Office 365/EWS使用OAuth身份验证：访问群体声明值无效

Question

我已经在Azure AD中注册了一个应用程序。
我已经从那里使用了ClientID
我生成了一个应用程序秘密/密钥
我已经将“完全访问用户邮箱（预览）”权限委派给了该应用程序。

我正在使用ADAL检索访问令牌，如下所示：

var authority = "https://login.windows.net/<tenant>"
var authContext = new AuthenticationContext(authority);
var clientCredential = new ClientCredential("<clientId>", "<appKey>");
result = OAuthTokenManager.authContext.AcquireToken("<my ResourceID>", clientCredential);

我确实拿回了访问令牌。解码值为：

{
 "typ": "JWT",
 "alg": "RS256",
 "x5t": "kriMPdmBvx68skT8-mPAB3BseeA"
}.
{
 "aud": "<my resource ID>",
 "iss": "https://sts.windows.net/2d1f889d-7930-4ef6-9f87-ef096d91ac47/",
 "nbf": 1403253608,
 "exp": 1403296808,
 "sub": "bdb0baf9-29ca-4a43-b9f8-d81ca2ae83bd",
 "appid": "<my app ID>",
 "oid": "bdb0baf9-29ca-4a43-b9f8-d81ca2ae83bd",
 "tid": "2d1f889d-7930-4ef6-9f87-ef096d91ac47",
 "idp": "https://sts.windows.net/2d1f889d-7930-4ef6-9f87-ef096d91ac47/"
}.
[signature] 

var service = new ExchangeService(ExchangeVersion.Exchange2013_SP1);
var credentials = new OAuthCredentials(token);
service.Credentials = credentials;
service.Url = new Uri("https://outlook.office365.com/EWS/Exchange.asmx");
service.ImpersonatedUserId = new ImpersonatedUserId(ConnectingIdType.SmtpAddress, "<smtp address of o365 mailbox>");
Folder inbox = Folder.Bind(service, WellKnownFolderName.Inbox);

The audience claim value is invalid <my resource ID>

ACS50001: Relying party with identifier 'https://outlook.office365.com/' was not found.

租户确实有Exchange订阅，并且它对邮箱具有完全访问权限。

Answer 1

啊好吧。对于服务类型的应用程序，您需要使用一个可以模拟用户的服务帐户。有关详细信息，请参阅此MSDN主题。拥有该帐户后，您将希望通过OAuth身份验证为该服务帐户，然后根据需要模拟您的用户。

对于本机应用程序，您不能使用应用程序机密进行身份验证。因此您需要执行以下操作：

AuthenticationResult result = authContext.AcquireToken("https://outlook.office365.com", clientId, new Uri(callbackUri), PromptBehavior.Auto);

其中clientid是您在Azure注册中的客户端ID，callbackuri是您在Azure中注册应用程序时指定的重定向URI。这将导致显示一个提示窗口，但如果保存令牌和刷新令牌并使用它们来刷新，则应避免任何进一步的提示。返回的令牌应该类似于：

{
 "typ": "JWT",
 "alg": "RS256",
 "x5t": "kriMPdmBvx68skT8-mPAB3BseeA"
}.
{
 "aud": "https://outlook.office365.com",
 "iss": "https://sts.windows.net/9e4563d1-423e-493b-bdc5-9a98fe2e24d9/",
 "iat": 1403706230,
 "nbf": 1403706230,
 "exp": 1403710130,
 "ver": "1.0",
 "tid": "9e4563d1-423e-493b-bdc5-9a98fe2e24d9",
 "amr": [
  "pwd"
 ],
 "oid": "4a6e20e6-9711-4ca1-888b-34e63f65f897",
 "upn": "[e-mail]",
 "unique_name": "[e-mail]",
 "sub": "Pp3JW2dfYELMUBjGjUIZLarT4diOkkKZ1OJPVunzAYE",
 "puid": "100300008A9245F4",
 "family_name": "Account",
 "given_name": "Application",
 "appid": "<your app id>",
 "appidacr": "0",
 "scp": "user_impersonation",
 "acr": "1"
}.
[signature]