OAuth2与Azure AD-未获得用户同意 [英] OAuth2 with Azure AD - Not getting user consent

问题描述

我正在尝试使OAuth2工作流针对Azure AD正确执行。我正在按照此来源的指示进行操作：

_{（来源： azurecomcdn.net ）}

2）其次，将提升任何其他用户（非管理员）在管理员同意可以使用该应用程序后，在首次使用该应用程序时同意他们的个人信息。

I am trying to get the OAuth2 workflow to perform correctly for Azure AD. I am following the directions from this source: https://msdn.microsoft.com/en-us/library/azure/dn645542.aspx

I can successfully get an authorization code response by using this request: https://login.microsoftonline.com/[app-endpoint-id]/oauth2/authorize?response_type=code&client_id=[client-id]&redirect_uri=[redirect-uri]

I then use the authorization code to request an access token with a http post like so (I am testing this using Postman):

POST /[app-endpoint-id]/oauth2/token HTTP/1.1 Host: login.microsoftonline.com Cache-Control: no-cache Postman-Token: ed098281-9aa4-6e5f-915d-0253d9a876d3 Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&client_id=[client-id]&code=[authorization_code]&redirect_uri=[redirect_uri]&client_secret=[client-secret]&resource=[app-url]

I get the following error message from the POST request:

{"error":"invalid_grant","error_description":"AADSTS65001: The user or administrator has not consented to use the application with ID 'app-id'. Send an interactive authorization request for this user and resource.\r\nTrace ID: trace-di\r\nCorrelation ID: correlation-id\r\nTimestamp: 2016-01-13 17:18:39Z","error_codes":[65001],"timestamp":"2016-01-13 17:18:39Z","trace_id":"trace-id","correlation_id":"correlation-id"}

If I clear my cache and make the first request for the authorization code I will be redirected to log in. However, I don't get any way to authorize my app after logging in like it says I should in this documentation:

//azure.microsoft.com/en-us/documentation/articles/active-directory-integrating-applications/

What am I doing wrong here? I am trying to get an access token.

解决方案

The problem you are running in to is that the tenant you are using to access your app has not added your application to the list of applications that are supported. It's telling you to use the interactive flow as an administrator.

Consent is a two step process:

1) First, the administrator of the tenant must approve the app. This can be done either 1) in the Azure portal of the tenant wishing to use the app or 2) by launching the app and using admin credentials against the app when you sign in.

Example of the Azure portal approval:

_{(source: azurecomcdn.net)}

2) Second, any additional user (non-admin) will be promoted to consent for their individual information when using the app for the first time after the admin has consented that the app can be used.

这篇关于OAuth2与Azure AD-未获得用户同意的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！