Microsoft Entra可验证凭证呈现请求触发内部服务器错误求助

背景 #

• 企业A：拥有Microsoft可验证账号，用于为员工创建可验证凭证
• 企业B：拥有Microsoft可验证账号，需验证企业A员工身份以提供折扣

操作步骤 #

1. 使用企业A账号创建可验证凭证，已成功存储至Microsoft Authenticator App
2. 企业B生成身份验证用的呈现请求及对应二维码

问题现象 #

使用Microsoft Authenticator App扫描二维码后，应用识别到匹配的凭证并提供分享选项，但点击「分享」后触发错误：

Oops, failed to connect. It seems there is a problem with one of our services connecting to your device. Check your network connection and try again.

技术详情 #

Error Code: internalServerError
Error Details: A generic error has occurred on the server.; Not Found; Not Found
TimeStamp: Dec1, 2022 10:02:48 AM EST
Request ID: 438395be97f20bbcc31511351121bbaa
Correlation ID: 3sg46/0ARha0zS/XHYKGfA.6.4

部分日志片段 #

2022-11-30 17:49:33,560 INFO/Broker: [com.microsoft.identity.common.internal.result.MsalBrokerResultAdapter:authenticationResultFromBundle][2022-11-30 17:49:33 - thread_name: pool-27-thread-2, correlation_id: b27725eb-c6fc-4a0f-bdd5-dd5f3f74270b - Android 30] Broker Result returned from Bundle, constructing authentication result ThreadPoolExecutor$Worker.run()@641 [pool-14-thread-1]
2022-11-30 17:49:33,562 INFO/App: MSAL acquire token silently success: com.microsoft.identity.client.AuthenticationResult@5709e74 MsalTokenRefreshManager$getTokenSilentlyAsync$4$1$onTaskCompleted$acquireTokenSilentParameters$1.onSuccess()@567 [main]
2022-11-30 17:49:33,563 INFO/Broker: [com.microsoft.identity.common.java.result.LocalAuthenticationResult][2022-11-30 17:49:33 - thread_name: pool-27-thread-2, correlation_id: b27725eb-c6fc-4a0f-bdd5-dd5f3f74270b - Android 30] Id Token type: IdToken ThreadPoolExecutor$Worker.run()@641 [pool-14-thread-1]
2022-11-30 17:49:33,563 INFO/Broker: [com.microsoft.identity.common.java.result.LocalAuthenticationResult][2022-11-30 17:49:33 - thread_name: pool-27-thread-2, correlation_id: b27725eb-c6fc-4a0f-bdd5-dd5f3f74270b - Android 30] Constructing LocalAuthentication result, AccessTokenRecord null: false, AccountRecord null: false, RefreshTokenRecord null or empty: false, IdTokenRecord null: false ThreadPoolExecutor$Worker.run()@641 [pool-14-thread-1]
2022-11-30 17:49:33,564 INFO/App: Token result: Success AadRemoteNgcAuthCheckUseCase$checkForAuth$2.invokeSuspend()@88 [DefaultDispatcher-worker-5]
2022-11-30 17:49:33,564 INFO/Broker: [CommandDispatcher:submitSilent][2022-11-30 17:49:33 - thread_name: pool-27-thread-2, correlation_id: b27725eb-c6fc-4a0f-bdd5-dd5f3f74270b - Android 30] Completed silent request as owner for correlation id : **b27725eb-c6fc-4a0f-bdd5-dd5f3f74270b, with the status : COMPLETED is cacheable : true ThreadPoolExecutor$Worker.run()@641 [pool-14-thread-1]
2022-11-30 17:49:33,564 INFO/App: ListSessionsUseCase request with client request ID: 09871643-7561-4d9a-8e43-567c4d0480cb RemoteAuthenticationManager.listSessions()@201 [DefaultDispatcher-worker-5]

已执行排查操作 #

• 重启手机
• 切换Wi-Fi及移动数据网络
• 验证企业A的凭证发放流程仍正常运行

解决建议 #

1. 检查呈现请求配置匹配性

   • 确认企业B生成的呈现请求中，凭证类型标识符与企业A发放的凭证完全一致，注意大小写、特殊字符的拼写
   • 验证企业B租户是否被授权接收该类型凭证的呈现请求，可能存在权限配置遗漏

2. 核对凭证元数据与受众设置

   • 检查企业A的凭证定义在Microsoft Entra中是否已正确发布，确保元数据URL可正常访问
   • 确认凭证的受众（Audience）配置包含企业B的租户ID或相关实体

3. 确认平台服务状态

   • 查看Microsoft 365服务健康面板，确认Verifiable Credentials服务无服务中断或异常

4. 提交官方支持工单

   • 携带提供的Request ID、Correlation ID及完整错误信息，联系Microsoft技术支持。这类internalServerError属于平台侧问题，需要后台日志排查定位

5. 重新生成呈现请求

   • 删除企业B当前的呈现请求模板，重新创建并生成新的二维码进行测试，排除模板配置异常

内容的提问来源于stack exchange，提问作者Brijesh Shah