Question

当我尝试使用Microsoft帐户登录到我的Web应用程序时出现此错误：

{
  "error": {
    "code": "UnknownError",
    "message": "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\">\r\n<html xmlns=\"http://www.w3.org/1999/xhtml\">\r\n<head>\r\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\"/>\r\n<title>401 - Unauthorized: Access is denied due to invalid credentials.</title>\r\n<style type=\"text/css\">\r\n<!--\r\nbody{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}\r\nfieldset{padding:0 15px 10px 15px;} \r\nh1{font-size:2.4em;margin:0;color:#FFF;}\r\nh2{font-size:1.7em;margin:0;color:#CC0000;} \r\nh3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} \r\n#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:\"trebuchet MS\", Verdana, sans-serif;color:#FFF;\r\nbackground-color:#555555;}\r\n#content{margin:0 0 0 2%;position:relative;}\r\n.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}\r\n-->\r\n</style>\r\n</head>\r\n<body>\r\n<div id=\"header\"><h1>Server Error</h1></div>\r\n<div id=\"content\">\r\n <div class=\"content-container\"><fieldset>\r\n  <h2>401 - Unauthorized: Access is denied due to invalid credentials.</h2>\r\n  <h3>You do not have permission to view this directory or page using the credentials that you supplied.</h3>\r\n </fieldset></div>\r\n</div>\r\n</body>\r\n</html>\r\n",
    "innerError": {
      "request-id": "caee116c-483e-4d88-814a-721ce92c6b74",
      "date": "2018-08-10T19:18:47"
    }
  }
}

该应用在https://apps.dev.microsoft.com中的配置如下：

具有生成密码的应用
允许隐式流检查
redirect_uri： http://localhost:3000/users/auth/microsoft_graph_oauth2/callback
授权权限：电子邮件，Mail.Read，Mail.Send，offline_access，openid，个人资料

（rails）应用程序配置有gems devise和omniauth。这是omniauth策略配置：

  config.omniauth :microsoft_graph_oauth2,
                  Rails.application.credentials.dig(:oauth, :o365_id),
                  Rails.application.credentials.dig(:oauth, :o365_secret),
                  scope: %w[
                    email profile openid offline_access
                    Mail.Read Mail.Send
                  ].join(' ')

这是omniauth策略定义：

module OmniAuth
  module Strategies
    class MicrosoftGraphOauth2 < OmniAuth::Strategies::OAuth2
      option :name, :microsoft_graph_oauth2

      option :client_options, site: 'https://login.microsoftonline.com',
                              token_url: '/common/oauth2/v2.0/token',
                              authorize_url: '/common/oauth2/v2.0/authorize'

      option :authorize_options, %i[
        display score auth_type
        scope prompt
        login_hint domain_hint
        response_mode
      ]

      uid { raw_info['id'] }

      info do
        {
          email:      raw_info['mail'] || raw_info['userPrincipalName'],
          first_name: raw_info['givenName'],
          last_name:  raw_info['surname'],
          name:       full_name,
          nickname:   raw_info['userPrincipalName']
        }
      end

      extra do
        {
          'raw_info' => raw_info,
          'params' => access_token.params
        }
      end

      def callback_url
        options[:redirect_uri] || (full_host + script_name + callback_path)
      end

      def raw_info
        @raw_info ||= access_token.get(
          'https://graph.microsoft.com/v1.0/me'
        ).parsed
      end

      def authorize_params
        super.tap do |params|
          %w[display score auth_type].each do |v|
            next unless request.params[v]
            params[v.to_sym] = request.params[v]
          end
        end
      end

      def full_name
        raw_info['displayName'].presence ||
          raw_info.values_at('givenName', 'surname').compact.join(' ')
      end
    end
  end
end

我想念什么？我在任何地方都找不到此错误的原因。看来这是Microsoft应用程序定义中的一些配置问题，但idk是什么...

Answer 1

在更新委派权限之后已解决。 email, profile是“旧版”（office365 v2 API）权限，应替换为User.Read，以使用图（v1）API进行正确的身份验证

Microsoft Graph Oauth2-获取：“ 401-未经授权：由于凭据无效而拒绝访问”

1 个答案: