OAuth 2.0 客户端未返回 JSON Web 令牌

Question

我正在尝试将 Azure Active Directory OAuth 2.0 登录添加到我的 PHP Web 应用程序。

我正在使用基于 PHP League’s OAuth 2.0 Client. 的 Azure 提供程序 TheNetworg

它似乎工作正常，因为我得到了一个访问令牌返回。

但是，令牌看起来像 JSON Web 令牌，但它不是——老实说，不知道令牌是什么。

这是我使用的代码：-

<?php
require "..\\vendor\\autoload.php";
session_start();

$client_id                          = 'aloadofnumbersandletters';
$client_secret                      = 'aloadofnumbersandletters';
$redirect_uri                       = 'http://localhost:54680/VirtualWebServer/logi03.php';
$provider                           = new TheNetworg\OAuth2\Client\Provider\Azure([
                                      'clientId'          => $client_id,
                                      'clientSecret'      => $client_secret,
                                      'redirectUri'       => $redirect_uri]);
$provider->defaultEndPointVersion   = TheNetworg\OAuth2\Client\Provider\Azure::ENDPOINT_VERSION_2_0;
$baseGraphUri                       = $provider->getRootMicrosoftGraphUri(null);
$provider->scope                    = 'openid profile email offline_access ' . $baseGraphUri . 
'/User.Read';

# Logout
#
if($_GET["logout"])
{
    $post_logout_redirect_uri = 'https://www.msn.com'; // The logout destination after the user is 
logged out from their account.
    $logoutUrl = $provider->getLogoutUrl($post_logout_redirect_uri);
    header('Location: '.$logoutUrl); // Redirect the user to the generated URL
}
#
# Get token and go to MENU01
#
else if (isset($_GET['code']) && isset($_SESSION['OAuth2.state']) && isset($_GET['state']))
{
    if ($_GET['state'] == $_SESSION['OAuth2.state'])
    {
        unset($_SESSION['OAuth2.state']);

        $token = $provider->getAccessToken('authorization_code', ['scope' => $provider->scope, 'code' 
=> $_GET['code'],]);

        #header('Location: menu01.php?oid='.$user->getId()."&token=".$token);
    }
    else
    {
        echo 'Invalid state';
        return null;
    }
}
#
# Login
#
else
{  
    $authorizationUrl = $provider->getAuthorizationUrl(['scope' => $provider->scope]);
    error_log("authorizationUrl token:".$authorizationUrl."\r\n", 3, 
"C:\\Users\\User\\source\\repos\\IDMS\\1.txt");
    $_SESSION['OAuth2.state'] = $provider->getState();

    header('Location: ' . $authorizationUrl);
}

?>

但是$token的内容是这样的：-

EwCIA8l6BAAU6k7+XVQzkGyMv7VHB/h4cHbJYRAAAX5k1c9mtATTlIlFQyK3KS5IWF qIZ97rD8ZQRxnG2OXlI0aer8zF7HzPIgmWOM0Bm4QhslLdF2VNjPLU1jYZgLv7C2hp +dUre/MIkHhndMdGkKHaKp6E2LTSCkw6ei6CFCmMypVbeJV1JCRxN6lC9Im7uHRjVn VfASbgsOnupmGDljChR68lMO1TlFefl7+Pa7fI4v7MklCeJA5gBd0WKEqso8xerRxa 6ubv4w1FfZUZ3QfdR7DVi+GowYUUXgNBEdybikTy8TK6dGIQZuagsspSpWwEofGhEN VeFhX4BMlXg2d5Xt9Hs+O/d3BGEtXLGksaEktNwJqAgi1VjVTQgDZgAACFg/hj18dS 8hWAIkvlNNhWilWG2OuDfVLMxLBRdQoK3RoDfpD8P99hoXcSVr760kFu99cjzLZ4gJ Xq4ykAiGSHK5JPL8DYLuHRg93jitRBx6DA+0TbjWRO4Zm+2uVxP44C24fDOSWhIaW4 /UJC/EaAz223W/vwcO0J0ZJph5GfEBtbhNqM87r7an+JZvI9zXFwHKvobHcknHOpdn xaMbWBt2g+N2gum9uJNVQvYDjcXOslpzCqC6Lc+g8So0B4UJOMnrgcJ1gbxOMr/q5H 2k9349wuketwrLpSRB5oo5Fgj8FRFZkp4wa+2xKSFbjBMUagJFAF1txbQ+hOWtUHVS OFv6XIkrhBEKA3cvPFrmgTdqSdietlDMeYHkcAEL/o7mupaTj9OK7sOwNSSTKtCL6c MbVVKMsLQ+M1VwZ+pwCg+Xi61BgH7r+wmtFKc1g3h/8GQ9Q8mjq7lShm/sjZrOUoZl EJkdWfQF2CStP7RDcGItSnPqg0swUksnLED1yclK+wWn5yll7E6K55ES3BJsXtUFku wqy8b+QJ1H8/xFLNl32wvvsBh1XWDU+MZR+5edyQmF4jTuCLqlnVTFMD+C6bJGYn3Q oqloEfm+94+voH4OiFtr0z909U/sQCWl+PWkYWuNUzHqN0fywbpnOaUx1ak3DtV2Oo mNy18EE8i+FbzeIojjR2PptBiK9g+zQ5iwX73UENojKOKIYd/C/tlWwvgENi38+gTu 9p0T1Fol+d38G/ji/jhzpsMFtZfOU97VL7ZTELmFHBqDmmAzmbphl+kmvVrgvYHgYN VPebHvrA8psCDAg==

我期待，或者至少我认为我应该期待，作为 JSON Web Token，由 2 个点分隔。

类似这样的：-

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9 .eyJ1c2VyIjoiVlx1MDAxNcKbwoNUwoonbFPCu8KhwrYiLCJpYXQiOjE0NDQyNjI4NjYsImV4cCI6MTQ0NDI2Mjg4Nn0 .Dww7TC-d0teDAgsmKHw7bhF2THNichsE6rVJq9xu_2s

有谁知道为什么我没有获得 JWT，而是完全不同的东西？

Answer 1

我不会说 PHP，但在我看来你的 JWT 是加密的。这是 Azure AD 应用注册中的设置。在 Azure 门户中的应用注册中查找“令牌加密”刀片以进行验证。