代码之家  ›  专栏  ›  技术社区  ›  Omar Qureshi

混合环境,404个本地邮箱,200个用于Exchange online

  •  5
  • Omar Qureshi  · 技术社区  · 7 年前

    我已经编写了一个能够与Exchange在线帐户进行对话的应用程序,我目前正在尝试测试,以了解使其与运行在Hybrid中的内部部署帐户协同工作所需的步骤。

    我有:

    • Windows Server 2012 R2
    • Exchange 2016 CU8(与 /PrepareAD 运行)
    • 到的Internet可访问路径 /api/v2.0 /autodiscover/autodiscover.json
    • 运行HCW
    • AD Connect正在运行
    • Active Directory已同步到Azure Active Directory
    • 权限在我注册的应用程序上看起来很好(读取日历事件/读写日历事件)

    404 尝试访问日历事件时:

    curl -v -H 'Content-Type: application/json' -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJub25jZSI6IkFRQUJBQUFBQUFCSGg0a21TX2FLVDVYcmp6eFJBdEh6RE1mbEZNYTYwaktGRHRhUXp0ZGVkM2V6Z0ZfUzlLMjdDRmQxSHlfZGdRcnR6WlJBczRDV095R3E1Vl9OZW9MSFNKTGpzblNCSDNCQU9oQnBzU18wVmlBQSIsImFsZyI6IlJTMjU2IiwieDV0IjoiU1NRZGhJMWNLdmhRRURTSnhFMmdHWXM0MFEwIiwia2lkIjoiU1NRZGhJMWNLdmhRRURTSnhFMmdHWXM0MFEwIn0.eyJhdWQiOiJodHRwczovL2dyYXBoLm1pY3Jvc29mdC5jb20iLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC8wODY1YjBhYi02ZjYwLTQzNjMtYTEwZi05NWU5ZTc5ZjlmODEvIiwiaWF0IjoxNTE4OTc5NzQ0LCJuYmYiOjE1MTg5Nzk3NDQsImV4cCI6MTUxODk4MzY0NCwiYWlvIjoiWTJOZ1lKRE0reDVXbGhWNUlrajUwbDB4THNacEFBPT0iLCJhcHBfZGlzcGxheW5hbWUiOiJIQy1XZWIiLCJhcHBpZCI6ImVkZjlkY2M0LThjNjAtNDg3ZS1hYmUyLTI4MjcyYTRlZGJlMCIsImFwcGlkYWNyIjoiMiIsImlkcCI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0LzA4NjViMGFiLTZmNjAtNDM2My1hMTBmLTk1ZTllNzlmOWY4MS8iLCJvaWQiOiJkNTUzMTE2My01MTcxLTRmZjctYTNjMS04NWFlNzUzMjkzNTIiLCJyb2xlcyI6WyJNYWlsLlJlYWRXcml0ZSIsIkNvbnRhY3RzLlJlYWRXcml0ZSIsIkRpcmVjdG9yeS5SZWFkLkFsbCIsIk1haWwuUmVhZCIsIkNhbGVuZGFycy5SZWFkV3JpdGUiXSwic3ViIjoiZDU1MzExNjMtNTE3MS00ZmY3LWEzYzEtODVhZTc1MzI5MzUyIiwidGlkIjoiMDg2NWIwYWItNmY2MC00MzYzLWExMGYtOTVlOWU3OWY5ZjgxIiwidXRpIjoiNkxJT3g1bWQ4ay05ajhBUUtiY2hBQSIsInZlciI6IjEuMCJ9.AWt_ANsH8sk15WeH1AgD6SD0Ki8VILMvzkbSMju_YFGKc5cVkrGp7Skzt64uDM8rI6Py5Y-1c3srXwON2oSihkRskfz5vG4nIlbFnuYd3Ij2Vz1ktpNnCeMAnAK2T8ifk2visRSvchRbuBNZZyamwRjActdDF9BS8NygUgmmygK4mPjOIab17PJPz5PisvRbCA2jBLWLvbu9RYrLH-xGuoLd2PLTbsn2WSVi3er4XztZCcK7XfVWe-0wjrV6qBufd5z0hH_KpQLdzPtLOzSUGUAcXGa0mBPceTWULQvQ-LPcAJO57F0ir5k22fWzlkOfUxQb9eGWREUm1cAPWk3CPw" "https://graph.microsoft.com/v1.0/users/oq@healthcentrified.co.uk/calendar/events"
    *   Trying 137.116.241.64...
    * Connected to graph.microsoft.com (137.116.241.64) port 443 (#0)
    * found 148 certificates in /etc/ssl/certs/ca-certificates.crt
    * found 592 certificates in /etc/ssl/certs
    * ALPN, offering http/1.1
    * SSL connection using TLS1.2 / ECDHE_RSA_AES_256_CBC_SHA384
    *        server certificate verification OK
    *        server certificate status verification SKIPPED
    *        common name: graph.microsoft.com (matched)
    *        server certificate expiration date OK
    *        server certificate activation date OK
    *        certificate public key: RSA
    *        certificate version: #3
    *        subject: C=US,ST=WA,L=Redmond,O=Microsoft Corporation,OU=Microsoft Corporation,CN=graph.microsoft.com
    *        start date: Wed, 03 Jan 2018 17:32:18 GMT
    *        expire date: Fri, 03 Jan 2020 17:32:18 GMT
    *        issuer: C=US,ST=Washington,L=Redmond,O=Microsoft Corporation,OU=Microsoft IT,CN=Microsoft IT TLS CA 4
    *        compression: NULL
    * ALPN, server did not agree to a protocol
    > GET /v1.0/users/oq@healthcentrified.co.uk/calendar/events HTTP/1.1
    > Host: graph.microsoft.com
    > User-Agent: curl/7.47.0
    > Accept: */*
    > Content-Type: application/json
    > Authorization: Bearer eyJ0eXAiOiJKV1QiLCJub25jZSI6IkFRQUJBQUFBQUFCSGg0a21TX2FLVDVYcmp6eFJBdEh6RE1mbEZNYTYwaktGRHRhUXp0ZGVkM2V6Z0ZfUzlLMjdDRmQxSHlfZGdRcnR6WlJBczRDV095R3E1Vl9OZW9MSFNKTGpzblNCSDNCQU9oQnBzU18wVmlBQSIsImFsZyI6IlJTMjU2IiwieDV0IjoiU1NRZGhJMWNLdmhRRURTSnhFMmdHWXM0MFEwIiwia2lkIjoiU1NRZGhJMWNLdmhRRURTSnhFMmdHWXM0MFEwIn0.eyJhdWQiOiJodHRwczovL2dyYXBoLm1pY3Jvc29mdC5jb20iLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC8wODY1YjBhYi02ZjYwLTQzNjMtYTEwZi05NWU5ZTc5ZjlmODEvIiwiaWF0IjoxNTE4OTc5NzQ0LCJuYmYiOjE1MTg5Nzk3NDQsImV4cCI6MTUxODk4MzY0NCwiYWlvIjoiWTJOZ1lKRE0reDVXbGhWNUlrajUwbDB4THNacEFBPT0iLCJhcHBfZGlzcGxheW5hbWUiOiJIQy1XZWIiLCJhcHBpZCI6ImVkZjlkY2M0LThjNjAtNDg3ZS1hYmUyLTI4MjcyYTRlZGJlMCIsImFwcGlkYWNyIjoiMiIsImlkcCI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0LzA4NjViMGFiLTZmNjAtNDM2My1hMTBmLTk1ZTllNzlmOWY4MS8iLCJvaWQiOiJkNTUzMTE2My01MTcxLTRmZjctYTNjMS04NWFlNzUzMjkzNTIiLCJyb2xlcyI6WyJNYWlsLlJlYWRXcml0ZSIsIkNvbnRhY3RzLlJlYWRXcml0ZSIsIkRpcmVjdG9yeS5SZWFkLkFsbCIsIk1haWwuUmVhZCIsIkNhbGVuZGFycy5SZWFkV3JpdGUiXSwic3ViIjoiZDU1MzExNjMtNTE3MS00ZmY3LWEzYzEtODVhZTc1MzI5MzUyIiwidGlkIjoiMDg2NWIwYWItNmY2MC00MzYzLWExMGYtOTVlOWU3OWY5ZjgxIiwidXRpIjoiNkxJT3g1bWQ4ay05ajhBUUtiY2hBQSIsInZlciI6IjEuMCJ9.AWt_ANsH8sk15WeH1AgD6SD0Ki8VILMvzkbSMju_YFGKc5cVkrGp7Skzt64uDM8rI6Py5Y-1c3srXwON2oSihkRskfz5vG4nIlbFnuYd3Ij2Vz1ktpNnCeMAnAK2T8ifk2visRSvchRbuBNZZyamwRjActdDF9BS8NygUgmmygK4mPjOIab17PJPz5PisvRbCA2jBLWLvbu9RYrLH-xGuoLd2PLTbsn2WSVi3er4XztZCcK7XfVWe-0wjrV6qBufd5z0hH_KpQLdzPtLOzSUGUAcXGa0mBPceTWULQvQ-LPcAJO57F0ir5k22fWzlkOfUxQb9eGWREUm1cAPWk3CPw
    >
    < HTTP/1.1 404 Not Found
    < Cache-Control: private
    < Transfer-Encoding: chunked
    < Content-Type: text/plain
    < request-id: f499015e-325b-45e8-9716-0a8a7160b82d
    < client-request-id: f499015e-325b-45e8-9716-0a8a7160b82d
    < x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"North Europe","Slice":"SliceA","Ring":"3","ScaleUnit":"003","Host":"AGSFE_IN_0","ADSiteName":"DUB"}}
    < Duration: 1764.3754
    < Date: Sun, 18 Feb 2018 19:18:28 GMT
    <
    * Connection #0 to host graph.microsoft.com left intact
    

    如果我对已迁移到Exchange Online的邮箱执行类似的请求,这会起作用(我得到一个 HTTP 200 以及返回JSON的事件列表)

    Office 365支持部门不确定在这里做什么(这可能超出了他们的范围)。

    这个 documentation says that it is in preview ,但仍应有效

    作为Office 365的一部分,Microsoft Graph始终在Exchange Online上提供对云中客户邮箱的访问。2016年9月针对Exchange内部部署服务器发布的Exchange 2016累积更新3(CU3)增加了对REST API与Office 365集成的支持。如果您的应用程序使用Mail、Calendar或Contacts API的v1.0,那么您现在也可以在混合部署中找到无缝的身份验证和应用程序体验,无论邮箱是在本地还是在云中,只要部署满足特定要求。

    在幕后,当Microsoft Graph确定REST API 呼叫正在尝试访问混合模式中的内部部署邮箱 部署时,它将REST请求代理给本地REST 然后处理请求的端点。这一发现使 尽可能访问REST API。

    我要说的是,我的Windows经验非常有限,这是我第一次尝试将Windows服务器用于任何事情,然而,缺乏关于此场景的文档,因为这可能是许多大型企业组织都想做的事情。

    有什么明显的问题吗?

    使现代化

    Rasmus问我是否有任何请求进入我的web服务器,而我可以看到大量流量 /rpc 我什么都没碰到 autodiscover.json 唯一的要求是 /API

    2018-02-25 18:58:24 ::1 
    GET /api/v1.0/users/HealthMailboxda9cb9ff7af047cf9878a9b7be391e14@healthcentrified.co.uk/Messages 
    $top=1
    &request_id=4f17c7a2-f753-46f7-853d-36f7a5281932 444 
    - ::1 Odata_AM_Probe/Local - 401 0 0 0
    

    和其他人从此用户代理发送到此邮箱

    1 回复  |  直到 7 年前
        1
  •  2
  •   Stephan    6 年前

    我查过你的代币了 https://jwt.ms 发现这是客户端凭据流中的应用程序令牌。这不是现成的支持,但今天我发现,您可以在本地exchange环境中启用这些令牌。

    在这篇帖子中看到我的答案: https://stackoverflow.com/a/56131954/639153

    原始答案 here