使用Microsoft Account库遇AADSTS700025错误：公共客户端无需密钥

问题详情 #

异常信息：OAuth令牌端点请求失败，响应体内容为：{"error":"invalid_client","error_description":"AADSTS700025: Client is public so neither 'client_assertion' nor 'client_secret' should be presented"}

相关配置代码：

builder.Services.AddAuthentication()
.AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options =>
{
    options.LoginPath = "/page";
    options.LogoutPath = "/page";
    options.AccessDeniedPath = "/page?code={0}";
    options.ExpireTimeSpan = TimeSpan.FromMinutes(tiempoDeSesion);
    options.Cookie.Name = ".CookieName.Sec";
    options.SlidingExpiration = true;
})
.AddMicrosoftAccount(microsoftOptions =>
{
    microsoftOptions.ClientId = builder.Configuration["AzureAd:ClientId"];
    microsoftOptions.ClientSecret = builder.Configuration["AzureAd:ClientSecret"];
    microsoftOptions.CallbackPath = new PathString("/signin-microsoft-token");
    microsoftOptions.AuthorizationEndpoint = $"https://login.microsoftonline.com/{builder.Configuration["AzureAd:TenantId"]}/oauth2/v2.0/authorize";
    microsoftOptions.TokenEndpoint = $"https://login.microsoftonline.com/{builder.Configuration["AzureAd:TenantId"]}/oauth2/v2.0/token";
    microsoftOptions.Scope.Add("https://graph.microsoft.com/user.read");
    microsoftOptions.SaveTokens = true;
    microsoftOptions.ClaimActions.MapJsonKey(ClaimTypes.NameIdentifier, "id");
    microsoftOptions.ClaimActions.MapJsonKey(ClaimTypes.Name, "displayName");
    microsoftOptions.ClaimActions.MapJsonKey(ClaimTypes.GivenName, "givenName");
    microsoftOptions.ClaimActions.MapJsonKey(ClaimTypes.Surname, "surname");
    microsoftOptions.ClaimActions.MapCustomJson(ClaimTypes.Email,
                                   user => user.GetString("mail") ?? user.GetString("userPrincipalName"));
});

解决方案 #

• 你的Azure AD应用被配置为公共客户端（如移动/桌面类应用），这类客户端无法安全存储密钥，因此Azure AD禁止其在令牌请求中携带client_secret或client_assertion。
• 直接移除配置代码中的microsoftOptions.ClientSecret = builder.Configuration["AzureAd:ClientSecret"];行即可。

修改后的配置代码：

builder.Services.AddAuthentication()
.AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options =>
{
    options.LoginPath = "/page";
    options.LogoutPath = "/page";
    options.AccessDeniedPath = "/page?code={0}";
    options.ExpireTimeSpan = TimeSpan.FromMinutes(tiempoDeSesion);
    options.Cookie.Name = ".CookieName.Sec";
    options.SlidingExpiration = true;
})
.AddMicrosoftAccount(microsoftOptions =>
{
    microsoftOptions.ClientId = builder.Configuration["AzureAd:ClientId"];
    // 移除ClientSecret配置
    microsoftOptions.CallbackPath = new PathString("/signin-microsoft-token");
    microsoftOptions.AuthorizationEndpoint = $"https://login.microsoftonline.com/{builder.Configuration["AzureAd:TenantId"]}/oauth2/v2.0/authorize";
    microsoftOptions.TokenEndpoint = $"https://login.microsoftonline.com/{builder.Configuration["AzureAd:TenantId"]}/oauth2/v2.0/token";
    microsoftOptions.Scope.Add("https://graph.microsoft.com/user.read");
    microsoftOptions.SaveTokens = true;
    microsoftOptions.ClaimActions.MapJsonKey(ClaimTypes.NameIdentifier, "id");
    microsoftOptions.ClaimActions.MapJsonKey(ClaimTypes.Name, "displayName");
    microsoftOptions.ClaimActions.MapJsonKey(ClaimTypes.GivenName, "givenName");
    microsoftOptions.ClaimActions.MapJsonKey(ClaimTypes.Surname, "surname");
    microsoftOptions.ClaimActions.MapCustomJson(ClaimTypes.Email,
                                   user => user.GetString("mail") ?? user.GetString("userPrincipalName"));
});

补充说明：
可在Azure门户的应用注册页面，检查「认证」->「高级设置」中的「允许公共客户端流」是否开启，若开启则属于公共客户端范畴，无需配置客户端密钥。

内容的提问来源于stack exchange，提问作者Paula Code