azure - 尝试为 Azure 设置 OAuth2，出现错误而不是登录页面

Question

Error: AADSTS90002: Requested tenant identifier '${azuretenantid}' is not valid.

Address of redirection https://login.microsoftonline.com/$%7BazureTenantId%7D/oauth2/authorize?resource=https://graph.windows.net&client_id=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&redirect_uri=http://localhost:8084/login&response_type=code&scope=profile&state=wTeKZ1

配置

   azure:  
     enabled: true   
     accounts:  
     - name: exp  
       requiredGroupMembership: []  
       providerVersion: V1  
       clientId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx  
       appKey: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx  
       tenantId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx  
       subscriptionId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx  
       defaultResourceGroup: spinnakerk8s  
       defaultKeyVault: KeyVault



   authn:  
     oauth2:  
       enabled: true  
       client:  
         clientId: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx  
         clientSecret: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx  
         accessTokenUri:   https://login.microsoftonline.com/${azuretenantid}/oauth2/token  
         userAuthorizationUri: https://login.microsoftonline.com/${azuretenantid}/oauth2/authorize?resource=https://graph.windows.net  
         clientAuthenticationScheme: query  
         scope: profile  
       resource:  
         userInfoUri: https://graph.windows.net/me?api-version=1.6  
       userInfoMapping:  
         email: userPrincipalName  
         firstName: givenName  
         lastName: surname  
       provider: AZURE

尝试的解决方案:将 accessTokenUri 地址更正为 https://login.microsoftonline.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/oauth2/token
userAuthorizationUri:https://login.microsoftonline.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/oauth2/authorize?resource=https://graph.windows.net

同样的更正，但改为 ${azure_tenant_id} 以匹配 azure-linux.json 变量

减少 Spinnaker 版本 1.5.0 尝试所有更改

手动更改错误页面地址以包含租户 ID 页面，正确拉起登录页面

结果:尽管发生了更改，地址始终会被更正以包含 ${azuretenantid} ，其中错误预期结果:重定向到登录页面

Answer 1

很明显，您的变量 ${azuretenantid} 在 URL 字符串中没有被替换。

您应该检查是否使用正确的语法将该变量替换为正确的 Azure 租户 ID。

否则，您可以将 ${azuretenantid} 替换为 common，并使用公共(public)端点尝试自动发现给定用户的正确租户。查看有关公共(public)端点 here 的更多详细信息.