Outlook插件嵌套应用认证触发AADSTS65001授权同意错误求助

问题概述 #

在实现Outlook插件嵌套应用单点登录（SSO）时，使用MSAL和Teams CLI发起token请求后返回权限同意错误：

{
    "error": "invalid_grant",
    "error_description": "AADSTS65001: The user or administrator has not consented to use the application with ID '2ededef4-ffcb-4740-ad6e-0e4a9125463f' named 'Ramsay Companion +'. Send an interactive authorization request for this user and resource. Trace ID: f74d15e5-5caa-4d96-bdde-8cc509124200 Correlation ID: 0197a0a7-69ea-7955-88dc-8f35628fbb13 Timestamp: 2025-06-24 06:36:55Z",
    "error_codes": [65001],
    "timestamp": "2025-06-24 06:36:55Z",
    "trace_id": "f74d15e5-5caa-4d96-bdde-8cc509124200",
    "correlation_id": "0197a0a7-69ea-7955-88dc-8f35628fbb13",
    "suberror": "consent_required"
}

核心原因 #

当前用户或租户管理员未对目标应用（ID: 2ededef4-ffcb-4740-ad6e-0e4a9125463f）授予所需权限，静默token获取流程失败，且交互式授权未正确触发权限同意步骤。

解决方案 #

1. 确认并配置应用权限 #

• 登录Entra ID管理中心，找到目标应用注册
• 进入权限 > 添加权限，确认已添加代码中请求的email、profile、openid、offline_access权限
• 若为租户级应用，点击授予管理员同意，完成租户范围内的权限批量授权

2. 优化交互式同意触发逻辑 #

调整代码逻辑，确保捕获到consent_required错误时强制触发同意提示：

const Email: React.FC = () => {
  useEffect(() => {
    Office.onReady(async (info) => {
      if (info.host === Office.HostType.Outlook) {
        const pca = await createNestablePublicClientApplication(msEntraconfig);

        try {
          console.log("Trying to acquire token silently...");
          const accounts = await pca.acquireTokenSilent({ scopes: msScopes });
          console.log("Acquired token silently.");
          const accessToken = accounts.accessToken;
          console.log(accessToken);
        } catch (silentError: any) {
          console.log(`Silent token acquisition failed: ${silentError}`);
          
          // 针对权限同意缺失的错误处理
          if (silentError.errorCode === "65001" || silentError.suberror === "consent_required") {
            try {
              console.log("Triggering consent prompt...");
              const userAccount = await pca.acquireTokenPopup({
                scopes: msScopes,
                prompt: "consent" // 强制显示权限同意界面
              });
              console.log("Token acquired after user consent.");
              const accessToken = userAccount.accessToken;
              console.log(accessToken);
            } catch (popupError) {
              console.error(`Consent flow failed: ${popupError}`);
            }
          } else {
            // 处理其他静默获取失败场景
            try {
              const userAccount = await pca.acquireTokenPopup({ scopes: msScopes });
              const accessToken = userAccount.accessToken;
              console.log(accessToken);
            } catch (popupError) {
              console.error(`Interactive token acquisition failed: ${popupError}`);
            }
          }
        }
      }
    });
  }, []);

  return <div>Email Component</div>;
};

3. 验证重定向URI配置 #

• 确认Entra ID应用注册中的重定向URI与代码中msEntraconfig.auth.redirectUri完全匹配
• 对于嵌套应用，确保URI格式符合要求（如示例中的brk-multihub://localhost:3000），且已在应用注册中添加该URI

关键注意事项 #

• offline_access权限需要用户显式同意，需确保应用注册中已添加该权限
• 开发测试时，优先使用个人账户或已完成管理员同意的租户账户
• 确保Teams CLI部署的应用manifest文件中，权限声明与Entra ID配置一致

内容的提问来源于stack exchange，提问作者San Jaisy