azure - Oauth 身份验证 token 在 powershell 中失败，但在 Postman 中失败

Question

我的 powershell 脚本中有以下逻辑尝试获取身份验证/不记名 token :

$token = curl --location --request POST 'https://login.microsoftonline.com/$TENANT_ID/oauth2/v2.0/token' `
--form 'grant_type=client_credentials' `
--form 'client_secret=$DEPLOYMENT_CLIENT_SECRET' `
--form 'client_id=$DEPLOYMENT_CLIENT_ID' `
--form 'resource=https://management.azure.com'

我看到的错误:

PS /workspaces/testproject> ./curltest.ps1
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   981  100   419  100   562   1557   2089 --:--:-- --:--:-- --:--:--  3646
===========
{"error":"invalid_request","error_description":"AADSTS901002: The 'resource' request parameter is not supported.\r\nTrace ID: 5b54cd7f-6b2d-40fc-9122-7b3c26a56600\r\nCorrelation ID: asdf-asdf-asdf-asdf-\r\nTimestamp: 2022-05-04 19:22:06Z","error_codes":[901002],"timestamp":"2022-05-04 19:22:06Z","trace_id":"asdf-asdf-asdf-","correlation_id":"asdf-asdf-asdf-asdf-asdf"}
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:--  0:00:01 --:--:--     0^C

所以我像这样删除资源:

$token = curl --location --request POST 'https://login.microsoftonline.com/$TENANT_ID/oauth2/v2.0/token' `
--form 'grant_type=client_credentials' `
--form 'client_secret=$DEPLOYMENT_CLIENT_SECRET' `
--form 'client_id=$DEPLOYMENT_CLIENT_ID' 
#--form 'resource=https://management.azure.com'

但是我现在看到的错误是这样的:

PS /workspaces/testproject> ./curltest.ps1
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1000  100   563  100   437   2025   1571 --:--:-- --:--:-- --:--:--  3597
===========
{"error":"invalid_request","error_description":"AADSTS90014: The required field 'scope' is missing from the credential. Ensure that you have all the necessary parameters for the login request.\r\nTrace ID: asdf-asdf-asdf-asdf-asdf\r\nCorrelation ID: asdf-asdf-asdf-asdf-asdf\r\nTimestamp: 2022-05-04 19:23:11Z","error_codes":[90014],"timestamp":"2022-05-04 19:23:11Z","trace_id":"asdf-asdf-asdf-asdf","correlation_id":"asdf-asdf-asdf-asdf","error_uri":"https://login.microsoftonline.com/error?code=90014"}
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:--  0:00:01 --:--:--     0^C

在 Postman 中，我可以这样做:

我可以添加/删除资源参数。不管怎样，我都会得到一个 token 。租户 ID、客户端 ID 和客户端密码均与 powershell 脚本中使用的内容匹配。
如果我将使用 POSTMAN 生成的 token 插入到脚本中，并使用它来curl GET 调用我自己种植的 azure fn，它就可以工作。

我确信我错过了一些简单的事情。任何帮助将不胜感激

Answer 1

您在 Postman 中看到成功的原因是因为您使用了 2 个不同的端点。

在 Postman 中，您使用的是 v1 端点，https://login.microsoftonline.com/{tenant_id}/oauth2/token

在 PowerShell 中，您使用的是 v2 端点https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token

似乎对于 v2，resource 参数已替换为 scope

尝试将 resource 参数替换为 scope = "https://management.azure.com/.default"

我能够使用 Invoke-RestMethod 获取 token

$params = @{                
    Uri    = "https://login.microsoftonline.com/$($tenant_id)/oauth2/v2.0/token"
    Method = "POST"
    Body   = @{
        client_id     = $client_id
        client_secret = $client_secret
        grant_type    = "client_credentials"
        scope         = "https://management.azure.com/.default"
    }
}
 
$connection = Invoke-RestMethod @params