azure - 如何在 Azure AD 中为 MS graph api 生成 grant_type 密码的 access_token

Question

我已经使用这两个链接来生成access_token密码grant_type

1. https://dzone.com/articles/getting-access-token-for-microsoft-graph-using-oau-2?preview=true
2. https://learn.microsoft.com/en-us/azure/active-directory-b2c/configure-ropc?tabs=app-reg-ga

我使用了下面的curl请求

curl --location --request POST 'https://login.microsoftonline.com/910f-90d18b56a170/oauth2/token' --header 'Content-Type: application/x-www-form-urlencoded' --data-urlencode 'client_id=4b5d-bde6-0b1a09b84a5f' --data-urlencode 'client_secret=q4720z4z_6N8CU-c7qEwx2a' --data-urlencode 'grant_type=password' --data-urlencode '<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="6d181e081f030c000850151515152d1414141443020300040e1f021e020b19430e0200" rel="noreferrer noopener nofollow">[email protected]</a>' --data-urlencode 'password=xxxxxxx' --data-urlencode 'resource=https://graph.microsoft.com' --data-urlencode 'scope=openid'

以下是回复

{
    "error": "invalid_grant",
    "error_description": "AADSTS50126: Error validating credentials due to invalid username or password.\r\nTrace ID: 21fdd138-0bc6-49bd-8852-c7a6a3a1e600\r\nCorrelation ID: a1010714-38f6-4926-a135-568adcdada26\r\nTimestamp: 2020-12-15 16:44:37Z",
    "error_codes": [
        50126
    ],
    "timestamp": "2020-12-15 16:44:37Z",
    "trace_id": "21fdd138-0bc6-49bd-8852-c7a6a3a1e600",
    "correlation_id": "a1010714-38f6-4926-a135-568adcdada26",
    "error_uri": "https://login.microsoftonline.com/error?code=50126"
}

我不知道为什么响应表明我的凭据无效，即使我传递了正确的凭据。

Answer 1

当我使用错误的凭据运行以下查询时遇到同样的问题

向以下curl操作提供正确的凭据后能够获取 token

  curl -X POST -d "client_id=clientid&scope=user.read&grant_type=password&username=username &password=password&resource=https://graph.microsoft.com " https://login.microsoftonline.com/tenantid/oauth2/token

Note :Microsoft recommends you do not use the ROPC flow. In mostscenarios, more secure alternatives are available and recommended.This flow requires a very high degree of trust in the application, andcarries risks which are not present in other flows. You should onlyuse this flow when other more secure flows can't be used.