java - AADSTS50011 回复地址未使用安全方案[AZURE]

Question

我正在关注本教程 https://dev.outlook.com/restapi/tutorial/java以便逐步完成创建用于检索 Office 365 或 Outlook.com 中的消息的简单 Java Spring MVC 应用程序的过程。

到目前为止我做了什么:

• 在 AZURE-365-MAIL-API 注册上注册了我们的应用程序
• 在我的应用程序中使用了appId、appPassword 和redirectUrl 并发出了请求。

这里是 Controller 类:

@RestController
@RequestMapping("/auth")
public class AuthorizeController {

@RequestMapping(value = "/authorize", method = RequestMethod.GET)
public JasonMessage authorize(
        @RequestParam("code") String code,
        @RequestParam("id_token") String idToken,
        @RequestParam("state") UUID state,
        HttpServletRequest request) {
    {
        // Get the expected state value from the session
        HttpSession session = request.getSession();
        UUID expectedState = (UUID) session.getAttribute("expected_state");
        UUID expectedNonce = (UUID) session.getAttribute("expected_nonce");

        // Make sure that the state query parameter returned matches
        // the expected state
        if (state.equals(expectedState)) {
            session.setAttribute("authCode", code);
            session.setAttribute("idToken", idToken);
        } else {
            session.setAttribute("error", "Unexpected state returned from authority.");
        }

        JasonMessage jasonMessage= new JasonMessage();
        jasonMessage.setStatus("success");
        jasonMessage.setData("id_token",idToken);
        jasonMessage.setData("code",code);
        jasonMessage.setData("state",state);
        return jasonMessage;
    }

}

}

这也是入口点:

@RestController
@RequestMapping("/office365")
public class IndexController {

@RequestMapping(value = "/service/mail",
        method = RequestMethod.GET)
public void Office365(Model model, HttpServletRequest request, HttpServletResponse response) {
    UUID state = UUID.randomUUID();
    UUID nonce = UUID.randomUUID();

    // Save the state and nonce in the session so we can
    // verify after the auth process redirects back
    HttpSession session = request.getSession();
    session.setAttribute("expected_state", state);
    session.setAttribute("expected_nonce", nonce);

    String loginUrl = AuthHelper.getLoginUrl(state, nonce);
    model.addAttribute("loginUrl", loginUrl);




    try {
         response.sendRedirect(loginUrl);
    } catch (IOException e) {
        e.printStackTrace();

    }
}



public class AuthHelper {


private static final String authority = "https://login.microsoftonline.com";
private static final String authorizeUrl = authority + "/common/oauth2/v2.0/authorize";

private static String[] scopes = {
        "openid",
        "offline_access",
        "profile",
        "https://outlook.office.com/mail.read"
};

private static String appId = "9489e4b5-875d-4bd7-924b-88b3b562ccc7";
private static String appPassword = "0uPnh7gJi86eSWWwr6E2M3F";
private static String redirectUrl = "http://localhost:8080/controller/auth/authorize";

private static String getAppId() {
    if (appId == null) {
        try {
            loadConfig();
        } catch (Exception e) {
            return null;
        }
    }
    return appId;
}
private static String getAppPassword() {
    if (appPassword == null) {
        try {
            loadConfig();
        } catch (Exception e) {
            return null;
        }
    }
    return appPassword;
}

private static String getRedirectUrl() {
    if (redirectUrl == null) {
        try {
            loadConfig();
        } catch (Exception e) {
            return null;
        }
    }
    return redirectUrl;
}

private static String getScopes() {
    StringBuilder sb = new StringBuilder();
    for (String scope: scopes) {
        sb.append(scope + " ");
    }
    return sb.toString().trim();
}

private static void loadConfig() throws IOException {
    String authConfigFile = "auth.properties";
    InputStream authConfigStream = AuthHelper.class.getClassLoader().getResourceAsStream(authConfigFile);

    if (authConfigStream != null) {
        Properties authProps = new Properties();
        try {
            authProps.load(authConfigStream);
            appId = authProps.getProperty("appId");
            appPassword = authProps.getProperty("appPassword");
            redirectUrl = authProps.getProperty("redirectUrl");
        } finally {
            authConfigStream.close();
        }
    }
    else {
        throw new FileNotFoundException("Property file '" + authConfigFile + "' not found in the classpath.");
    }
}

public static String getLoginUrl(UUID state, UUID nonce) {

    UriComponentsBuilder urlBuilder = UriComponentsBuilder.fromHttpUrl(authorizeUrl);
    urlBuilder.queryParam("client_id", getAppId());
    urlBuilder.queryParam("redirect_uri", getRedirectUrl());
    urlBuilder.queryParam("response_type", "code id_token");
    urlBuilder.queryParam("scope", getScopes());
    urlBuilder.queryParam("state", state);
    urlBuilder.queryParam("nonce", nonce);
    urlBuilder.queryParam("response_mode", "form_post");

    return urlBuilder.toUriString();
}

}

入口网址:localhost:8080/controller/office365/service/mail我相信问题出在我们的重定向网址上，即 http://localhost:8080/controller/auth/authorize .

这是错误:回复地址'http://localhost:8080/controller/auth/authorize '没有使用安全方案。**

我们的应用程序需要身份验证，因此在使用条目 url 之前，我手动登录到我们的应用程序，然后点击条目 url。我是否需要以不需要身份验证的方式放置回复网址？如果是这种情况，我可以简单地修改 web.xml 并创建一个类来绕过身份验证。如果这不是问题，我将非常感谢您的帮助。

我也尝试过使用 HTTPS，但它导致了另一个错误。

谢谢!

Answer 1

Azure 不会将授权请求重定向到非 HTTPS URL。本地主机是唯一的异常(exception)。您需要使用 HTTPS 保护您的网站，并确保您提供的重定向是 HTTPS。