使用 Azure AD Graph API 时如何获取用于获取 access_token 的“代码"

我是 Azure AD 的新手，想通过我的 Java 应用程序与之交互.经过一番研究，我发现我们需要获取 bearer_token 才能使用 Azure AD 的 Graph API.

我正在关注

谁能告诉我这个代码"是什么以及我应该如何获得它?

注意:我有 Azure AD 的免费试用帐户.

非常感谢任何帮助！

问候，阿米特

解决方案

您正在尝试使用授权码授予流程.您可以在 微软文档

这是一个两步过程:

步骤 1:通过点击/authorize 端点获取授权码.您将收到一个授权码作为此调用的响应.示例如下:

//换行符仅用于易读性https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?client_id=6731de76-14a6-49ae-97bc-6eba6914391e&response_type=代码&redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F&response_mode=查询&scope=openid%20offline_access%20https%3A%2F%2Fgraph.microsoft.com%2Fmail.read&状态=12345

第 2 步:一旦您获得了之前通话的授权码，您就可以将其兑换为访问令牌.示例如下:

//换行符仅用于易读性POST/{租户}/oauth2/v2.0/token HTTP/1.1主持人:https://login.microsoftonline.com内容类型:application/x-www-form-urlencodedclient_id=6731de76-14a6-49ae-97bc-6eba6914391e&scope=https%3A%2F%2Fgraph.microsoft.com%2Fmail.read&code=OAAABAAAAiL9Kn2Z27UubvWFPbm0gLWQJVzCTE9UkP3pSx1aXxUjq3n8b2JRLk4OxVXr...&redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F&grant_type=授权码&client_secret=JqQX2PNo9bpM0uEihUPzyrh//注意:只有网络应用需要

I am newbie to Azure AD and want to interact with it through my java app. After doing some research, I found that we need to get bearer_token in order to use Graph API for Azure AD.

I am following this link to get bearer token but facing issue with one of parameters.

Now as shown in below image from above link, there are several parameters and information related to them is given like what they are and how to retrieve them but I dont see any information related 'code' parameter.

Can somebody tell me what is this 'code' and how am I supposed to get it?

Note: I have free trial account of Azure AD.

Any help is much appreciated!

Regards, Amit

解决方案

You are trying to use Authorization Code Grant Flow. You can read in detail about the flow and steps here in Microsoft Docs

It's a two step process:

STEP 1: Get Authorization Code by hitting the /authorize endpoint. You will get an authorization_code back as response for this call. Example shown below:

// Line breaks for legibility only

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?
client_id=6731de76-14a6-49ae-97bc-6eba6914391e
&response_type=code
&redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F
&response_mode=query
&scope=openid%20offline_access%20https%3A%2F%2Fgraph.microsoft.com%2Fmail.read
&state=12345

STEP 2: Once you have an authorization_code from previous call, you can redeem it for an access token. Example shown below:

// Line breaks for legibility only

POST /{tenant}/oauth2/v2.0/token HTTP/1.1
Host: https://login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded

client_id=6731de76-14a6-49ae-97bc-6eba6914391e
&scope=https%3A%2F%2Fgraph.microsoft.com%2Fmail.read
&code=OAAABAAAAiL9Kn2Z27UubvWFPbm0gLWQJVzCTE9UkP3pSx1aXxUjq3n8b2JRLk4OxVXr...
&redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F
&grant_type=authorization_code
&client_secret=JqQX2PNo9bpM0uEihUPzyrh    // NOTE: Only required for web apps