c# - 使用 Exchange 服务和 OAuth 订阅推送通知时出现 401 Unauthorized

Question

我正在尝试使用 oauth 访问 EWS 托管 API(订阅推送通知)，如下所示:

var authenticationTask = await authenticationContext.AcquireTokenAsync("https://outlook.office365.com", new ClientCredential(clientID, clientSecret));
string targetSmtp = "user123@mydomain.onmicrosoft.com";
ExchangeService exchangeService = new ExchangeService(ExchangeVersion.Exchange2013);
exchangeService.Url = someURL;
exchangeService.TraceEnabled = true;
exchangeService.TraceFlags = TraceFlags.All;
exchangeService.ImpersonatedUserId = new ImpersonatedUserId(ConnectingIdType.PrincipalName, "user123@mydomain.onmicrosoft.com");
exchangeService.HttpHeaders.Add("X-AnchorMailbox", targetSmtp);
exchangeService.Credentials = new OAuthCredentials(authenticationTask.AccessToken);
PushSubscription subscription = exchangeService.SubscribeToPushNotifications(
                                            new[] { someFolder },
                                            new Uri(postBackUrl),
                                            15,
                                            null,
                                            EventType.NewMail,
                                            EventType.Created,
                                            EventType.Deleted,
                                            EventType.Modified,
                                            EventType.Moved,
                                            EventType.Copied);

我能够为我的应用程序获取 token ，但在为用户 (user123@mydomain.onmicrosoft.com) 订阅推送通知时，我收到 “请求失败。远程服务器返回错误:(401)未经授权。” 错误

更新:尝试按照此处提到的完全相同的步骤进行操作:Azure AD app-only access tokens for exchange impersonation但仍然收到 401。

Ashish

Answer 1

对于那些遇到同样问题的人，我们需要使用证书(而不是使用客户端 key )获取已注册应用程序的访问 token 。有关如何操作的更多详细信息，请参阅:https://blogs.msdn.microsoft.com/exchangedev/2015/01/21/building-daemon-or-service-apps-with-office-365-mail-calendar-and-contacts-apis-oauth2-client-credential-flow/