如何获取 client_assertion 字符串

Question

我已经用 C++ 编写了 EWS 应用程序。目前支持Basic和NTLM认证，现在尝试支持OAuth认证

由于它是 C++ 应用程序，我不能使用 .NET AcquireToken，所以我需要发布以下 OAuth 身份验证请求

POST https://login.microsoftonline.com/b9bd2162xxx/oauth2/tokenHTTP/1.1

内容类型：application/x-www-form-urlencoded

resource=https://tailspin.onmicrosoft.com/surveys.webapi

&client_id=87df91dc-63de-4765-8701-b59cc8bd9e11

&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer

&client_assertion=eyJhbGci...

&grant_type=authorization_code

所以我的问题是，如果我正在构建请求，我怎样才能获得 client_assertion 字符串？是否有任何 API\开源库可以使用 .pfx\X.509 证书获取此字符串？

Answer 1

根据grant_type 的值，您使用的是授权码授予流程。此流程用于交互式应用程序。如果您要使用此流程，则无需提供client_assertion 和client_assertion_type。

您可以参考以下有关此流程的请求。

1.请求授权码：

https://login.microsoftonline.com/{tenant}/oauth2/authorize?
client_id=6731de76-14a6-49ae-97bc-6eba6914391e
&response_type=code
&redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F
&response_mode=query
&resource=https%3A%2F%2Fservice.contoso.com%2F
&state=12345

2.使用授权码请求访问令牌：

POST /{tenant}/oauth2/token HTTP/1.1
Host: https://login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded
grant_type=authorization_code
&client_id=2d4d11a2-f814-46a7-890a-274a72a7309e
&code=AwABAAAAvPM1KaPlrEqdFSBzjqfTGBCmLdgfSTLEMPGYuNHSUYBrqqf_ZT_p5uEAEJJ_nZ3UmphWygRNy2C3jJ239gV_DBnZ2syeg95Ki-374WHUP-i3yIhv5i-7KU2CEoPXwURQp6IVYMw-DjAOzn7C3JCu5wpngXmbZKtJdWmiBzHpcO2aICJPu1KvJrDLDP20chJBXzVYJtkfjviLNNW7l7Y3ydcHDsBRKZc3GuMQanmcghXPyoDg41g8XbwPudVh7uCmUponBQpIhbuffFP_tbV8SNzsPoFz9CLpBCZagJVXeqWoYMPe2dSsPiLO9Alf_YIe5zpi-zY4C3aLw5g9at35eZTfNd0gBRpR5ojkMIcZZ6IgAA
&redirect_uri=https%3A%2F%2Flocalhost%2Fmyapp%2F
&resource=https%3A%2F%2Fservice.contoso.com%2F
&client_secret=p@ssw0rd

//NOTE: client_secret only required for web apps

有关此流程的更多详细信息，请参阅以下文档：

Authorize access to web applications using OAuth 2.0 and Azure Active Directory

更新

string clientId = "";
string thumbprint = "";
X509Certificate2 cert = GetCertificate(thumbprint);
string resource = "";

string authority = "https://login.microsoftonline.com/{tenant}";
AuthenticationContext authContext = new AuthenticationContext(authority);
var resoult=  authContext.AcquireTokenAsync(resource, new ClientAssertionCertificate(clientId, cert)).Result;
Console.WriteLine(resoult.AccessToken);