java - 尝试使用 java 实现 Azure AD 身份验证时出现异常

Question

我正在使用用户名-密码流程来获取 token 。下面是我的示例代码:

public class UsernamePasswordFlowTest {

private static String authority;
private static Set<String> scope;
private static String clientId;
private static String username;
private static String password;
public static void main(String args[]) throws Exception {

    setUpSampleData();

    PublicClientApplication pca = PublicClientApplication.builder(clientId)
            .authority(authority)
            .build();

    //Get list of accounts from the application's token cache, and search them for the configured username
    //getAccounts() will be empty on this first call, as accounts are added to the cache when acquiring a token
    Set<IAccount> accountsInCache = pca.getAccounts().join();
    IAccount account = getAccountByUsername(accountsInCache, username);

    //Attempt to acquire token when user's account is not in the application's token cache
    IAuthenticationResult result = acquireTokenUsernamePassword(pca, scope, account, username, password);
    System.out.println("Account username: " + result.account().username());
    System.out.println("Access token:     " + result.accessToken());
    System.out.println("Id token:         " + result.idToken());
    System.out.println();

    accountsInCache = pca.getAccounts().join();
    account = getAccountByUsername(accountsInCache, username);

    //Attempt to acquire token again, now that the user's account and a token are in the application's token cache
    result = acquireTokenUsernamePassword(pca, scope, account, username, password);
    System.out.println("Account username: " + result.account().username());
    System.out.println("Access token:     " + result.accessToken());
    System.out.println("Id token:         " + result.idToken());
}

private static IAuthenticationResult acquireTokenUsernamePassword(PublicClientApplication pca,
                                                                  Set<String> scope,
                                                                  IAccount account,
                                                                  String username,
                                                                  String password) throws Exception {
    IAuthenticationResult result;
    try {
        SilentParameters silentParameters =
                SilentParameters
                        .builder(scope)
                        .account(account)
                        .build();
        // Try to acquire token silently. This will fail on the first acquireTokenUsernamePassword() call
        // because the token cache does not have any data for the user you are trying to acquire a token for
        result = pca.acquireTokenSilently(silentParameters).join();
        System.out.println("==acquireTokenSilently call succeeded");
    } catch (Exception ex) {
        if (ex.getCause() instanceof MsalException) {
            System.out.println("==acquireTokenSilently call failed: " + ex.getCause());
            UserNamePasswordParameters parameters =
                    UserNamePasswordParameters
                            .builder(scope, username, password.toCharArray())
                            .build();
            // Try to acquire a token via username/password. If successful, you should see
            // the token and account information printed out to console
            result = pca.acquireToken(parameters).join();
            System.out.println("==username/password flow succeeded");
        } else {
            // Handle other exceptions accordingly
            throw ex;
        }
    }
    return result;
}

/**
 * Helper function to return an account from a given set of accounts based on the given username,
 * or return null if no accounts in the set match
 */
private static IAccount getAccountByUsername(Set<IAccount> accounts, String username) {
    if (accounts.isEmpty()) {
        System.out.println("==No accounts in cache");
    } else {
        System.out.println("==Accounts in cache: " + accounts.size());
        for (IAccount account : accounts) {
            if (account.username().equals(username)) {
                return account;
            }
        }
    }
    return null;
}

/**
 * Helper function unique to this sample setting. In a real application these wouldn't be so hardcoded, for example
 * values such as username/password would come from the user, and different users may require different scopes
 */
private static void setUpSampleData() throws IOException {
    authority = "https://login.microsoftonline.com/{tenantId}"; // tenantid = xxxxxxxx
    scope = Collections.singleton("user.read");
    clientId = "ebxxxx1c-e1xxx-4xxx-bxxx-dxxxxeaxxxx";
    username = "testuser";
    password = "xxxx";
}

}

但出现异常:

com.microsoft.aad.msal4j.MsalClientException:在缓存中找不到 token 在 com.microsoft.aad.msal4j.AcquireTokenSilentSupplier.execute(AcquireTokenSilentSupplier.java:98)在 com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:59)在 com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:17)在 java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1700)

原因:com.microsoft.aad.msal4j.MsalServiceException:未知服务异常。 HTTP 请求返回状态码 404，无响应正文在 com.microsoft.aad.msal4j.MsalServiceExceptionFactory.fromHttpResponse(MsalServiceExceptionFactory.java:52)在 com.microsoft.aad.msal4j.UserDiscoveryRequest.execute(UserDiscoveryRequest.java:34)在 com.microsoft.aad.msal4j.AcquireTokenByAuthorizationGrantSupplier.processPasswordGrant(AcquireTokenByAuthorizationGrantSupplier.java:91)

有人可以帮助我理解这个异常吗？

Answer 1

com.microsoft.aad.msal4j.MsalServiceException

如果您的应用程序未在 Azure AD 中注册为公共(public)客户端应用程序，则可能会引发此异常。在 Azure 门户中，编辑应用程序的 list 并将 allowPublicClient 设置为 true。

还要检查指定的 client_secret 与该客户端的预期值不匹配。更正 client_secret 并重试。

当库或设备本地发生错误时，会引发

MsalClientException。

更多详情请引用此document

您可以按照 Github 中的以下代码示例进行操作:https://github.com/Azure-Samples/ms-identity-java-desktop/blob/master/Username-Password-Flow/README.md