基于Spring配置Azure客户端凭据流程时遇强制登录问题求助

我正在尝试给自己的Spring应用和Web API配置客户端凭据流程（Client Credential Flow），参考了Azure官方相关文档，但因为文档表述不够清晰，遇到了棘手的问题。按我理解，客户端凭据流程是机对机（Machine to Machine）的授权方式，完全不需要用户参与登录，但现在Azure却强制要求用户登录，这直接引发了一系列后续错误，我完全搞不懂为什么会出现这种情况。

环境信息 #

• OS: Ubuntu 20.10
• IDE: Visual Studio Code

依赖库 #

<dependency>
    <groupId>com.azure.spring</groupId>
    <artifactId>azure-spring-boot-starter-active-directory</artifactId>
    <version>3.5.0</version>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>

application.yml配置 #

azure:
  activedirectory:
    tenant-id: {my-web-app-tenant-id}
    client-id: {my-web-app-client-id}
    client-secret: {my-web-app-client-secret}
    authorization-clients:
      web-api:
        scopes:
          - api://example-api/Employees.Read.All
          - api://example-api/Employees.Write.All

解答 #

Hey, let's break down why you're seeing that unexpected login prompt and how to fix it:

1. Wrong dependency choice
   You've included both azure-spring-boot-starter-active-directory and spring-boot-starter-oauth2-client—but the latter is built for authorization code flow (which requires user login), so it's overriding or interfering with your client credentials setup. For machine-to-machine scenarios, you don't need spring-boot-starter-oauth2-client; stick with azure-spring-boot-starter-active-directory alone, or pair it with spring-boot-starter-oauth2-resource-server if you're also securing your app as a resource server.

2. Config structure is designed for user-facing flows
   Your current authorization-clients setup is made for flows that involve a user (like authorization code). Client credentials flow doesn't use this section—instead, you need to configure token acquisition directly, and first make sure your Azure AD setup is correct:

   • In Azure AD, your client app must have application permissions (not delegated permissions) granted to the target web API, and an admin must have consented to those permissions.
   • The target web API's app registration must expose the relevant scopes, and those scopes must be added as application permissions to your client app.

3. Revised configuration example
   After adjusting dependencies, here's a more appropriate application.yml for client credentials flow:

spring:
  security:
    oauth2:
      client:
        registration:
          azure-cc:
            provider: azure-ad
            client-id: {my-web-app-client-id}
            client-secret: {my-web-app-client-secret}
            authorization-grant-type: client_credentials
        provider:
          azure-ad:
            token-uri: https://login.microsoftonline.com/{my-web-app-tenant-id}/oauth2/v2.0/token
azure:
  activedirectory:
    tenant-id: {my-web-app-tenant-id}

In your code, use OAuth2AuthorizedClientManager or ClientCredentialsTokenResponseClient to fetch the token programmatically—this avoids triggering any user-facing login filters.

4. Critical Azure AD checks
   • Double-check that your client app has a valid client secret/certificate configured under Certificates & secrets.
   • Go to your client app's API permissions, ensure you've added application permissions (not delegated) for your web API, and click Grant admin consent for [Tenant Name].
   • Verify that your web API's Expose an API section has the scopes you're requesting, and that those scopes are enabled for application access.

内容的提问来源于stack exchange，提问作者Billy Bolton