【发布时间】：2022-07-19 05:38:03
【问题描述】：
让我的客户 ID 和密码正确。我的重定向网址是 - http://localhost:8080/callback 。我已在我的 AD 中允许公共客户流。但是每次我执行代码 main.go 时，我都会收到错误 Handler error: token response was 401 Unauthorized。所以我确实得到了登录页面，但每当我点击登录时，它都会使用我的电子邮件 ID 和密码对我进行身份验证。但是一旦我进入重定向，我得到错误处理程序错误：令牌响应是 401 未授权。
package main
import (
"crypto/sha256"
"encoding/base64"
"encoding/gob"
"encoding/json"
"fmt"
"html/template"
"log"
"net/http"
"net/url"
"strings"
"github.com/davecgh/go-spew/spew"
"github.com/gorilla/sessions"
_ "golang.org/x/net/context"
"golang.org/x/oauth2"
)
const (
redirectURI string = "http://localhost:8080/callback"
)
// Authentication + Encryption key pairs
var sessionStoreKeyPairs = [][]byte{
[]byte("something-very-secret"),
nil,
}
var store sessions.Store
var (
clientID string
config *oauth2.Config
)
type User struct {
Email string
DisplayName string
}
func init() {
// Create file system store with no size limit
fsStore := sessions.NewFilesystemStore("", sessionStoreKeyPairs...)
fsStore.MaxLength(0)
store = fsStore
gob.Register(&User{})
gob.Register(&oauth2.Token{})
}
func main() {
log.SetFlags(log.LstdFlags | log.Llongfile)
clientID = "<client-id>"
if clientID == "" {
log.Fatal("AZURE_AD_CLIENT_ID must be set.")
}
config = &oauth2.Config{
ClientID: clientID,
ClientSecret: "<secret-id>", // no client secret
RedirectURL: redirectURI,
Endpoint: oauth2.Endpoint{
AuthURL: "https://login.microsoftonline.com/<Tenant-id>/oauth2/authorize",
TokenURL: "https://login.microsoftonline.com/<tenant-id>/oauth2/token",
},
Scopes: []string{"User.Read"},
}
http.Handle("/", handle(IndexHandler))
http.Handle("/callback", handle(CallbackHandler))
log.Fatal(http.ListenAndServe(":8080", nil))
}
type handle func(w http.ResponseWriter, req *http.Request) error
func (h handle) ServeHTTP(w http.ResponseWriter, req *http.Request) {
defer func() {
if r := recover(); r != nil {
log.Printf("Handler panic: %v", r)
}
}()
if err := h(w, req); err != nil {
log.Printf("Handler error: %v", err)
if httpErr, ok := err.(Error); ok {
http.Error(w, httpErr.Message, httpErr.Code)
}
}
}
type Error struct {
Code int
Message string
}
func (e Error) Error() string {
if e.Message == "" {
e.Message = http.StatusText(e.Code)
}
return fmt.Sprintf("%d: %s", e.Code, e.Message)
}
func IndexHandler(w http.ResponseWriter, req *http.Request) error {
session, _ := store.Get(req, "session")
var token *oauth2.Token
if req.FormValue("logout") != "" {
session.Values["token"] = nil
sessions.Save(req, w)
} else {
if v, ok := session.Values["token"]; ok {
token = v.(*oauth2.Token)
}
}
var data = struct {
Token *oauth2.Token
AuthURL string
}{
Token: token,
AuthURL: config.AuthCodeURL(SessionState(session), oauth2.AccessTypeOnline),
}
return indexTempl.Execute(w, &data)
}
var indexTempl = template.Must(template.New("").Parse(`<!DOCTYPE html>
<html>
<head>
<title>Azure AD OAuth2 Example</title>
<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-BVYiiSIFeK1dGmJRAkycuHAHRg32OmUcww7on3RYdg4Va+PmSTsz/K68vbdEjh4u" crossorigin="anonymous">
</head>
<body class="container-fluid">
<div class="row">
<div class="col-xs-4 col-xs-offset-4">
<h1>Azure AD OAuth2 Example</h1>
{{with .Token}}
<div id="displayName"></div>
<a href="/?logout=true">Logout</a>
{{else}}
<a href="{{$.AuthURL}}">Login</a>
{{end}}
</div>
</div>
<script src="https://code.jquery.com/jquery-3.2.1.min.js" integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4=" crossorigin="anonymous"></script>
<script>
{{with .Token}}
var token = {{.}};
$.ajax({
url: 'https://graph.microsoft.com/v1.0/me',
dataType: 'json',
success: function(data, status) {
$('#displayName').text('Welcome ' + data.displayName);
},
beforeSend: function(xhr, settings) {
xhr.setRequestHeader('Authorization', 'Bearer ' + token.access_token);
}
});
{{end}}
</script>
</body>
</html>
`))
func CallbackHandler(w http.ResponseWriter, req *http.Request) error {
session, _ := store.Get(req, "session")
if req.FormValue("state") != SessionState(session) {
return Error{http.StatusBadRequest, "invalid callback state"}
}
form := url.Values{}
form.Set("grant_type", "authorization_code")
form.Set("client_id", clientID)
form.Set("response_type", "code")
form.Set("scope", "offline_access%20user.read")
form.Set("redirect_uri", "http%3A%2F%2Flocalhost%3A8080%2Fcallback")
form.Set("response_mode", "query")
form.Set("state", "12345")
tokenReq, err := http.NewRequest(http.MethodPost, config.Endpoint.TokenURL, strings.NewReader(form.Encode()))
if err != nil {
return fmt.Errorf("error creating token request: %v", err)
}
tokenReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
resp, err := http.DefaultClient.Do(tokenReq)
if err != nil {
return fmt.Errorf("error performing token request: %v", err)
}
defer resp.Body.Close()
if resp.StatusCode >= 400 {
return fmt.Errorf("token response was %s", resp.Status)
}
var token oauth2.Token
if err := json.NewDecoder(resp.Body).Decode(&token); err != nil {
return fmt.Errorf("error decoding JSON response: %v", err)
}
session.Values["token"] = &token
if err := sessions.Save(req, w); err != nil {
return fmt.Errorf("error saving session: %v", err)
}
http.Redirect(w, req, "/", http.StatusFound)
return nil
}
func SessionState(session *sessions.Session) string {
return base64.StdEncoding.EncodeToString(sha256.New().Sum([]byte(session.ID)))
}
func dump(v interface{}) {
spew.Dump(v)
}
【问题讨论】：
-
登录应用程序后，是否在进行
https://graph.windows.net/me?api-version=1.6图形调用？如果是这种情况，我建议您将调用更新为https://graph.microsoft.com/v1.0/me，因为https://graph.windows.net是旧版本，现在已弃用。此外，请确保您已在 Azure AD 中注册的应用程序的 API 权限刀片下添加 Microsoft GraphUser.read权限。 -
得到同样的错误。在 API Permissions 刀片@AmanpreetSingh_msft 下添加了权限
-
您是否也更新了代码？使用浏览器工具（F12 键）在网络选项卡下捕获呼叫，并分享正在发送的确切图形呼叫。
-
更新了代码。已上传使用工具捕获的通话图像。不知道为什么不调用 tokenurl.... @AmanpreetSingh_msft
-
那是因为您正在使用 Authorization_Code 流与 form.Set("response_type", "code")。然后兑换代码以获得访问令牌。如果使用混合流 (docs.microsoft.com/en-us/azure/active-directory/develop/…)，您还可以包含 id_token 或 token。我实际上想在调用 Graph API 并以 401 失败时查看下一个调用。
标签： go authentication azure-active-directory