Django Azure ad AADSTS50011:请求中指定的回复url与为应用程序配置的回复URL不匹配

Question

我正在尝试使用azure active directory对用户进行身份验证，但我得到了“AADSTS50011”：请求中指定的回复url与我使用的django microsoft auth library应用程序配置的回复url不匹配。我已经提到了多个StackOverflow问题，但没有一个能解决我的问题。它们都不是Django特有的

settings.py

"""

Django settings for mywebapp project.

Generated by 'django-admin startproject' using Django 2.1.4.

For more information on this file, see
https://docs.djangoproject.com/en/2.1/topics/settings/

For the full list of settings and their values, see
https://docs.djangoproject.com/en/2.1/ref/settings/
"""

import os

# Build paths inside the project like this: os.path.join(BASE_DIR, ...)
BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))


# Quick-start development settings - unsuitable for production
# See https://docs.djangoproject.com/en/2.1/howto/deployment/checklist/

# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = 'wi31*5al3v=&or_p354489830j)w_zr-)1^a$m*=@yo1l62nni'

# SECURITY WARNING: don't run with debug turned on in production!
DEBUG = True

ALLOWED_HOSTS = ["*"]

SITE_ID = 1

# Application definition

INSTALLED_APPS = [
    'django.contrib.sites',
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'myapp',
    'microsoft_auth',
]

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

ROOT_URLCONF = 'mywebapp.urls'

TEMPLATES = [
    {
        'BACKEND': 'django.template.backends.django.DjangoTemplates',
        'DIRS': [],
        'APP_DIRS': True,
        'OPTIONS': {
            'context_processors': [
                'django.template.context_processors.debug',
                'django.template.context_processors.request',
                'django.contrib.auth.context_processors.auth',
                'django.contrib.messages.context_processors.messages',
                'microsoft_auth.context_processors.microsoft',
            ],
        },
    },
]

WSGI_APPLICATION = 'mywebapp.wsgi.application'


# Database
# https://docs.djangoproject.com/en/2.1/ref/settings/#databases

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.sqlite3',
        'NAME': os.path.join(BASE_DIR, 'db.sqlite3'),
    }
}

AUTHENTICATION_BACKENDS = [
    'microsoft_auth.backends.MicrosoftAuthenticationBackend',
    'django.contrib.auth.backends.ModelBackend' # if you also want to use Django's authentication
    # I recommend keeping this with at least one database superuser in case of unable to use others
]

# Password validation
# https://docs.djangoproject.com/en/2.1/ref/settings/#auth-password-validators

AUTH_PASSWORD_VALIDATORS = [
    {
        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
    },
]


    # Internationalization
    # https://docs.djangoproject.com/en/2.1/topics/i18n/

LANGUAGE_CODE = 'en-us'

TIME_ZONE = 'UTC'

USE_I18N = True

USE_L10N = True

USE_TZ = True


# Static files (CSS, JavaScript, Images)
# https://docs.djangoproject.com/en/2.1/howto/static-files/

STATIC_URL = '/static/'


MICROSOFT_AUTH_CLIENT_ID ={clientid}
MICROSOFT_AUTH_CLIENT_SECRET = {Secret}

MICROSOFT_AUTH_LOGIN_TYPE = 'ma'

urls.py

urlpatterns = [
    path('microsoft/', include('microsoft_auth.urls', namespace='microsoft')),
    path('myapp/', include('myapp.urls')),
    path('admin/', admin.site.urls),
]

Answer 1

当azure portal中定义的重定向url与授权请求中的重定向url不匹配时，通常会出现此问题。您可以使用fiddler捕获授权请求url，以在请求中查找重定向url。差不多

https://login.microsoftonline.com/{tenant}/oauth2/authorize？ client_id=6731de76-14a6-49ae-97bc-6eba6914391e

复制此redirect_uri并将其粘贴到Azure门户。

Answer 2

当您运行内置服务器时，它默认在端口8000上运行。因此，您将在Azure中输入的回调URLhttp://localhost:8000/microsoft/auth-callback/

问题是Azure会回调，但会删除冒号和端口号，因此它会重新调用服务器http://localhost/microsoft/auth-callback/这显然会在服务器侦听端口8000时失败。

在这种情况下，您可以配置一个 iptables 重定向规则，将流量重定向到端口 80 上的 localhost，如下所示（在 Linux 上）：

iptables -t nat -I OUTPUT --source 127.0.0.1 --destination 127.0.0.1 -p tcp --dport 80 -j REDIRECT --to-ports 8000

#iptables-nvL-t nat链预路由（策略接受295个数据包，66558字节）pkts字节目标保护选择退出源目标

链输入（策略接受 295 个数据包，66558 字节）pkts 字节目标保护选择退出源目标

链输出（策略接受145K数据包，8873K字节）pkts字节目标保护选择退出源目标
211 12660重定向tcp-**127.0.0.1 127.0-0.1 tcp dpt:80个重定向端口8000

链POSTROUTING（策略接受145K数据包，8886K字节）pkts字节目标prot选择退出源目标