php - graph.microsoft.com 收到错误请求响应，缺少 UPN 和 PUID 声明

Question

我们正在尝试使用 Office 365 统一 API 向 graph.microsoft.com 发出请求。

身份验证成功，但访问 token 缺少 UPN 和 PUID，这意味着针对 https://graph.microsoft.com/beta/me 的请求失败。

验证码:

$code = $_GET['code'];
//build the request body
$tokenRequestBody = "grant_type=authorization_code&" .
    "redirect_uri=" . '<redirectURI>' . "&" .
    "client_id=" . '<cliendId>' . "&" .
    "client_secret=" . urlencode('<clientsecret>') . "&" .
    "resource=" . 'https://graph.microsoft.com' . "&" .
    "code=" . $code;


$request = curl_init("https://login.microsoftonline.com/0e06e1f9-24b3-4026-8bd0-2a6c28937df1/oauth2/token");
curl_setopt($request, CURLOPT_POST, 1);
curl_setopt($request, CURLOPT_POSTFIELDS, $tokenRequestBody);
curl_setopt($request, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));

curl_setopt($request, CURLOPT_RETURNTRANSFER, true);

$tokenOutput = curl_exec($request);
$token = json_decode($tokenOutput);

图形请求代码:

    $path = "https://graph.microsoft.com/beta/me";

    //perform a REST query for the user
    $request = curl_init($path);
    curl_setopt($request, CURLOPT_HTTPHEADER, array(
        "Authorization: Bearer ".$token->access_token
    ,
        "Accept: application/json"));

    curl_setopt($request, CURLOPT_RETURNTRANSFER, true);
    $response = curl_exec($request);

解码后的访问 token :

{
 typ: "JWT",
 alg: "RS256",
 x5t: "MnC_VZcATfM5pOYiJHMba9goEKY",
 kid: "MnC_VZcATfM5pOYiJHMba9goEKY"
}.
{
 aud: "https://graph.microsoft.com",
 iss: "https://sts.windows.net/0e06e1f9-24b3-4026-8bd0-2a6c28937df1/",
 iat: 1447345801,
 nbf: 1447345801,
 exp: 1447349701,
 acr: "1",
 altsecid: "1:live.com:0003BFFD977FF496",
 amr: [
  "pwd"
 ],
 appid: "<appid>",
 appidacr: "1",
 email: "<emailaddress>",
 family_name: "<familyname>",
 given_name: "<givenname>",
 idp: "live.com",
 ipaddr: "<ipaddress>",
 scp: "Calendars.Read Calendars.ReadWrite Contacts.Read Contacts.ReadWrite Directory.AccessAsUser.All Directory.Read.All Directory.ReadWrite.All Files.Read Files.Read.Selected Files.ReadWrite Files.ReadWrite.Selected Group.Read.All Group.ReadWrite.All Mail.Read Mail.ReadWrite Mail.Send Notes.Create Notes.Read Notes.Read.All Notes.ReadWrite Notes.ReadWrite.All Notes.ReadWrite.CreatedByApp offline_access openid People.Read People.ReadWrite Sites.Read.All Sites.ReadWrite.All User.Read User.Read.All User.ReadBasic.All User.ReadWrite User.ReadWrite.All",
 sub: "5je0Jdv8442iS3rLXa-3a7KWSiKCyBrq9Q0c0d4sbBY",
 tid: "0e06e1f9-24b3-4026-8bd0-2a6c28937df1",
 unique_name: "<uniquename>",
 ver: "1.0"
}.
[signature]

图形请求响应:

{
  "error": {
    "code": "BadRequest",
    "message": "Missing UPN and PUID claims.",
    "innerError": {
      "request-id": "158c62f6-fece-4f64-bbb5-a1e691334daa",
      "date": "2015-11-12T14:09:40"
    }
  }
}

希望得到一些帮助!提前致谢。

Answer 1

您可以检查以下几点来进行故障排除:

1、在您的AD应用程序面板中，单击“USERS”选项卡，检查该用户是否在您的Azure AD中。

2、请检查从on-promise AD或Office 365同步用户到Azure AD的过程是否成功。您可以使用office 365帐户登录Azure门户，首次登录Azure门户时会自动添加到Azure AD中。此外，如果出现错误或 UPN 存在冲突，您可能会遇到此错误。

您可以在 Powershell 中尝试以下脚本，添加您的应用程序服务主体并为您的应用程序设置角色:

#-----------------------------------------------------------
# This will add your Application Service Prinicpal to 
# the Company Administrator role
#-----------------------------------------------------------
$msolcred=get-credential
connect-msolservice -credential $msolcred

$ClientIdWebApp = 'Your application client id'
$webApp = Get-MsolServicePrincipal –AppPrincipalId $ClientIdWebApp

#use Add-MsolRoleMember to add it to “Company Administrator” role).
Add-MsolRoleMember -RoleName "Company Administrator" -RoleMemberType ServicePrincipal -RoleMemberObjectId $webApp.ObjectId 

您可以引用Manage Azure AD service principals有关如何使用 Azure AD Powershell 的详细信息。

另外，您可以引用Deep Dive into the Office 365 Unified API集成 Office 365，并检查第一部分提到的先决条件。