Azure B2C Oauth：无法为 SSL/TLS 安全通道建立信任关系

Question

我正在学习https://azure.microsoft.com/en-us/documentation/articles/active-directory-b2c-reference-oauth-code/的教程

登录并重定向到 OAuthCallback 后，我无法继续进行 Oauth 令牌获取部分

这里是我调用它的地方

    public async static Task<AdAcessToken> ExchangeCodeForAccessToken(string userId, string conversationId, string code, string AdOauthCallback)
    {
        var uri = new Uri("https://login.microsoftonline.com/baad.onmicrosoft.com/oauth2/v2.0/token?p=b2c_1_sign-in");

        var formdata = new FormUrlEncodedContent(new[]
        {
            new KeyValuePair<string, string>("grant_type", "authorization_code"),
            new KeyValuePair<string, string>("client_id", Constants.ADClientId),
            new KeyValuePair<string, string>("scope", "openid offline_access"),
            new KeyValuePair<string, string>("code", code),
            new KeyValuePair<string, string>("redirect_uri", AdOauthCallback)
        });


        var data = new
        {
            grant_type = "authorization_code",
            client_id = Constants.ADClientId,
            scope = "openid offline_access",
            code = code,
            redirect_uri = AdOauthCallback
        };

        return await AdPostRequest<AdAcessToken>(uri,data);
    }

这是我的方法

    private static async Task<T> AdPostRequest<T>(Uri uri, Object data)
    {
        string json;

        using (HttpClient client = new HttpClient())
        {
            client.BaseAddress = new Uri("https://login.microsoftonline.com/");
            client.DefaultRequestHeaders.Host = "microsoftonline.com";
            client.DefaultRequestHeaders.Accept.Add(new System.Net.Http.Headers.MediaTypeWithQualityHeaderValue("application/json"));

            var returned = await client.PostAsJsonAsync(uri, data).ConfigureAwait(false);    //SSL ERROR IM STUCK HERE!!!!            
            json = returned.Content.ReadAsStringAsync().Result;
        }

        try
        {
            var result = JsonConvert.DeserializeObject<T>(json);
            return result;
        }
        catch (JsonException ex)
        {
            throw new ArgumentException("Unable to deserialize the AD response.", ex);
        }
    }

这是错误输出

This XML file does not appear to have any style information associated with it. The document tree is shown below.
<Error>
<Message>An error has occurred.</Message>
<ExceptionMessage>An error occurred while sending the request.</ExceptionMessage>
<ExceptionType>System.Net.Http.HttpRequestException</ExceptionType>
<StackTrace>
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult() at VSTF_RD_Bot.AdHelpers.<AdPostRequest>d__7`1.MoveNext() in C:\Users\bob\Development\BotFrameworkSample-master\Bot\VSTF_RD_Bot\AdHelpers.cs:line 130 --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult() at VSTF_RD_Bot.AdHelpers.<ExchangeCodeForAccessToken>d__2.MoveNext() in C:\Users\bob\Development\BotFrameworkSample-master\Bot\VSTF_RD_Bot\AdHelpers.cs:line 73 --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult() at VSTF_RD_Bot.Controllers.OAuthCallbackController.<OAuthCallback>d__0.MoveNext() in C:\Users\bob\Development\BotFrameworkSample-master\Bot\VSTF_RD_Bot\Controllers\OAuthCallbackController.cs:line 34 --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult() at System.Threading.Tasks.TaskHelpersExtensions.<CastToObject>d__3`1.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult() at System.Web.Http.Controllers.ApiControllerActionInvoker.<InvokeActionAsyncCore>d__0.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult() at System.Web.Http.Controllers.ActionFilterResult.<ExecuteAsync>d__2.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult() at System.Web.Http.Dispatcher.HttpControllerDispatcher.<SendAsync>d__1.MoveNext()
</StackTrace>
<InnerException>
<Message>An error has occurred.</Message>
<ExceptionMessage>
The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.
</ExceptionMessage>
<ExceptionType>System.Net.WebException</ExceptionType>
<StackTrace>
at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, TransportContext& context) at System.Net.Http.HttpClientHandler.GetRequestStreamCallback(IAsyncResult ar)
</StackTrace>
<InnerException>
<Message>An error has occurred.</Message>
<ExceptionMessage>
The remote certificate is invalid according to the validation procedure.
</ExceptionMessage>
<ExceptionType>
System.Security.Authentication.AuthenticationException
</ExceptionType>
<StackTrace>
at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult) at System.Net.PooledStream.EndWrite(IAsyncResult asyncResult) at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar)
</StackTrace>
</InnerException>
</InnerException>
</Error>

请指教。我什至已经完成了 Powershell 步骤，但似乎没有工作。

Step 5: Trust the IIS Express SSL certificate

Since the web API is SSL protected, the client of the API (the web app) will refuse the SSL connection to the web API unless it trusts the API's SSL certificate. Use the following steps in Windows Powershell to trust the IIS Express SSL certificate. You only need to do this once. If you fail to do this step, calls to the TodoListService will always throw an unhandled exception where the inner exception message is:

"The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel."

To configure your computer to trust the IIS Express SSL certificate, begin by opening a Windows Powershell command window as Administrator.

Query your personal certificate store to find the thumbprint of the certificate for CN=localhost:

PS C:\windows\system32> dir Cert:\LocalMachine\My


    Directory: Microsoft.PowerShell.Security\Certificate::LocalMachine\My

我无法继续。我该如何解决这个问题，文档似乎没有任何更新，我错过了什么吗？

Answer 1

尝试改变这个：

client.DefaultRequestHeaders.Host = "microsoftonline.com";

到这里：

client.DefaultRequestHeaders.Host = "login.microsoftonline.com";

Answer 2

您是否正在使用 Chrome 调试您的应用程序？ 如果是这样，试试这个： 1) 使用任何 IE 或 Firefox 进行调试 2) 当浏览器显示不安全警告消息时，单击高级。 3）一旦进入高级，搜索查看证书 4) 找到查看证书后，将其保存到磁盘。 5) 停止调试并重新开始，但这次使用 Chrome 6) 当出现 Not Secure 警告时，进入 Chrome 的设置，高级，管理证书 7) 使用默认值导入保存的证书。

这基本上是一种注册自签名证书的方式。还有其他方法可以做到这一点，因此系统会信任它，但这就是我在这里所做的并且效果很好。 希望对您有所帮助。