使用MSAL4J创建Azure AD用户时返回HTTP/1.1 401 Unauthorized

使用MSAL4J库编写Java代码，调用Microsoft Graph接口在Azure Active Directory中创建用户时，可通过用户名密码流正常获取访问令牌，但创建用户请求始终返回401未授权错误。
相关实现代码如下：

HttpPost create = null;
HttpGet getRequest = null;
HttpClient client = null;
HttpResponse response = null;
IAuthenticationResult result = null;

PublicClientApplication pca = PublicClientApplication.builder("client_id")
        .authority("https://login.microsoftonline.com/{tenant_id}/").build();

Set<String> scope = new HashSet<>();
scope.add("User.ReadWrite.All");
scope.add("User.ReadWrite");
scope.add("Directory.ReadWrite");
scope.add("Directory.ReadWrite.All");

UserNamePasswordParametersBuilder parameters = UserNamePasswordParameters.builder(scope,
        "administrator@xxxxxxxx.onmicrosoft.com", "xxxxxxxx".toCharArray());

try {
    result = pca.acquireToken(parameters.build()).join();
} catch (Exception e) {
    e.printStackTrace();
}

StringEntity inputJSONStringEntity = new StringEntity(
        "{\"passwordProfile\":{\"password\":\"User120222\"},\"country\":\"India\",\"city\":\"Mumbai\",\"displayName\":\"User1\",\"companyName\":\"companyName\",\"givenName\":\"User1\",\"jobTitle\":\"Developer\",\"accountEnabled\":true,\"streetAddress\":\"St1\",\"surname\":\"User1\",\"state\":\"MH\",\"department\":\"ESE\",\"userPrincipalName\":\"User1@xxxxxxxx.onmicrosoft.com\",\"mailNickname\":\"User1\"}");

client = HttpClientBuilder.create().build();
create = new HttpPost("https://graph.microsoft.com/v1.0/users");

create.addHeader("Content-Type", "application/json");

create.addHeader("Authorization", "Bearer" + result.accessToken());

create.setEntity(inputJSONStringEntity);
response = client.execute(create);

接口返回的401响应头信息如下：

HttpResponseProxy{HTTP/1.1 401 Unauthorized [Transfer-Encoding: chunked, Content-Type: application/json, Vary: Accept-Encoding, Strict-Transport-Security: max-age=31536000, request-id: d3f08ea0-ee39-41fd-8f41-338392697300, client-request-id: d3f08ea0-ee39-41fd-8f41-338392697300, x-ms-ags-diagnostic: }, WWW-Authenticate: Bearer realm="", authorization_uri="https://login.microsoftonline.com/common/oauth2/authorize", client_id="00000003-0000-0000-c000-000000000000", Date: Fri, 17 Jun 2022 06:05:59 GMT] org.apache.http.client.entity.DecompressingEntity@1e127982}

解析获取到的访问令牌，aud、scp字段内容如下：

{"aud": "00000003-0000-0000-c000-000000000000",
"scp": "Directory.AccessAsUser.All Directory.Read.All Directory.ReadWrite.All Directory.Write.Restricted DirectoryRecommendations.Read.All DirectoryRecommendations.ReadWrite.All Files.Read Files.Read.All Files.Read.Selected Files.ReadWrite Files.ReadWrite.All Files.ReadWrite.AppFolder Files.ReadWrite.Selected RoleAssignmentSchedule.Read.Directory RoleAssignmentSchedule.ReadWrite.Directory RoleEligibilitySchedule.Read.Directory RoleEligibilitySchedule.ReadWrite.Directory RoleManagement.Read.Directory RoleManagement.ReadWrite.Directory RoleManagementPolicy.Read.Directory RoleManagementPolicy.ReadWrite.Directory User.Export.All User.Invite.All User.ManageIdentities.All User.Read User.Read.All User.ReadBasic.All User.ReadWrite User.ReadWrite.All profile openid email"}

• 核心问题是Authorization请求头格式错误：代码中拼接认证头时，Bearer和访问令牌字符串之间缺少空格，Microsoft Graph服务端无法正确识别传入的令牌，直接返回401错误。
• 令牌本身有效性、权限均符合要求：解析后的aud字段为Microsoft Graph的官方资源ID，scp字段已包含创建用户所需的User.ReadWrite.All、Directory.ReadWrite.All委托权限，不存在权限不足、令牌受众不匹配的问题。

1. 修正Authorization请求头的拼接逻辑，在Bearer后增加空格，修改后的代码如下：

create.addHeader("Authorization", "Bearer " + result.accessToken());

2. 兜底校验项（当前场景无需修改，仅作排障参考）：
   • 确认Azure AD应用已开启公共客户端流，否则用户名密码流无法正常获取令牌
   • 确认登录使用的管理员账号未开启MFA多因素认证，ROPC流不支持MFA场景
   • 若修复头格式后仍报错，读取401响应的响应体内容，可获取更明确的错误提示

内容的提问来源于stack exchange，提问作者Swap