EWS应用OAuth认证下公共文件夹PullSubscription无法获取事件求助

问题描述 #

我正在为EWS应用添加OAuth支持，遇到公共文件夹PullSubscription无法获取事件的问题，邮箱文件夹无此异常，仅公共文件夹受影响。

代码仅做两处变更：

• Exchange Service使用OAuthCredentials
• 模拟拥有公共文件夹所有者权限的邮箱地址

此前采用基本认证时，使用服务账户凭据，无需模拟即可正常获取公共文件夹的PullSubscription。当前创建PullSubscription时无报错，能查到对应的ID，但向文件夹添加项目后调用GetEvents方法，始终无事件返回。

以下是GetEvents的请求响应跟踪信息：

26-8-2022 17:56:31 : EwsRequestHttpHeaders --- <Trace Tag="EwsRequestHttpHeaders" Tid="1" Time="2022-08-26 15:56:31Z">
 POST /EWS/Exchange.asmx HTTP/1.1
 Content-Type: text/xml; charset=utf-8
 Accept: text/xml
 User-Agent: 
 ExchangeServicesClient/15.00.0913.015
    
 Accept-Encoding: gzip,deflate
 X-AnchorMailbox: publicfolderstore_bac380fe@domainname.onmicrosoft.com
    
 X-PublicFolderMailbox: publicfolderstore_bac380fe@domainname.onmicrosoft.com
    
 X-PreferServerAffinity: True
    
 Authorization: Bearer eyJ0eXAiOiJKV1QiLCJub25jZSI6IkRPRTZVMFJHdnM0X3FHanBhbU9KTjM1VHVsdmNRWUtjNHlFVDk2YnhfQjgiLCJhbGciOiJSUzI1NiIsIng1dCI6IjJaUXBKM1VwYmpBWVhZR2FYRUpsOGxWMFRPSSIsImtpZCI6IjJaUXBKM1VwYmpBWVhZR2FYRUpsOGxWMFRPSSJ9.eyJhdWQiOiJodHRwczovL291dGxvb2sub2ZmaWNlMzY1LmNvbSIsImlzcyI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0L2VkMDc0NDQxLWI4MjUtNDJjYy04ODU2LTE3YWUzYjBiMmY0Mi8iLCJpYXQiOjE2NjE1Mjg5NjcsIm5iZiI6MTY2MTUyODk2NywiZXhwIjoxNjYxNTMyODY3LCJhaW8iOiJFMlpnWUxpVHNzZktUS2x6bGtGdzNoS3Z5WmIyQUE9PSIsImFwcF9kaXNwbGF5bmFtZSI6IkV4Y2hhbmdlR3JvdXBDYWxlbmRhciIsImFwcGlkIjoiZmRlYTFhZmYtZmVhYS00ZDA0LWI3OTUtNTVkODczZjIyODNiIiwiYXBwaWRhY3IiOiIxIiwiaWRwIjoiaHR0cHM6Ly9zdHMud2luZG93cy5uZXQvZWQwNzQ0NDEtYjgyNS00MmNjLTg4NTYtMTdhZTNiMGIyZjQyLyIsIm9pZCI6IjM4MDkxNzg0LWU5NzItNDk4ZS05ZTlkLTZmMGE2NzQ4MTMyZSIsInJoIjoiMC5BVThBUVVRSDdTVzR6RUtJVmhldU93c3ZRZ0lBQUFBQUFQRVB6Z0FBQUFBQUFBQlBBQUEuIiwicm9sZXMiOlsiZnVsbF9hY2Nlc3NfYXNfYXBwIl0sInNpZCI6IjYwN2UxMDI4LTUwOTAtNDRjMS04NDc1LTFiNDFmZjQ0NGI4OSIsInN1YiI6IjM4MDkxNzg0LWU5NzItNDk4ZS05ZTlkLTZmMGE2NzQ4MTMyZSIsInRpZCI6ImVkMDc0NDQxLWI4MjUtNDJjYy04ODU2LTE3YWUzYjBiMmY0MiIsInV0aSI6Ik5oY3hiMHIxeUVpbGlIR2hWRFU0QUEiLCJ2ZXIiOiIxLjAiLCJ3aWRzIjpbIjA5OTdhMWQwLTBkMWQtNGFjYi1iNDA4LWQ1Y2E3MzEyMWU5MCJdfQ.GeDfpt7ABAp5WpL9su265dV9UvilX6lxt5eCj7FWrBqGLhSNOL6fRfGGH-98nOKbqONmpEiXe0M61cOagKnrlNoyNgnvsC6bE1v6Nt_Uk44MPHfAs4MW1GDn9RtGbL9EEIDTZFg4qwrfRToOkyliFIcsfpXnXKmBiVSN0XFXtyHdvJpCjrb7Jj4o-qzGKKF1BREAVHrpIHBMz1r8u3UVihMQBEnI8X-a_qOF7MmgeyKBCLabZ5oFXOVsVPCI9re89W0q9jx04d0gnBLSAsjSHh94aG0P7ffpjupu3GSpZAm6Y9AkWv629EDO_C1wOshdI8--F9yyqhJ44Oh90Ha9xw
    
    
 </Trace>
    
26-8-2022 17:56:31 : EwsRequest --- <Trace Tag="EwsRequest" Tid="1" Time="2022-08-26 15:56:31Z" Version="15.00.0913.015">
   <?xml version="1.0" encoding="utf-8"?>
   <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
     <soap:Header>
       <t:RequestServerVersion Version="Exchange2013" />
       <t:ExchangeImpersonation>
         <t:ConnectingSID>
           <t:SmtpAddress>account@domainname.com</t:SmtpAddress>
         </t:ConnectingSID>
       </t:ExchangeImpersonation>
     </soap:Header>
     <soap:Body>
       <m:GetEvents>
         <m:SubscriptionId>JwBhczhwcjA3bWI3OTI1LmV1cnByZDA3LnByb2Qub3V0bG9vay5jb20QAAAAS114Ai9w+UayiTSZLtc6DY6SxEJ7h9oIEAAAAAAAAAAAAAAAAAAAAAAAAAA=</m:SubscriptionId>
         <m:Watermark>AQAAABTg+YC4KZFNttW01ElEHaecAgsrAAAAAAA=</m:Watermark>
       </m:GetEvents>
     </soap:Body>
   </soap:Envelope>
 </Trace>
    
26-8-2022 17:56:31 : EwsResponseHttpHeaders --- <Trace Tag="EwsResponseHttpHeaders" Tid="1" Time="2022-08-26 15:56:31Z">
 HTTP/1.1 200 OK
 Transfer-Encoding: chunked
 request-id: de8811fe-8069-c2ff-15a7-5ac62e39d3f5
 Alt-Svc: h3=":443",h3-29=":443"
 X-CalculatedFETarget: AM6PR01CU002.internal.outlook.com
 X-BackEndHttpStatus: 200,200
 X-CalculatedBETarget: AS8PR07MB7925.eurprd07.PROD.OUTLOOK.COM
 X-RUM-Validated: 1
 x-ms-appId: fdea1aff-feaa-4d04-b795-55d873f2283b
 Restrict-Access-Confirm: 1
 x-EwsHandler: GetEvents
 X-BeSku: WCS6
 X-DiagInfo: AS8PR07MB7925
 X-BEServer: AS8PR07MB7925
 X-Proxy-RoutingCorrectness: 1
 X-Proxy-BackendServerStatus: 200
 X-FEProxyInfo: AM0PR02CA0136.EURPRD02.PROD.OUTLOOK.COM
 X-FEEFZInfo: AMS
 X-FEServer: AM6PR01CA0042,AM0PR02CA0136
 X-FirstHopCafeEFZ: AMS
 Cache-Control: private
 Content-Type: text/xml; charset=utf-8
 Date: Fri, 26 Aug 2022 15:56:28 GMT
 Set-Cookie: exchangecookie=52d38d4eb5c14276b165655c6cd18691; path=/; secure
 Server: Microsoft-IIS/10.0
 X-AspNet-Version: 4.0.30319
 X-Powered-By: ASP.NET
    
    
 </Trace>
    
26-8-2022 17:56:31 : EwsResponse --- <Trace Tag="EwsResponse" Tid="1" Time="2022-08-26 15:56:31Z" Version="15.00.0913.015">
   <?xml version="1.0" encoding="utf-8"?>
   <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
     <s:Header>
       <h:ServerVersionInfo MajorVersion="15" MinorVersion="20" MajorBuildNumber="5588" MinorBuildNumber="3" Version="V2018_01_08" xmlns:h="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" />
     </s:Header>
     <s:Body>
       <m:GetEventsResponse xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types">
         <m:ResponseMessages>
           <m:GetEventsResponseMessage ResponseClass="Success">
             <m:ResponseCode>NoError</m:ResponseCode>
             <m:Notification>
               <t:SubscriptionId>JwBhczhwcjA3bWI3OTI1LmV1cnByZDA3LnByb2Qub3V0bG9vay5jb20QAAAAS114Ai9w+UayiTSZLtc6DY6SxEJ7h9oIEAAAAAAAAAAAAAAAAAAAAAAAAAA=</t:SubscriptionId>
               <t:PreviousWatermark>AQAAABTg+YC4KZFNttW01ElEHaecAgsrAAAAAAA=</t:PreviousWatermark>
               <t:MoreEvents>false</t:MoreEvents>
               <t:StatusEvent>
                 <t:Watermark>AQAAABTg+YC4KZFNttW01ElEHaf4BQsrAAAAAAE=</t:Watermark>
               </t:StatusEvent>
             </m:Notification>
           </m:GetEventsResponseMessage>
         </m:ResponseMessages>
       </m:GetEventsResponse>
     </s:Body>
   </s:Envelope>
 </Trace>

可能的原因及排查建议 #

1. 模拟权限与OAuth上下文冲突 #

• 确认模拟的邮箱账户拥有目标公共文件夹的所有者权限，包括对公共文件夹邮箱的访问权限
• 尝试移除ExchangeImpersonation头，直接使用OAuth凭据对应的账户创建订阅并调用GetEvents，验证是否是模拟机制导致的问题

2. OAuth令牌权限不足 #

• 检查OAuth令牌的scope，应用权限模式需包含full_access_as_app，委托权限模式需包含EWS.AccessAsUser.All
• 确认应用注册时已获取管理员同意的公共文件夹相关权限

3. 公共文件夹路由与订阅目标错误 #

• 验证X-PublicFolderMailbox和X-AnchorMailbox头指向的公共文件夹邮箱是否正确
• 检查创建PullSubscription时指定的文件夹路径，确保订阅的是目标公共文件夹而非根目录或其他无关文件夹

4. Watermark同步异常 #

• 使用空Watermark重新创建订阅，避免旧Watermark导致服务器判定无新事件
• 调用GetEvents时使用响应中StatusEvent返回的新Watermark重试

5. EWS版本兼容性问题 #

• 当前请求使用Exchange2013版本，尝试升级请求版本至V2018_01_08（与响应中的ServerVersion一致），验证是否是版本兼容问题

6. 服务器端订阅状态异常 #

• 通过EWS的GetSubscriptions方法查询订阅状态，确认订阅是否处于活跃状态
• 检查Exchange服务器事件日志，查看是否有公共文件夹订阅相关的错误或警告

内容的提问来源于stack exchange，提问作者John Veld