MIP SDK和AD RMS错误“MSIS9622:客户端身份验证失败”

Question

我已经学习了AD RMS和MIP SDK教程，并且已经使用AD RMS和ADFS建立了一个环境

以下是我的代码片段:

var engineSettings = new FileEngineSettings("internal\\sysadmin", authDelegate, "", "en-US");
engineSettings.Identity = new Identity("internal\\sysadmin");
engineSettings.ProtectionCloudEndpointBaseUrl = "https://adrms.server.com";
engineSettings.ProtectionOnlyEngine = true;
var fileEngine = Task.Run(async () => await fileProfile.AddEngineAsync(engineSettings)).Result;

...snip...

var fileHandlerResult = Task.Run(async () => await fileHandler.CommitAsync(protectedFilePath)).Result;

在CommitAsync行，用户被重定向到ADFS登录页面并登录，然后被重定向到“认证失败”页面，上面写着:

Error details: error access_denied error_description: MSIS9622: Client authentication failed. Please verify the credential provided for client authentication is valid.

是否需要对MIP SDK示例进行额外更改以使它们能够与ADFS一起使用？这是我的施政报告的片段

public string AcquireToken(Identity identity, string authority, string resource, string claims)
        {
            _app = PublicClientApplicationBuilder.Create(_appInfo.ApplicationId)
                .WithAdfsAuthority("https://adfs.server.com/adfs/", false)
                .WithRedirectUri("http://localhost:50069")
                .Build();

            var accounts = _app.GetAccountsAsync().GetAwaiter().GetResult();

            // Append .default to the resource passed in to AcquireToken().
            string[] scopes = { resource[^1].Equals('/') ? $"{resource}.default" : $"{resource}/.default" };

            var result = _app.AcquireTokenInteractive(scopes)
                .WithAccount(accounts.FirstOrDefault())
                .WithPrompt(Prompt.SelectAccount)
                .ExecuteAsync()
                .ConfigureAwait(false)
                .GetAwaiter()
                .GetResult();

            return result.AccessToken;
        }

Answer 1

我检查了我的AD FS事件查看器日志，我发现用户没有权限访问api.rms.rest.com依赖方信任-通过编辑权限改造策略来允许每个人。