sharepoint - 使用 Office 365 OAuth API 对 SharePoint 端点进行身份验证

Question

我正在尝试使用提到的 Office 365 API 访问共享点在线站点 here我正在获取授权 token 并调用发现服务，如下所示:

httpClient = new HttpClient();
httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", authResult.AccessToken);
httpClient.DefaultRequestHeaders.Add("Accept", "application/json; odata=verbose");
response = await httpClient.GetAsync(new Uri("https: / /api.office.com/discovery/me/services"));
data = await response.Content.ReadAsStringAsync();

我在结果中得到以下类型的端点 URL:

1. OneDrive
   https://sometenant-my.sharepoint.com/personal/sometenant_data_onmicrosoft_com/_api

2. 与 Outlook 相关
   https://outlook.office365.com/api/v1.0

我没有在结果中获得 SharePoint 的任何端点 URL。如果我尝试以下代码:

 httpClient = new HttpClient();
 httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", authResult.AccessToken);
 httpClient.DefaultRequestHeaders.Add("Accept", "application/json; odata=verbose");
 response = await httpClient.GetAsync("https://sometenant.sharepoint.com/_api/web/lists/getByTitle('Documents')/items");
 data = await response.Content.ReadAsStringAsync();

我在响应流中得到以下信息:

"{\"error\":\"invalid_client\",\"error_description\":\"Invalid audience Uri 'Microsoft.SharePoint'.\"}"

响应中的错误是:

{StatusCode: 401, ReasonPhrase: 'Unauthorized', Version: 1.1, Content: System.Net.Http.StreamContent, Headers:
{
  x-ms-diagnostics: 3000003;reason="Invalid audience Uri 'Microsoft.SharePoint'.";category="invalid_client"
  SPRequestGuid: 8462cf9c-c093-1000-a3da-fc5e1aab16c1
  request-id: 8462cf9c-c093-1000-a3da-fc5e1aab16c1
  SPRequestDuration: 37
  SPIisLatency: 25
  MicrosoftSharePointTeamServices: 16.0.0.3431
  X-Content-Type-Options: nosniff
  X-MS-InvokeApp: 1; RequireReadOnly
  Date: Mon, 24 Nov 2014 22:45:46 GMT
  P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
  Server: Microsoft-IIS/7.5
  WWW-Authenticate: Bearer realm="xxxxxx-xxxx-xxxxx-xxxx-xxxxxxxx",client_id="xxxxxxxx-xxx-xxxx-xxxx-000000000000",trusted_issuers="xxxxxxx-xxxx-xxx-xxx-000000000000@*,https : // sts.windows.net/*/,00000003-0000-xxxxx-ce00-000000000000@xxxxxxxx-xxxxx-11e1-xxxx-xxxxxxx",authorization_uri="https://login.windows.net/common/oauth2/authorize"
  X-Powered-By: ASP.NET
  Content-Length: 93
}}

我相信我应该能够使用 Office 365 API 访问 SharePoint 数据。

我已授予应用对所有网站集权限的完全控制权。

如果我在这里遗漏了什么，请告知。

Answer 1

您最初尝试获取access_token 时的目标 URL 与 SharePoint 所需的不同。我不知道为什么，Office365 access_token 对于 SharePoint 来说似乎是合乎逻辑的，但事实并非如此。

所以我假设您在 SharePoint 注册应用程序中有 client_id 和 client_secret。如果没有，您可以通过两种方式注册新的应用程序:

1. https://{your tenantID}.sharepoint.com/_layouts/15/appregnew.aspx

(出于某种原因，Azure ACS 在尝试获取 acess_token 时未验证此处生成的 client_secret，至少对我而言不是。所以我尝试了下面的方法)

2. Login to your azure management portal and go to :

active directory (left side bottom) > default directory (if you don't have any previously) > Application > Add

这里填写你的应用的详细信息，APP ID URI = 'https://{your tenantID}.sharepoint.com/' 并在底部的“permissions to other applications ”不要忘记添加应用程序 > Office 365 SharePoint Online

获取授权码:

https://{tenantID}.sharepoint.com/_layouts/oauthauthorize.aspx?client_id={ur client id}&scope=Web.Read&response_type=code&redirect_uri=https%3A%2F%2Flocalhost%2F

在 chrome 中输入上面的 url 并输入，您将被重定向到上面指定的 url。你最终会在

"https://localhost/?code={authorization code}"

复制授权码

获取承载域:

GET 请求

https://{your tenantID}.sharepoint.com/_vti_bin/client.svc

授权:承载( header )

从响应头中获取Bearer realm组件并保存。

获取访问 token :

POST 请求

https://accounts.accesscontrol.windows.net/{bearer realm}/tokens/OAuth/2

和 body 参数

grant_type=authorization_code&client_id={ur client id}&client_secret={ur client secret}&code={auth code that you got from the step above}&redirect_uri=https%3A%2F%2Flocalhost%2F&resource=00000003-0000-0ff1-ce00-000000000000%2F{your tenantID}.sharepoint.com%40{bearer realm}

&resource = 00000003-0000-0ff1-ce00-000000000000 对于共享点是永久的

这应该返回带有访问 token 和刷新 token 的响应，现在使用它您将能够访问 SharePoint REST API。