当前位置：首页 > 文章列表 > Golang > Go问答 > 错误：Golang Azure Active Directory 令牌请求被拒绝

错误：Golang Azure Active Directory 令牌请求被拒绝

来源：stackoverflow 2024-02-17 22:54:18 0浏览收藏

推广推荐

支持 PC / 移动端，安全直达

知识点掌握了，还需要不断练习才能熟练运用。下面golang学习网给大家带来一个Golang开发实战，手把手教大家学习《错误：Golang Azure Active Directory 令牌请求被拒绝》，在实现功能的过程中也带大家重新温习相关知识点，温故而知新，回头看看说不定又有不一样的感悟！

问题内容

我的客户端 id 和密码是否正确。我的重定向网址是 - http://localhost:8080/callback 。我已在我的 ad 中允许公共客户端流量。但每次我执行代码 main.go 时，我都会收到错误 handler error: token response was 401 unauthorized。所以我确实得到了登录页面，但每当我单击登录时，它都会使用我的电子邮件 id 和密码对我进行身份验证。但是一旦我输入重定向，我就会收到错误处理程序错误：令牌响应为 401 未经授权。

package main

import (
    "crypto/sha256"
    "encoding/base64"
    "encoding/gob"
    "encoding/json"
    "fmt"
    "html/template"
    "log"
    "net/http"
    "net/url"
    "strings"

    "github.com/davecgh/go-spew/spew"
    "github.com/gorilla/sessions"

    _ "golang.org/x/net/context"
    "golang.org/x/oauth2"
)

const (
    redirectURI string = "http://localhost:8080/callback"
)

// Authentication + Encryption key pairs
var sessionStoreKeyPairs = [][]byte{
    []byte("something-very-secret"),
    nil,
}

var store sessions.Store

var (
    clientID string
    config   *oauth2.Config
)

type User struct {
    Email       string
    DisplayName string
}

func init() {
    // Create file system store with no size limit
    fsStore := sessions.NewFilesystemStore("", sessionStoreKeyPairs...)
    fsStore.MaxLength(0)
    store = fsStore

    gob.Register(&User{})
    gob.Register(&oauth2.Token{})
}

func main() {
    log.SetFlags(log.LstdFlags | log.Llongfile)

    clientID = "<client-id>"
    if clientID == "" {
        log.Fatal("AZURE_AD_CLIENT_ID must be set.")
    }

    config = &oauth2.Config{
        ClientID:     clientID,
        ClientSecret: "<secret-id>", // no client secret
        RedirectURL:  redirectURI,

        Endpoint: oauth2.Endpoint{
            AuthURL:  "https://login.microsoftonline.com/<Tenant-id>/oauth2/authorize",
            TokenURL: "https://login.microsoftonline.com/<tenant-id>/oauth2/token",
        },

        Scopes: []string{"User.Read"},
    }

    http.Handle("/", handle(IndexHandler))
    http.Handle("/callback", handle(CallbackHandler))

    log.Fatal(http.ListenAndServe(":8080", nil))
}

type handle func(w http.ResponseWriter, req *http.Request) error

func (h handle) ServeHTTP(w http.ResponseWriter, req *http.Request) {
    defer func() {
        if r := recover(); r != nil {
            log.Printf("Handler panic: %v", r)
        }
    }()
    if err := h(w, req); err != nil {
        log.Printf("Handler error: %v", err)

        if httpErr, ok := err.(Error); ok {
            http.Error(w, httpErr.Message, httpErr.Code)
        }
    }
}

type Error struct {
    Code    int
    Message string
}

func (e Error) Error() string {
    if e.Message == "" {
        e.Message = http.StatusText(e.Code)
    }
    return fmt.Sprintf("%d: %s", e.Code, e.Message)
}

func IndexHandler(w http.ResponseWriter, req *http.Request) error {
    session, _ := store.Get(req, "session")

    var token *oauth2.Token
    if req.FormValue("logout") != "" {
        session.Values["token"] = nil
        sessions.Save(req, w)
    } else {
        if v, ok := session.Values["token"]; ok {
            token = v.(*oauth2.Token)
        }
    }

    var data = struct {
        Token   *oauth2.Token
        AuthURL string
    }{
        Token:   token,
        AuthURL: config.AuthCodeURL(SessionState(session), oauth2.AccessTypeOnline),
    }

    return indexTempl.Execute(w, &data)
}

var indexTempl = template.Must(template.New("").Parse(`<!DOCTYPE html>
<html>
  <head>
    <title>Azure AD OAuth2 Example</title>

    <link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-BVYiiSIFeK1dGmJRAkycuHAHRg32OmUcww7on3RYdg4Va+PmSTsz/K68vbdEjh4u" crossorigin="anonymous">
  </head>
  <body class="container-fluid">
    <div class="row">
      <div class="col-xs-4 col-xs-offset-4">
        <h1>Azure AD OAuth2 Example</h1>
{{with .Token}}
        <div id="displayName"></div>
        <a href="/?logout=true">Logout</a>
{{else}}
        <a href="{{$.AuthURL}}">Login</a>
{{end}}
      </div>
    </div>

    <script src="https://code.jquery.com/jquery-3.2.1.min.js" integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4=" crossorigin="anonymous"></script>
    <script>
{{with .Token}}
      var token = {{.}};

      $.ajax({
        url: 'https://graph.microsoft.com/v1.0/me',
        dataType: 'json',
        success: function(data, status) {
            $('#displayName').text('Welcome ' + data.displayName);
        },
        beforeSend: function(xhr, settings) {
          xhr.setRequestHeader('Authorization', 'Bearer ' + token.access_token);
        }
      });
{{end}}
    </script>
  </body>
</html>
`))

func CallbackHandler(w http.ResponseWriter, req *http.Request) error {
    session, _ := store.Get(req, "session")

    if req.FormValue("state") != SessionState(session) {
        return Error{http.StatusBadRequest, "invalid callback state"}
    }

    form := url.Values{}
    form.Set("grant_type", "authorization_code")
    form.Set("client_id", clientID)
    form.Set("response_type", "code")
    form.Set("scope", "offline_access%20user.read")
    form.Set("redirect_uri", "http%3A%2F%2Flocalhost%3A8080%2Fcallback")
    form.Set("response_mode", "query")
    form.Set("state", "12345")

    tokenReq, err := http.NewRequest(http.MethodPost, config.Endpoint.TokenURL, strings.NewReader(form.Encode()))
    if err != nil {
        return fmt.Errorf("error creating token request: %v", err)
    }
    tokenReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")

    resp, err := http.DefaultClient.Do(tokenReq)
    if err != nil {
        return fmt.Errorf("error performing token request: %v", err)
    }
    defer resp.Body.Close()

    if resp.StatusCode >= 400 {
        return fmt.Errorf("token response was %s", resp.Status)
    }

    var token oauth2.Token
    if err := json.NewDecoder(resp.Body).Decode(&token); err != nil {
        return fmt.Errorf("error decoding JSON response: %v", err)
    }

    session.Values["token"] = &token
    if err := sessions.Save(req, w); err != nil {
        return fmt.Errorf("error saving session: %v", err)
    }

    http.Redirect(w, req, "/", http.StatusFound)
    return nil
}

func SessionState(session *sessions.Session) string {
    return base64.StdEncoding.EncodeToString(sha256.New().Sum([]byte(session.ID)))
}

func dump(v interface{}) {
    spew.Dump(v)
}

正确答案

您需要添加client_secret：

form := url.Values{}
form.Set("grant_type", "authorization_code")
form.Set("client_id", clientID)
form.Set("code", req.FormValue("code"))
form.Set("redirect_uri", redirectURI)
form.Set("resource", "https://graph.windows.net")
form.Set("scope", "User.Read")
form.Set("response_mode", "query")
form.Set("client_secret", "xxxxxxxx")

还需要在api权限中添加user.read

一旦你完成了。您将能够获取令牌并将用户重定向到索引页面。

以上就是《错误：Golang Azure Active Directory 令牌请求被拒绝》的详细内容，更多关于的资料请关注golang学习网公众号！

版本声明

本文转载于：stackoverflow 如有侵犯，请联系study_golang@163.com删除