如何用HttpClient以X509Certificate2替换Client Secret调用Microsoft OAuth2令牌及刷新

原本使用以下代码通过Microsoft OAuth2令牌端点获取access/refresh令牌（用于调用Microsoft Graph API）：

string url = string.Format("https://login.microsoftonline.com/{0}/oauth2/v2.0/token", tenantId);

Dictionary<string, string> values = new Dictionary<string, string>
{
    { "client_id", clientId },
    { "scope", "user.read offline_access openid place.read.all" },
    { "client_secret", clientSecret },
    { "grant_type", "authorization_code" },
    { "code", authorizationCode }
};

if (!string.IsNullOrEmpty(redirectUri))
{
    values.Add("redirect_uri", redirectUri);
}

FormUrlEncodedContent data = new FormUrlEncodedContent(values);

HttpClient client = new HttpClient();

HttpResponseMessage response = client.PostAsync(url, data).Result;

现在需要用X509Certificate2替换client_secret，如何通过HTTP调用传递证书而非密钥？同时需要用证书实现刷新令牌的调用，当前刷新代码如下：

string url = string.Format("https://login.microsoftonline.com/{0}/oauth2/v2.0/token", tenantId);

Dictionary<string, string> values = new Dictionary<string, string>
{
    { "client_id", clientId },
    { "scope", "user.read offline_access openid place.read.all" },
    { "client_secret", clientSecret },
    { "grant_type", "refresh_token" },
    { "refresh_token", refreshToken }
};

if (!string.IsNullOrEmpty(redirectUri))
{
    values.Add("redirect_uri", redirectUri);
}

FormUrlEncodedContent data = new FormUrlEncodedContent(values);

HttpClient client = new HttpClient();

HttpResponseMessage response = client.PostAsync(url, data).Result;

注：无法使用MSAL，必须采用HTTP调用方式，且保留用户登录生成的authorization_code。

用X509证书替换client_secret的核心是通过**证书签名JWT（客户端断言）**证明客户端身份，而非直接传递密钥。以下是两种模式的具体实现：

一、授权码模式（authorization_code）替换实现 #

核心步骤 #

1. 加载X509证书，生成符合Azure AD要求的客户端断言JWT
2. 移除client_secret参数，添加client_assertion和client_assertion_type参数

代码示例 #

using System.IdentityModel.Tokens.Jwt;
using System.Security.Cryptography.X509Certificates;
using Microsoft.IdentityModel.Tokens;

// 加载证书（可从本地文件或证书存储读取，示例为本地PFX文件）
X509Certificate2 cert = new X509Certificate2("path/to/your/cert.pfx", "cert-password");

string url = string.Format("https://login.microsoftonline.com/{0}/oauth2/v2.0/token", tenantId);

// 生成客户端断言JWT
string clientAssertion = GenerateClientAssertion(clientId, tenantId, cert);

Dictionary<string, string> values = new Dictionary<string, string>
{
    { "client_id", clientId },
    { "scope", "user.read offline_access openid place.read.all" },
    { "grant_type", "authorization_code" },
    { "code", authorizationCode },
    { "client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" },
    { "client_assertion", clientAssertion }
};

if (!string.IsNullOrEmpty(redirectUri))
{
    values.Add("redirect_uri", redirectUri);
}

FormUrlEncodedContent data = new FormUrlEncodedContent(values);

HttpClient client = new HttpClient();
HttpResponseMessage response = client.PostAsync(url, data).Result;

// 生成客户端断言的辅助方法
private static string GenerateClientAssertion(string clientId, string tenantId, X509Certificate2 cert)
{
    var now = DateTime.UtcNow;
    var jwtToken = new JwtSecurityToken(
        issuer: clientId,
        audience: $"https://login.microsoftonline.com/{tenantId}/v2.0",
        claims: new[] { new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()) },
        notBefore: now,
        expires: now.AddMinutes(10), // 有效期建议10分钟以内
        signingCredentials: new SigningCredentials(
            new X509SecurityKey(cert),
            SecurityAlgorithms.RsaSha256
        )
    );

    return new JwtSecurityTokenHandler().WriteToken(jwtToken);
}

二、刷新令牌模式（refresh_token）替换实现 #

刷新令牌的逻辑与授权码模式一致，仅需修改grant_type并添加refresh_token参数，复用客户端断言生成逻辑即可。

代码示例 #

// 加载证书
X509Certificate2 cert = new X509Certificate2("path/to/your/cert.pfx", "cert-password");

string url = string.Format("https://login.microsoftonline.com/{0}/oauth2/v2.0/token", tenantId);

string clientAssertion = GenerateClientAssertion(clientId, tenantId, cert);

Dictionary<string, string> values = new Dictionary<string, string>
{
    { "client_id", clientId },
    { "scope", "user.read offline_access openid place.read.all" },
    { "grant_type", "refresh_token" },
    { "refresh_token", refreshToken },
    { "client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" },
    { "client_assertion", clientAssertion }
};

if (!string.IsNullOrEmpty(redirectUri))
{
    values.Add("redirect_uri", redirectUri);
}

FormUrlEncodedContent data = new FormUrlEncodedContent(values);

HttpClient client = new HttpClient();
HttpResponseMessage response = client.PostAsync(url, data).Result;

// 复用之前的GenerateClientAssertion方法

关键注意事项 #

• 证书配置：需提前将证书公钥上传至Azure AD应用注册的「证书和密码」页面，确保Azure AD信任该证书
• 签名算法：必须使用RsaSha256算法，符合Azure AD的客户端断言要求
• JWT有效期：断言有效期建议设置为5-10分钟，避免长期有效带来的安全风险

内容的提问来源于stack exchange，提问作者Adrien Ruffie