javascript - AADSTS50058 : A silent sign-in request was sent but no user is signed in

Question

我正在使用 hello.js 登录 Microsoft Graph。

首先我初始化了

hello.init({
    msft: {
      id: myAppId,
      oauth: {
        version: 2,
        auth: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize'
      },
      scope_delim: ' ',
      form: false
    },
  },
  { redirect_uri: window.location.href }
);

然后我在我的应用程序中成功登录

hello('msft').login({ scope: 'User.Read' })

这是 hello.js 登录后保存在 localStorage 中的内容。

{
  "msft": {
  "access_token":"aLongToken",
    "token_type":"Bearer",
    "expires_in":3599,
    "scope":"basic,User.Read",
    "state":"",
    "session_state":"f034f785-f8d0-4cec-aab4-88559c9d93dd",
    "client_id":"a91e6907-2b6e-4793-848d-633e960e809d",
    "network":"msft",
    "display":"popup",
    "redirect_uri":"http://localhost:3006/login",
    "expires":1501800737.361
  }
}

但是，当我尝试刷新 access_token 时

hello('msft').login({
  display: 'none',
  response_type: 'id_token token',
  response_mode: 'fragment',
  nonce: 'my-app',
  prompt: 'none',
  scope: 'User.Read',
  login_hint: 'Rose.Bukater@company.com',
  domain_hint: 'organizations'
})

我得到了错误

AADSTS50058: A silent sign-in request was sent but no user is signed in. The cookies used to represent the user's session were not sent in the request to Azure AD. This can happen if the user is using Internet Explorer or Edge, and the web app sending the silent sign-in request is in different IE security zone than the Azure AD endpoint (login.microsoftonline.com).

我正在使用 Chrome。

找到 this issue在 GitHub 上。但是还是没搞清楚怎么正确刷新。

---

更新:

在 https://apps.dev.microsoft.com 禁用允许隐式流之后，现在我什至无法登录。所以这不是正确的解决方案。 hello.js 在 localStorage 中保存了这个错误:

{
  "msft": {
    "error": {
      "code":"unsupported_response_type",
      "message":"AADSTS70005: response_type 'token' is not enabled for the application\r\nTrace ID: 1dc20dd0-cab3-41b5-9849-2a7e35d60700\r\nCorrelation ID: caacce8f-6763-405d-a840-70c24d5306d4\r\nTimestamp: 2017-08-04 21:56:42Z"
    },
    "error_description":"AADSTS70005: response_type 'token' is not enabled for the application\r\nTrace ID: 1dc20dd0-cab3-41b5-9849-2a7e35d60700\r\nCorrelation ID: caacce8f-6763-405d-a840-70c24d5306d4\r\nTimestamp: 2017-08-04 21:56:42Z",
    "state":"",
    "client_id":"a91e6907-2b6e-4793-848d-633e960e809d",
    "network":"msft",
    "display":"popup",
    "redirect_uri":"http://localhost:3006/login",
    "scope":"basic,User.Read"
  }
}

Answer 1

当当前为 login.microsoftonline.com 连接的用户的 cookie 已过期时，就会发生这种情况。我们处理它的方式是将用户重定向到以当前页面作为 redirecturi 参数的登录页面。