Golang集成Azure AD OAuth回调报token response 400 Bad Request

已确认配置的client id、client secret均正确，设置的回调地址为http://localhost:8080/callback，且已在Azure AD中开启公共客户端流。运行代码后可正常展示登录页面，点击登录后可通过邮箱、密码完成身份认证，但跳转至回调地址时触发报错：Handler error: token response was 400 Bad Request。
完整复现代码如下：

package main

import (
    "crypto/sha256"
    "encoding/base64"
    "encoding/gob"
    "encoding/json"
    "fmt"
    "html/template"
    "log"
    "net/http"
    "net/url"
    "strings"

    "github.com/davecgh/go-spew/spew"
    "github.com/gorilla/sessions"

    _ "golang.org/x/net/context"
    "golang.org/x/oauth2"
)

const (
    redirectURI string = "http://localhost:8080/callback"
)

// Authentication + Encryption key pairs
var sessionStoreKeyPairs = [][]byte{
    []byte("something-very-secret"),
    nil,
}

var store sessions.Store

var (
    clientID string
    config   *oauth2.Config
)

type User struct {
    Email       string
    DisplayName string
}

func init() {
    // Create file system store with no size limit
    fsStore := sessions.NewFilesystemStore("", sessionStoreKeyPairs...)
    fsStore.MaxLength(0)
    store = fsStore

    gob.Register(&User{})
    gob.Register(&oauth2.Token{})
}

func main() {
    log.SetFlags(log.LstdFlags | log.Llongfile)

    clientID = "<client-id>"
    if clientID == "" {
        log.Fatal("AZURE_AD_CLIENT_ID must be set.")
    }

    config = &oauth2.Config{
        ClientID:     clientID,
        ClientSecret: "<secret-id>", 
        RedirectURL:  redirectURI,

        Endpoint: oauth2.Endpoint{
            AuthURL:  "https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize",
            TokenURL: "https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token",
        },

        Scopes: []string{"User.Read"},
    }

    http.Handle("/", handle(IndexHandler))
    http.Handle("/callback", handle(CallbackHandler))

    log.Fatal(http.ListenAndServe(":8080", nil))
}

type handle func(w http.ResponseWriter, req *http.Request) error

func (h handle) ServeHTTP(w http.ResponseWriter, req *http.Request) {
    defer func() {
        if r := recover(); r != nil {
            log.Printf("Handler panic: %v", r)
        }
    }()
    if err := h(w, req); err != nil {
        log.Printf("Handler error: %v", err)

        if httpErr, ok := err.(Error); ok {
            http.Error(w, httpErr.Message, httpErr.Code)
        }
    }
}

type Error struct {
    Code    int
    Message string
}

func (e Error) Error() string {
    if e.Message == "" {
        e.Message = http.StatusText(e.Code)
    }
    return fmt.Sprintf("%d: %s", e.Code, e.Message)
}

func IndexHandler(w http.ResponseWriter, req *http.Request) error {
    session, _ := store.Get(req, "session")

    var token *oauth2.Token
    if req.FormValue("logout") != "" {
        session.Values["token"] = nil
        sessions.Save(req, w)
    } else {
        if v, ok := session.Values["token"]; ok {
            token = v.(*oauth2.Token)
        }
    }

    var data = struct {
        Token   *oauth2.Token
        AuthURL string
    }{
        Token:   token,
        AuthURL: config.AuthCodeURL(SessionState(session), oauth2.AccessTypeOnline),
    }

    return indexTempl.Execute(w, &data)
}

var indexTempl = template.Must(template.New("").Parse(`<!DOCTYPE html>
<html>
  <head>
    <title>Azure AD OAuth2 Example</title>

    <link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-BVYiiSIFeK1dGmJRAkycuHAHRg32OmUcww7on3RYdg4Va+PmSTsz/K68vbdEjh4u" crossorigin="anonymous">
  </head>
  <body class="container-fluid">
    <div class="row">
      <div class="col-xs-4 col-xs-offset-4">
        <h1>Azure AD OAuth2 Example</h1>
{{with .Token}}
        <div id="displayName"></div>
        <a href="/?logout=true">Logout</a>
{{else}}
        <a href="{{$.AuthURL}}">Login</a>
{{end}}
      </div>
    </div>

    <script src="https://code.jquery.com/jquery-3.2.1.min.js" integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4=" crossorigin="anonymous"></script>
    <script>
{{with .Token}}
      var token = {{.}};

      $.ajax({
        url: 'https://graph.windows.net/me?api-version=1.6',
        dataType: 'json',
        success: function(data, status) {
            $('#displayName').text('Welcome ' + data.displayName);
        },
        beforeSend: function(xhr, settings) {
          xhr.setRequestHeader('Authorization', 'Bearer ' + token.access_token);
        }
      });
{{end}}
    </script>
  </body>
</html>
`))

func CallbackHandler(w http.ResponseWriter, req *http.Request) error {
    session, _ := store.Get(req, "session")

    if req.FormValue("state") != SessionState(session) {
        return Error{http.StatusBadRequest, "invalid callback state"}
    }

    form := url.Values{}
    form.Set("grant_type", "authorization_code")
    form.Set("client_id", clientID)
    form.Set("code", req.FormValue("code"))
    form.Set("redirect_uri", redirectURI)
    form.Set("resource", "https://graph.windows.net/<tenant-id>/oauth2/authorize")

    tokenReq, err := http.NewRequest(http.MethodPost, config.Endpoint.TokenURL, strings.NewReader(form.Encode()))
    if err != nil {
        return fmt.Errorf("error creating token request: %v", err)
    }
    tokenReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")

    resp, err := http.DefaultClient.Do(tokenReq)
    if err != nil {
        return fmt.Errorf("error performing token request: %v", err)
    }
    defer resp.Body.Close()

    if resp.StatusCode >= 400 {
        return fmt.Errorf("token response was %s", resp.Status)
    }

    var token oauth2.Token
    if err := json.NewDecoder(resp.Body).Decode(&token); err != nil {
        return fmt.Errorf("error decoding JSON response: %v", err)
    }

    session.Values["token"] = &token
    if err := sessions.Save(req, w); err != nil {
        return fmt.Errorf("error saving session: %v", err)
    }

    http.Redirect(w, req, "/", http.StatusFound)
    return nil
}

func SessionState(session *sessions.Session) string {
    return base64.StdEncoding.EncodeToString(sha256.New().Sum([]byte(session.ID)))
}

func dump(v interface{}) {
    spew.Dump(v)
}

• 首先优化错误日志：当前代码仅判断响应状态码返回400，没有读取Azure AD返回的响应体内容，Azure返回的400响应会携带明确的AADSTS开头错误码和错误描述，打印响应体内容可以直接定位参数问题。
• 核心参数错误：你使用的是Azure AD v2.0 OAuth端点，但手动构造令牌请求时传入了v2.0端点不支持的resource参数，且该参数取值本身填写错误（填成了authorize端点地址，不是资源URI）。v2.0端点完全通过scope参数控制权限范围，不需要传resource字段。
• 漏传必填参数：你手动拼接令牌请求表单时，没有传入client_secret字段，对于配置为Web类型的应用，换令牌时必须携带该参数。
• 接口版本不匹配：你申请的User.Read是Microsoft Graph的权限，但前端调用的是已废弃的老版Azure AD Graph（graph.windows.net）接口，就算拿到令牌调用也会报权限错误。
• 冗余实现问题：你已经引入了golang.org/x/oauth2库，完全不需要手动构造HTTP请求换令牌，手动拼参数非常容易漏字段、格式错误，直接用库内置的Exchange方法即可自动处理所有参数拼装逻辑。
• 配置冲突检查：如果你确实要使用公共客户端流，需要把应用注册的平台配置为「移动和桌面应用」，这种场景下换令牌不需要传client_secret；如果平台配置为「Web」，则需要关闭公共客户端流，换令牌时必须携带client_secret，两个配置不要冲突。

修复后核心代码示例 #

回调处理逻辑替换 #

把原来CallbackHandler里手动构造请求的部分替换为oauth2库原生实现：

func CallbackHandler(w http.ResponseWriter, req *http.Request) error {
    session, _ := store.Get(req, "session")

    if req.FormValue("state") != SessionState(session) {
        return Error{http.StatusBadRequest, "invalid callback state"}
    }

    // 直接用oauth2库内置方法换令牌，自动处理参数拼装
    token, err := config.Exchange(req.Context(), req.FormValue("code"))
    if err != nil {
        // 这里返回的err会包含Azure返回的具体错误信息
        return fmt.Errorf("exchange token error: %v", err)
    }

    session.Values["token"] = token
    if err := sessions.Save(req, w); err != nil {
        return fmt.Errorf("error saving session: %v", err)
    }

    http.Redirect(w, req, "/", http.StatusFound)
    return nil
}

前端Graph调用地址修正 #

把模板里的接口地址换成Microsoft Graph的v1.0端点：

$.ajax({
    url: 'https://graph.microsoft.com/v1.0/me',
    dataType: 'json',
    success: function(data, status) {
        $('#displayName').text('Welcome ' + data.displayName);
    },
    beforeSend: function(xhr, settings) {
      xhr.setRequestHeader('Authorization', 'Bearer ' + token.access_token);
    }
});

内容的提问来源于stack exchange，提问作者omkar