c# - Dynamics CRM Web api 401 获取 Oauth token 后未经授权

Question

我在向 Dynamics CRM 2016 Web API 发出 HTTP GET 请求以进行概念验证时遇到问题。

我已关注this walk-through创建在 Azure Active Directory 上设置的 Multi-Tenancy Web 应用程序，该应用程序已被授予以组织用户身份访问 Dynamics CRM 的权限。

我用了this example code为了获得访问 token 。这似乎有效，为我提供了看起来像有效 token 的内容。

我使用 token 执行了一个简单的 GET 请求，该请求失败并显示 401 Unauthorized。代码:

class Test
{
    public async Task RunAsync()
    {
        var resource = "https://<snip>.crm4.dynamics.com/api/data/v8.1/";
        var authParams = AuthenticationParameters.CreateFromResourceUrlAsync(new Uri(resource))
            .Result;
        var authorityUrl = authParams.Authority;
        var resourceUrl = authParams.Resource;

        var clientId = "<snip>";
        var client_secret = "<snip>";
        var clientCredential = new ClientCredential(clientId, client_secret);

        var authContext = new AuthenticationContext(authorityUrl, false);
        var token = authContext.AcquireToken(resourceUrl, clientCredential);

        var response = await CallApiAsync($"{resourceUrl}api/data/v8.1/accounts?$select=name&$top=3", token.AccessToken);
        var content = await response.Content.ReadAsStringAsync();

        Console.WriteLine(response.RequestMessage);
        Console.WriteLine(response.Headers);
        Console.WriteLine(response.ReasonPhrase);
        Console.WriteLine(content);
    }

    private async Task<HttpResponseMessage> CallApiAsync(string uri, string token)
    {
        using (var httpClient = new HttpClient())
        {
            httpClient.DefaultRequestHeaders.Authorization =
                new AuthenticationHeaderValue("Bearer", token);
            httpClient.DefaultRequestHeaders.Add("Accept", "application/json");
            httpClient.DefaultRequestHeaders.Add("OData-MaxVersion", "4.0");
            httpClient.DefaultRequestHeaders.Add("OData-Version", "4.0");

            return await httpClient.GetAsync(uri);
        }
    }
}

请求:

Method: GET, RequestUri: 'https://<snip>.crm4.dynamics.com/api/data/v8.1/accounts?$select=name&$top=3', Version: 1.1, Content: <null>, Headers:
{
  Authorization: Bearer <snip>
  Accept: application/json
  OData-MaxVersion: 4.0
  OData-Version: 4.0
} 

回应:

REQ_ID: <snip>
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Tue, 21 Feb 2017 15:08:39 GMT
Set-Cookie: crmf5cookie=<snip>;secure; path=/
Server: Microsoft-IIS/8.5
WWW-Authenticate: Bearer authorization_uri=https://login.windows.net/<snip>/oauth2/authorize,resource_id=https://<snip>.crm4.dynamics.com/
X-Powered-By: ASP.NET

Unauthorized
HTTP Error 401 - Unauthorized: Access is denied

我觉得我错过了一些明显的东西？

Answer 1

没有正在使用的 CRM 组织用户。看看这个Server to Server Auth教程。您需要创建一个应用程序用户。这里有更多关于 Tip of the Day for Server to Server Auth 的评论.

在服务器到服务器身份验证之外，您可以 authenticate as a CRM user using creds this way .