Azure AD B2B场景下Live账户访客传租户ID时OAuth登录失败

场景背景 #

• 已完成Azure AD B2B集成配置，将Live ID账户添加至Office 365租户目录中。
• 发起OAuth流程时，只要请求中指定租户ID，仅这类Live ID关联的访客用户无法正常登录，同租户内的原生普通用户可正常使用OAuth流程完成认证。
• 携带租户ID的初始OAuth请求提交给这类访客用户时，会直接触发流程失败。

带租户ID的初始OAuth请求示例：

https://login.microsoftonline.com/c7105dda-a548-4def-8ee7-e992e0e6dcb0/oauth2/authorize?client_id=<ClientID>&redirect_uri=https://localhost:44349/signin-oidc&response_type=code id_token&scope=openid profile&response_mode=form_post&nonce=637505268863366814.NGIzNDlkNmUtNDE0Mi00ZmM5LWE1MjMtNDJmZTUwMzMxMjU4YWQ3ZTQ5YTItMjAzZS00ZjA0LTgyMjEtZDgwZTRmYmE0MDQz&domain_hint=figg.onmicrosoft.com&state=CfDJ8AmIwUTtfIRKmiJxVBYIakWifGVqwnP3VpGTBqp-uSv8qJ9T6WAh9GIuoHlMImbFEcibNio33A7zBAaF-G5mF6o_JrObRKzF_pOSYukXWF76AhGtyfWtHzgo4oYZmnwlwGRJiF9QLP964ShDXPrHRoilGubFOH-EHYDh8pshSXwEMkz5Bkosf6tWSk8CI5QSXBLL4Xs78noO0s17e687ZGpRpePzhoWKxNbnGvhGbwh9_OlJeNAHPsvy04bF8rGD0kHKrrBZ8tknR4ebDNlTnEpTHwz47YIBSNuclSCi-MOiPI8VIBo0JsyD3IYn0cS-0xWEdyh6Ng-D46HBjRzYkT1yT535Hw6waCLAWmPs4QiHAdVy21xn5kt0rB2nJKYFiWgWLAlaTdAh9oq4RLU6IRV7njf72wfNrRBlL_5WfxgxvCV2RUWhlBJhZpkXhZA6g6wnqJgobyDaw7wCbttbBGOB6Epr6VBxQgrsnMtk3-EacAI1eSk0HrTxkBDPyzW17ZOZGEXRFyxb9X79kSlJQMsOUp3uJ_tpMcpUmMORlsQ5dy8UzHsiUrPFP95Iu1rjV0gFuQlkVSWG6MBUfipuWf0iS2TrJMYZWtnjXrthSIik9GFJC6a7mHRgtd5210PK5PlgVQE3Sh2kK2zDF__BJv_t2hQknHzcyIdclBJm6YBrn_DAi32MPAPcmkHH84g7T06WnRQL9ShAFmzhho1Z-_4bntZ-KCqBhczgz905R_fs8DIDh788WxIAPwiK6qTMHE5EhLdDVEE2-rrAgtITfgIa9kLilNdKIbz1bpKeN67GCCIgDbR-4d0vOx1RsXEp0pMw12tLqtFf5DgMKX09pEWjj1gA6YyH1cb1cIo15Jaw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=5.3.0.0

• 针对同一租户、同一Live ID访客用户，OAuth请求中不传入租户ID、改用common公共端点时，可正常完成全流程登录。

不携带租户ID的OAuth请求示例：

https://login.microsoftonline.com/common/oauth2/authorize?client_id=<ClientId>&redirect_uri=https://localhost:44349/signin-oidc&response_type=code id_token&scope=openid profile&response_mode=form_post&nonce=637505274276407222.NGIyNGZiMzItNmU3YS00YWNhLWI0MGYtZjM3N2NiNjNlNzUyYzQ4ZWFmMjgtZmZkNi00MjUzLWJmOGYtZjU2Y2FkZThkZjM3&state=CfDJ8AmIwUTtfIRKmiJxVBYIakXDHn47C6MB0QV1aAZrRkifxM51hUeejmGwy6CN1_p1SUT-M5-OAMXmAJlXTWAnoRRW95FvI9cP2bSAtkALBwjXD2ahPMtVrPfm0dzvvKXmxqDH40fcnjc9zoJNHG7pyBqat3MlQGbrbeEQW2loX7Quyf7F4q5JNFHR2G7GgIRmNTzEPpss5HE5VFTtfWCsB03VNLE0f7lMm6G19qLAfdu5aA9XMd9F-9Gn9u27gYT20kcPRx3iyIMtMNexosKhewYJf8PSKD0V-A0ilWFqv9l78C7JO2Ktj53pe1Xt7ks6-9THMdsz6YAjkv0aqA1aF14mhVa5AQrLwQgZo5a8x7HylMrVtUrs9dCwid03_L8XfDPywWDw5ro3qy5UZzOmtUBErAW8wkyr1ezqtobjrV0PrMpTQ_4TxiBIyKshuhRN79BDcChrAQcRxtEitEn-9R7558eyzOgi7ig8AhCRdtnM&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=5.3.0.0

报错表现 #

• 携带租户ID发起请求时，流程最终会跳转至Live ID的oauth接口，触发页面不存在的404错误。
• 报错对应的跳转地址与提示内容：

无法找到login.live.com页面，该网页地址无对应内容：
https://login.live.com/oauth20_authorize.srf?response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&scope=openid+profile+email+offline_access

• 已留存对应报错的完整页面截图，可直观展示浏览器端的404提示详情。

内容的提问来源于stack exchange，提问作者Deepak Sharma