Question

我收到错误 AADSTS70002：验证凭据时出错。 AADSTS50012：客户声明受众声明与Realm发行者

不匹配运行此代码时

。

    string[] scopes = new string[]{"https://graph.microsoft.com/.default"};
var certStore = new X509Store(StoreName.My, StoreLocation.CurrentUser);
certStore.Open(OpenFlags.ReadOnly);
var cert = certStore.Certificates.Cast<X509Certificate2>().First(c => c.Thumbprint == "XXX-XXX etc");
var cas = new ClientAssertionCertificate(cert);
var cc = new Microsoft.Identity.Client.ClientCredential(cas);
var client = new Microsoft.Identity.Client.ConfidentialClientApplication("XX-XXX etc", "http://localhost", cc, new TokenCache(), new TokenCache() );
var authResult = await client.AcquireTokenForClientAsync(scopes);
var dap = new DelegateAuthenticationProvider(rm => 
{
    rm.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("bearer", authResult.AccessToken);
    return Task.FromResult(0);
});
var gClient = new GraphServiceClient(dap);
gClient.Me.Dump();

调用AcquireTokenForClientAsync()方法时出现错误。

我无法找到任何无法进行用户身份验证的MSAL和Daemon客户端的在线文档。

建议？

Answer 1

发现问题。我需要使用ConfidentialClientApplication构造函数的第二个重载，并提供这样的授权。

string authorityFormat = "https://login.microsoftonline.com/{0}/v2.0";
string tennantId = "xxx-xx-xx";

然后

var client = new Microsoft.Identity.Client.ConfidentialClientApplication("xxx-x-xx etc", string.Format(authorityFormat, tennantId), "http://localhost", cc, new TokenCache(), new TokenCache() );

代码Here指出了我正确的方向。

守护进程使用MSAL到MSGraph

1 个答案: