU2CEoPXwURQp6IVYMw-DjAOzn7C3JCu5wpngXmbZKtJdWmiBzHpcO2aICJPu1KvJrDLDP20chJBXzVYJtkfjviLNNW7l7Y3ydcHDsBRKZc3GuMQanmcghXPyoDg41g8XbwPudVh7uCmUponBQpIhbuffFP_tbV8SNzsPoFz9CLpBCZagJVXeqWoYMPe2dSsPiLO9Alf_YIe5zpi-zY4C3aLw5g9at35eZTfNd0gBRpR5ojkMIcZZ6IgAA
&redirect_uri=https%3A%2F%2Flocalhost%2Fmyapp%2F
&resource=https%3A%2F%2Fservice.contoso.com%2F
&client_secret=p@ssw0rd

如果您想要获取的访问令牌 https://srmukdev.sharepoint.com/ ,您需要为 https://srmukdev.sharepoint.com/ 根据您使用的流程在请求中。

Azure Active Directory Authentication Protocols