使用MSAL的ConfidentialClientApplicationBuilder获取Token时遇异常求助

问题描述 #

我尝试通过以下代码调用AcquireTokenForClient方法获取访问令牌，但执行时触发了异常。

代码示例 #

var clientID = "XXXXXXXXXXXXXXXXXXXXXXXXXXXX";
var clientSecret = "XXXXXXXXXXXXXXXXXXXXXXXXXXXX";

var authority = "https://<your-tenant>.b2clogin.com/<your-tenant>.onmicrosoft.com/<your-policyID>";

var clientApplication = ConfidentialClientApplicationBuilder.Create(clientID)
  .WithClientSecret(clientSecret)
  .WithAuthority(authority)
  .Build();

var scopes = new string[] { "{resourceId}/.default" };

var authenticationResult = await clientApplication.AcquireTokenForClient(scopes)
  .ExecuteAsync()
  .ConfigureAwait(false);

var accesstoken = authenticationResult.AccessToken;

异常信息 #

Unhandled exception. System.AggregateException: One or more errors occurred. (AADSTS50049: Unknown or invalid instance.
 ---> MSAL.CoreCLR.4.59.0.0.MsalServiceException:
        ErrorCode: invalid_instance
Microsoft.Identity.Client.MsalServiceException: AADSTS50049: Unknown or invalid instance. 
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.ThrowServerException(HttpResponse response, RequestContext requestContext)
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.ExecuteRequestAsync[T](Uri endPoint, HttpMethod method, RequestContext requestContext, Boolean expectErrorsOn200OK, Boolean addCommonHeaders, Func`2 onBeforePostRequestData)
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.DiscoverAadInstanceAsync(Uri endpoint, RequestContext requestContext)
   at Microsoft.Identity.Client.Instance.Discovery.NetworkMetadataProvider.SendInstanceDiscoveryRequestAsync(Uri authority, RequestContext requestContext)
   at Microsoft.Identity.Client.Instance.Discovery.NetworkMetadataProvider.FetchAllDiscoveryMetadataAsync(Uri authority, RequestContext requestContext)
   at Microsoft.Identity.Client.Instance.Discovery.NetworkMetadataProvider.GetMetadataAsync(Uri authority, RequestContext requestContext)
   at Microsoft.Identity.Client.Instance.Discovery.InstanceDiscoveryManager.FetchNetworkMetadataOrFallbackAsync(RequestContext requestContext, Uri authorityUri)
   at Microsoft.Identity.Client.Instance.Discovery.InstanceDiscoveryManager.GetMetadataEntryAsync(AuthorityInfo authorityInfo, RequestContext requestContext, Boolean forceValidation)
   at Microsoft.Identity.Client.Instance.AuthorityManager.RunInstanceDiscoveryAndValidationAsync()
   at Microsoft.Identity.Client.Internal.Requests.ClientCredentialRequest.GetAccessTokenAsync(CancellationToken cancellationToken, ILoggerAdapter logger)
   at Microsoft.Identity.Client.Internal.Requests.ClientCredentialRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.ApiConfig.Executors.ConfidentialClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenForClientParameters clientParameters, CancellationToken cancellationToken)

解决办法 #

• 修正Authority格式：AAD B2C的客户端凭证流不支持在Authority中包含用户策略/自定义策略。正确的Authority应为：

  https://<your-tenant>.b2clogin.com/<your-tenant>.onmicrosoft.com/v2.0/
  

  或使用租户ID替代域名：

  https://<your-tenant>.b2clogin.com/<tenant-id>/v2.0/
  

• 验证Scope的正确性：将{resourceId}替换为目标API的应用ID URI，格式应为：

  var scopes = new string[] { "https://<your-tenant>.onmicrosoft.com/your-api/.default" };
  

  .default后缀表示使用该API的所有应用级权限。

• 检查应用注册配置：确认客户端应用已被授予目标API的应用权限（非委托权限），且完成了管理员同意；同时验证客户端ID和Secret是否正确、未过期。

• 禁用实例发现（可选）：若网络限制导致实例发现失败，可在构建客户端时添加配置：

  var clientApplication = ConfidentialClientApplicationBuilder.Create(clientID)
    .WithClientSecret(clientSecret)
    .WithAuthority(authority)
    .WithInstanceDiscovery(false)
    .Build();
  

  注意：仅在确认Authority完全正确时使用，避免引入安全风险。

• 升级MSAL版本：当前使用的MSAL 4.59.0版本较旧，尝试升级到最新稳定版，修复可能存在的兼容性问题。

内容的提问来源于stack exchange，提问作者prasanthi