azure - 对于看似有效的 `invalid_token` 调用，出现 `/messages` 错误

Question

在 https://outlook.office.com/api/v2.0/me/messages 上执行 GET 时，出现奇怪的 invalid_token 错误 即使我提供的 access_token 是新鲜且有效的。

#<Faraday::Response:0x007f842a55d9c0 @on_complete_callbacks=[], @env=#<Faraday::Env @method=:get @body="" @url=#<URI::HTTPS https://outlook.office.com/api/v2.0/me/messages> @request=#<Faraday::RequestOptions (empty)> @request_headers={"User-Agent"=>"Faraday v0.9.2", "Authorization"=>"Bearer XXXXX_my_access_code_goes_hereXXXXX"} @ssl=#<Faraday::SSLOptions verify=true> @response=#<Faraday::Response:0x007f842a55d9c0 ...> @response_headers={"content-length"=>"0", "server"=>"Microsoft-IIS/8.5", "set-cookie"=>"exchangecookie=da79bef43acf4d1aa5f0bb00988f6629; expires=Sat, 09-Sep-2017 18:34:51 GMT; path=/; HttpOnly", "www-authenticate"=>"Bearer client_id=\"my_client_id\", trusted_issuers=\"00000001-0000-0000-c000-000000000000@*\", token_types=\"app_asserted_user_v1 service_asserted_app_v1\", authorization_uri=\"https://login.windows.net/common/oauth2/authorize\", error=\"invalid_token\",Basic Realm=\"\",Basic Realm=\"\",Basic Realm=\"\"", "request-id"=>"28ed7077-b92c-470a-b062-0f5f2a54d74a", "x-calculatedfetarget"=>"DM3PR12CU001.internal.outlook.com", "x-backendhttpstatus"=>"401, 401", "x-feproxyinfo"=>"DM3PR12CA0039.NAMPRD12.PROD.OUTLOOK.COM", "x-calculatedbetarget"=>"DM2PR12MB0315.namprd12.prod.outlook.com", "x-ms-diagnostics"=>"2000010;reason=\"ErrorCode: 'PP_E_RPS_CERT_NOT_FOUND'. Message: 'Certificate cannot be found. Certificate required for the operation cannot be found.%0d%0a Internal error: spRPSTicket->ProcessToken failed.'\";error_category=\"invalid_msa_ticket\"", "x-diaginfo"=>"DM2PR12MB0315", "x-beserver"=>"DM2PR12MB0315", "x-feserver"=>"DM3PR12CA0039, BY1PR13CA0015", "x-powered-by"=>"ASP.NET", "x-msedge-ref"=>"Ref A: A8A103D34AD84EC089A59EFDA0AF5385 Ref B: 740314A1C3A73205090D30CCB559AAA0 Ref C: Fri Sep  9 11:34:51 2016 PST", "date"=>"Fri, 09 Sep 2016 18:34:50 GMT", "connection"=>"close"} @status=401>>

Answer 1

我找到了答案。显然，范围 https://graph.microsoft.com/mail.read (我请求的)与 https://outlook.office.com/mail.read 不同。当我切换到在范围内使用 outlook.office.com 后，我的 API 调用也开始工作。