Azure逻辑应用程序无法使用转换后的base64编码的pfx创建客户端证书身份验证

Question

我想通过 Azure 逻辑应用获取 ADP 客户端的 token 信息。我拥有 ADP 的客户端证书，因此我决定使用逻辑应用程序中的 HTTP 触发器并选择身份验证类型“客户端证书”。由于我无法直接在逻辑应用程序中使用证书，因此我将证书转换为 base64Encoded .pfx 格式，并且证书没有任何密码。以下是请求的示例代码

{
    "definition": {
        "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
        "actions": {},
        "contentVersion": "1.0.0.0",
        "outputs": {},
        "triggers": {
            "HTTP": {
                "inputs": {
                    "authentication": {
                        "pfx": "convertedbase64string",
                        "type": "ClientCertificate"
                    },
                    "body": "grant_type=client_credentials&client_id=ClientId&client_secret=client_secret",
                    "headers": {
                        "content-type": "application/x-www-form-urlencoded"
                    },
                    "method": "POST",
                    "uri": "https://accounts.adp.com/auth/oauth/v2/token"
                },
                "recurrence": {
                    "frequency": "Month",
                    "interval": 15
                },
                "type": "Http"
            }
        }
    },
    "kind": "Stateful"
}

上述请求返回了错误的请求，任何人都可以帮助我这里出了什么问题吗？

For converting into base64 I used below steps in power shell
$pfx_cert = get-content 'C:\sample\adpcertificate.pfx' -Encoding Byte
$output =[Convert]::ToBase64String($pfx_cert)
$output

我使用 postman 尝试了与客户端证书相同的请求，该请求工作正常，但无法使用逻辑应用程序获得成功。

非常感谢任何帮助。

Answer 1

从 Postman 和逻辑应用程序发送的 header 之间只有很少的差异。主要区别在于，Postman 还发送接受 header :"Accept": "*/*" 并从逻辑中省略所有 x-ms-* header 应用程序。

我使用 http-trigger 创建了一个逻辑应用程序，我从 Postman 和逻辑应用程序发布到该逻辑应用程序以检查更改:

与 postman

{
    "headers": {
        "Connection": "keep-alive",
        "Accept": "*/*",
        "Accept-Encoding": "br,gzip,deflate",
        "Host": "....westeurope.logic.azure.com:443",
        "User-Agent": "PostmanRuntime/7.28.4",
        "Postman-Token": "...-baea-4e89-9bf6-490a63968b5d",
        "Content-Length": "76",
        "Content-Type": "application/x-www-form-urlencoded"
    },
    "body": {
        "$content-type": "application/x-www-form-urlencoded",
        "$content": "Z3JhbnRfdHlwZT1jbGllbnRfY3JlZGVudGlhbHMmY2xpZW50X2lkPUNsaWVudElkJmNsaWVudF9zZWNyZXQ9Y2xpZW50X3NlY3JldA==",
        "$formdata": [
            {
                "key": "grant_type",
                "value": "client_credentials"
            },
            {
                "key": "client_id",
                "value": "ClientId"
            },
            {
                "key": "client_secret",
                "value": "client_secret"
            }
        ]
    }
}

使用逻辑应用

{
    "headers": {
        "Connection": "Keep-Alive",
        "Accept-Encoding": "gzip,deflate",
        "Accept-Language": "en",
        "Host": "...westeurope.logic.azure.com",
        "User-Agent": "azure-logic-apps/1.0,(workflow ...; version ...)",
        "x-ms-trigger-callback-url": "https://....westeurope.logic.azure.com/ <...>",
        "x-ms-trigger-type": "Http",
        "x-ms-workflow-id": "...",
        "x-ms-workflow-version": "...",
        "x-ms-workflow-name": "myworkflowname",
        "x-ms-workflow-system-id": "/locations/westeurope/scaleunits/...",
        "x-ms-workflow-run-id": "...",
        "x-ms-workflow-operation-name": "HTTP",
        "x-ms-execution-location": "westeurope",
        "x-ms-workflow-subscription-id": "...",
        "x-ms-workflow-resourcegroup-name": "..",
        "x-ms-tracking-id": "...",
        "x-ms-correlation-id": "...",
        "x-ms-client-request-id": "...",
        "x-ms-activity-vector": "...",
        "Content-Length": "76",
        "Content-Type": "application/x-www-form-urlencoded"
    },
    "body": {
        "$content-type": "application/x-www-form-urlencoded",
        "$content": "Z3JhbnRfdHlwZT1jbGllbnRfY3JlZGVudGlhbHMmY2xpZW50X2lkPUNsaWVudElkJmNsaWVudF9zZWNyZXQ9Y2xpZW50X3NlY3JldA==",
        "$formdata": [
            {
                "key": "grant_type",
                "value": "client_credentials"
            },
            {
                "key": "client_id",
                "value": "ClientId"
            },
            {
                "key": "client_secret",
                "value": "client_secret"
            }
        ]
    }
}

解决方案

我的解决方案是在逻辑应用程序的发布请求中手动添加 Accept-Header。

"headers": {
        "Accept": "*/*",
        // ...
    },

遗憾的是，我没有 ADP 帐户来验证这一点，但我发现其他 API 在未发送接受 header 时会崩溃。