Java环境下为Microsoft Graph SDK配置OkHttp代理与SSL跳过的故障排查

核心根因 #

你为OkHttpClient配置的代理、SSL校验跳过逻辑完全没有覆盖整个请求链路：

• microsoft-graph-auth 0.2.0 版本的ClientCredentialProvider在获取访问令牌时，底层依赖Apache Oltu组件的URLConnectionClient实现，直接调用JDK原生HttpURLConnection发起认证请求，全程不会复用你为Graph API配置的带自定义参数的OkHttpClient实例
• 未走自定义配置的认证请求，既不会应用你设置的HTTP代理，也不会应用SSL校验跳过逻辑，因此直接报UnknownHostException: login.microsoftonline.com；由于无法正常获取有效访问令牌，后续请求Graph API时携带的认证头格式无效，才会触发401的InvalidAuthenticationToken错误

适配测试场景的实现方案 #

步骤1：打通认证流程的网络与SSL配置 #

认证流程不接入自定义OkHttp，测试场景下最简便的实现是在程序入口最前置的位置配置JVM全局规则，覆盖底层HttpURLConnection的默认行为：

// 全局代理配置，覆盖Oltu认证请求的网络路由
System.setProperty("http.proxyHost", this.proxyHost);
System.setProperty("http.proxyPort", String.valueOf(this.proxyPort));
System.setProperty("https.proxyHost", this.proxyHost);
System.setProperty("https.proxyPort", String.valueOf(this.proxyPort));

// 全局SSL校验跳过配置，仅测试环境可用
TrustManager[] trustAllCerts = new TrustManager[]{new X509TrustManager() {
    @Override
    public X509Certificate[] getAcceptedIssuers() {
        return new X509Certificate[0];
    }
    @Override
    public void checkServerTrusted(X509Certificate[] certs, String authType) {}
    @Override
    public void checkClientTrusted(X509Certificate[] certs, String authType) {}
}};
SSLContext sc = SSLContext.getInstance("TLS");
sc.init(null, trustAllCerts, new SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
HttpsURLConnection.setDefaultHostnameVerifier((hostname, session) -> true);

说明：如果不想使用全局JVM配置，需要自行替换Oltu默认的URLConnectionClient实现为OkHttp版本，但当前版本的SDK没有开放该组件的替换入口，测试场景下实现成本远高于全局配置方案，不推荐。

步骤2：修正Graph API请求侧的OkHttp配置 #

移除你之前代码中冗余的空认证Provider实现，直接构造独立的OkHttpClient并注入Graph客户端，核心修正后代码：

// 全信任SSL上下文初始化
final TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {
    @Override
    public X509Certificate[] getAcceptedIssuers() {
        return new X509Certificate[0];
    }
    @Override
    public void checkServerTrusted(final X509Certificate[] arg0, final String arg1) {}
    @Override
    public void checkClientTrusted(final X509Certificate[] arg0, final String arg1) {}
} };
final SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, trustAllCerts, new java.security.SecureRandom());
final X509TrustManager trustManager = (X509TrustManager) trustAllCerts[0];

// 初始化带自定义代理、SSL配置的OkHttpClient
final OkHttpClient httpClient = new OkHttpClient.Builder()
        .proxy(new Proxy(Proxy.Type.HTTP, new InetSocketAddress(this.proxyHost, this.proxyPort)))
        .sslSocketFactory(sslContext.getSocketFactory(), trustManager)
        .hostnameVerifier((hostname, session) -> true)
        .connectTimeout(30, TimeUnit.SECONDS)
        .readTimeout(60, TimeUnit.SECONDS)
        .build();

// 初始化认证Provider
final ClientCredentialProvider authProvider = new ClientCredentialProvider(
        this.clientId, this.scopes, this.clientSecret, this.tenantId, NationalCloud.Global
);

// 构建Graph服务客户端
final IGraphServiceClient graphClient = GraphServiceClient.builder()
        .authenticationProvider(authProvider)
        .httpProvider(new CoreHttpProvider(httpClient, authProvider, null))
        .buildClient();

风险提示：SSL全信任跳过、代理全局配置仅可用于测试隔离环境，生产环境必须加载受信任的CA证书链，关闭主机名校验与证书校验逻辑，防范中间人攻击风险。

内容的提问来源于stack exchange，提问作者Sujit J