使用Graph API的Exchange 2016本地邮箱访问(混合设置) [英] Exchange 2016 on-premise mailbox access using Graph API (Hybrid Setup)

问题描述

我在prem交换服务器上(处于混合模式)[e-mail]中有一个邮箱，并且我试图通过图形api(/messages)访问此邮箱.如果我在图形资源管理器中执行此操作，则效果很好，但是当我通过实现执行时失败.

I have a mailbox in on prem exchange server (which is in hybrid mode) [e-mail] and i am trying to access this via graph api (/messages). This works perfectly if i do this in graph explorer, but fails when i do via implementation.

所需的应用程序权限在Azure应用程序注册门户中给出. 实施使用 grant_type作为带有证书的client_credentials ，这对于云用户完全有效.

Required application permission is given in Azure app registration portal. Implementation uses grant_type as client_credentials with certificate and this works perfectly for cloud users.

{ 'error': {
    'innerError': {
        'date': '2019-02-28T14:17:45', 
        'request-id': '6a85f8c3-4e13-4cf0-84b2-ddc934241afd'
    },
    'message': '', 
    'code': 'UnknownError'
    }}

IIS日志

1. 通话来自图浏览器

2019-02-28 15:02:31 172.31.10.98GET/api/V2.0/Users('[e-mail]')/Messages/$count& CorrelationID =;& cafeReqId = bc8e8aef- de46-4c72-bcf4-b4f567bc45dd; 443 S-1-5-21-1392771109-4043059535-3934338706-1147 20.190.145.177Mozilla/5.0 +(Macintosh; + Intel + Mac + OS + X + 10_14_3)+ AppleWebKit/537.36 +(KHTML，+ like + Gecko) + Chrome/71.0.3578.80 + Safari/537.36-200 0 0 287

2019-02-28 15:02:31 172.31.10.98GET /api/V2.0/Users('[e-mail]')/Messages/$count &CorrelationID=;&cafeReqId=bc8e8aef-de46-4c72-bcf4-b4f567bc45dd; 443 S-1-5-21-1392771109-4043059535-3934338706-1147 20.190.145.177Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_14_3)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/71.0.3578.80+Safari/537.36 - 200 0 0 287

1. 用于从已实现的应用拨打电话

2019-02-28 15:00:05 172.31.10.98GET/api/V2.0/Users('[e-mail]')/Messages/$count& CorrelationID =;& cafeReqId = c504b658- b9df-43b5-9dbb-8e83050c3d2f; 443-20.190.128.103--401 0 0 102

2019-02-28 15:00:05 172.31.10.98GET /api/V2.0/Users('[e-mail]')/Messages/$count &CorrelationID=;&cafeReqId=c504b658-b9df-43b5-9dbb-8e83050c3d2f; 443 - 20.190.128.103- - 401 0 0 102

1. 此身份验证失败的原因是什么，可能是因为该令牌是由天蓝色的AD提供的， 已针对onprem进行了身份验证?

1. What would be reason for this authentication failure , could it be because that token is provided by azure AD which is authenticated against onprem ?

更新

添加了更多用于记录的标头，发现以下是错误消息.

Update

Added some more headers for logging and found that below is the error.

2019-03-04 04:05:13 172.31.10.98 GET/api/V2.0/Users('[e-mail]')/Messages& CorrelationID =;& cafeReqId = 2823c302-3c84-4847 -b586-accced4b6dd5; 443-20.190.145.177 PostmanRuntime/7.6.0-401 0 0332 Bearer + eyJ0等等.....等等....... hSd mail.onprem.com---Bearer + client_id ="00000002-0000- 0ff1-ce00-000000000000，+ token_types =" app_asserted_user_v1 + service_asserted_app_v1，+ authorization_uri =" https://login.windows.net/common/oauth2/authorize，+ error =" invalid_token"2000001; reason =" This +令牌+配置文件+'V1S2SAppOnly'+不适用于+当前+协议.; error_category =" invalid_token"

2019-03-04 04:05:13 172.31.10.98 GET /api/V2.0/Users('[e-mail]')/Messages &CorrelationID=;&cafeReqId=2823c302-3c84-4847-b586-accced4b6dd5; 443 - 20.190.145.177 PostmanRuntime/7.6.0 - 401 0 0 332 Bearer+eyJ0 blah blah.....blah blah.....hSd mail.onprem.com - - - Bearer+client_id="00000002-0000-0ff1-ce00-000000000000",+token_types="app_asserted_user_v1+service_asserted_app_v1",+authorization_uri="https://login.windows.net/common/oauth2/authorize",+error="invalid_token" 2000001;reason="This+token+profile+'V1S2SAppOnly'+is+not+applicable+for+the+current+protocol.";error_category="invalid_token"

我们在交换服务器上使用了自签名证书，这会导致此问题吗?如果是这样的话，想知道图浏览器的所有功能如何工作.

We are using self signed certificate on exchange server , can this lead to this issue ? If so wondering how everything is working from graph explorer.

推荐答案

问题实际上出在其他地方-Exchange似乎不支持client_credentials流.但是，您可以通过以下PowerShell强制执行此操作(确保在应用后重新启动IIS):

The issue is actually somewhere else - Exchange doesn't seem to support client_credentials flow. You can, however force it via following PowerShell (make sure to restart your IIS after applying):

$apps = Get-PartnerApplication
# Microsoft Graph is 2nd item in the array, if you are unsure, list the items by calling $apps first
$apps[1] | Set-PartnerApplication -AppOnlyPermissions $apps[1].ActAsPermissions

完整的解释可以在这里找到:

The full explanation can be found here: https://blog.thenetw.org/2019/05/13/using-client_credentials-with-microsoft-graph-in-hybrid-exchange-setup/

这篇关于使用Graph API的Exchange 2016本地邮箱访问(混合设置)的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！