圖形API-獲取“遠程服務器回傳錯誤：（400）錯誤請求。”使用多租戶請求AccessToken時出錯

實際上，我正在嘗試使用以下端點在管理員同意成功完成管理員后使用使用 TenantId 獲取訪問令牌

https://login.microsoftonline.com/common/adminconsent

然后我使用租戶 ID 請求 AccessToken 端點

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

通過傳遞所有必填欄位來使用 HttpWebRequest

tenant : 6292ef34-37a8-4687-b8b3-7dd8d54a8a42

使用 HttpWebRequest 進行 API 呼叫的代碼

public static string AdminConsentAccessToken(string tenant, string state = "", string admin_concent = "")
{
    string postData="{\"client_id\":\"65577dd2-cc76-46af-a1ac-71582eac6af2\",\"scope\":\"https://graph.microsoft.com/.default",\"client_secret\":\"my_client_secret\","\grant_type\":"\client_credentials\"}"
    string result = string.Empty;
    try
    {
        var httpRequest = (HttpWebRequest)WebRequest.Create($"https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token");
        httpRequest.Method = "POST"; ;
        httpRequest.Accept = "application/json";
        httpRequest.ContentType = "application/x-www-form-urlencoded";
    
        using (var streamWriter = new StreamWriter(httpRequest.GetRequestStream()))
        {
            streamWriter.Write(postData);
        }
        var httpResponse = (HttpWebResponse)httpRequest.GetResponse();
        using (var streamReader = new StreamReader(httpResponse.GetResponseStream()))
        {
            result = streamReader.ReadToEnd();
        }
    }
    catch (Exception ex)
    {
    //exception
    }
    return result;
}

使用此代碼，我收到以下錯誤：“遠程服務器回傳錯誤：（400）錯誤請求。” 和狀態：協議錯誤，請您檢查代碼提示出了什么問題。

我也從郵遞員那里試過這個，我得到 400 - 錯誤請求（由于語法錯誤，請求無法完成。）

POST : https://login.microsoftonline.com/6292ef34-37a8-4687-b8b3-7dd8d54a8a42/oauth2/v2.0/token
Header : Content-Type : application/x-www-form-urlencoded
Body :
{
"grant_type": "client_credentials",
"client_id":"65577dd2-cc76-46af-a1ac-71582eac6af2",
"scope":"https://graph.microsoft.com/.default",
"client_secret": "my_client_secret"
}

Response :
{
"error": "invalid_request",
"error_description": "AADSTS900144: The request body must contain the following parameter: 'grant_type'.\r\nTrace ID: 68beea44-7863-4e08-97c9-526ada9d0300\r\nCorrelation ID: 064a85fe-6d37-43bd-ae59-3dca04232188\r\nTimestamp: 2022-06-24 09:08:56Z",
"error_codes": [
900144
],
"timestamp": "2022-06-24 09:08:56Z",
"trace_id": "68beea44-7863-4e08-97c9-526ada9d0300",
"correlation_id": "064a85fe-6d37-43bd-ae59-3dca04232188",
"error_uri": "https://login.microsoftonline.com/error?code=900144"
}

uj5u.com熱心網友回復：

嘗試使用請求application/json的Content-Type標頭而不是application/x-www-form-urlencoded.

uj5u.com熱心網友回復：

在 Postman 中，確保x-www-urlencoded在 tab 上選中復選框Body。

看起來您正在以json格式發送資料。

uj5u.com熱心網友回復：

您創建一個請求模型：

public class ReqModel
{
    public string client_id{ get; set; }
    public string  scope{ get; set; }
    public string  client_secret{ get; set; }
    public string grant_type{ get; set; }
}

然后你嘗試像這樣創建 postData：

    ReqModel reqModel = new()
        {
            client_id = "65577dd2-cc76-46af-a1ac-71582eac6af2",
            scope = "https://graph.microsoft.com/.default",
            client_secret = "my_client_secret",
            grant_type = "client_credentials"
        };


        string postData = JsonConvert.SerializeObject(reqModel, Newtonsoft.Json.Formatting.Indented);

uj5u.com熱心網友回復：

我可以根據您的要求獲取訪問令牌

但這并不意味著您可以通過在代碼中模擬發布請求來獲取訪問令牌，微軟要求用戶使用

using Azure.Identity;
using Microsoft.Graph;

var scopes = new[] { "https://graph.microsoft.com/.default" };
var tenantId = "hanxia.onmicrosoft.com";
var clientId = "azure_ad_app_id";
var clientSecret = "client_secret";
var clientSecretCredential = new ClientSecretCredential(
    tenantId, clientId, clientSecret);
var graphClient = new GraphServiceClient(clientSecretCredential, scopes);
var temp = await graphClient.Users.Request().GetAsync();