我有一个用户被授予使用MS Graph API的权限。

我用Java编写了一个程序，使用MicrosoftGraphClient进行简单的查找，通过邮箱查找用户。应用启动后代码起初运行正常，但经过一段时间（大约一天）就会抛出异常。我怀疑异常只是把来自REST API的 HTTP响应进行包装。

com.microsoft.graph.models.odataerrors.ODataError: Continuous access evaluation resulted in challenge with result: InteractionRequired and code: TokenCreatedWithOutdatedPolicies
    at com.microsoft.graph.models.odataerrors.ODataError.createFromDiscriminatorValue(ODataError.java:36)

我使用的依赖：

      <dependency>
          <groupId>com.microsoft.graph</groupId>
          <artifactId>microsoft-graph</artifactId>
          <version>6.55.0</version>
      </dependency>
      <dependency>
          <groupId>com.azure</groupId>
          <artifactId>azure-identity</artifactId>
          <version>1.13.0</version>
      </dependency>

我的代码如下：

Config类：

@Configuration
public class MicrosoftGraphConfiguration {
    @Bean
    MicrosoftGraphClient microsoftGraphClient(GraphServiceClient graphServiceClient) {
        return new MicrosoftGraphClient(graphServiceClient);
    }

    @Bean
    GraphServiceClient graphClient(MicrosoftGraphProperties microsoftGraphProperties) {
        ClientSecretCredential credential = new ClientSecretCredentialBuilder()
                .clientId(microsoftGraphProperties.getClientId())
                .clientSecret(microsoftGraphProperties.getClientSecret())
                .tenantId(microsoftGraphProperties.getTenantId())
                .build();
        return new GraphServiceClient(credential);
    }

}

Service类：

   private final GraphServiceClient graphClient;

    public Optional<User> lookupUserByEmail(String email) {

        try {
            UserCollectionResponse userCollectionResponse = graphClient.users().get(conf -> {
                conf.queryParameters.filter = "mail eq '" + email + "'"; 
            });
            List<User> users = userCollectionResponse.getValue(); 
            ...
            return Optional.of(user);
        } catch (ODataError oDataError) {
            LOGGER.error("Problem while searching user in ms graph.  ", oDataError); 
        } catch (Exception e) {
           ...
        }
    }

不幸的是，我自己无法访问Azure，去查找配置或查看这种情况下的日志。

我问过负责策略的团队，他们说策略并不会经常变更，所以我不认为发生的是 "TokenCreatedWithOutdatedPolicies"。无论如何，我也不知道如何调查这个问题，甚至不知道如何找到解决办法。

有没有人能否理解在内部到底发生了什么？我能在代码中添加什么来让根本原因更清晰？

也许有人会知道对这种情况的潜在修复是什么？在开发模式下修复也不容易，因为我不能简单运行一个JUnit测试来看看修复是否有效，正如我所说，问题是在应用运行一天后才出现。

解决方案

From what I have learned, it is a bug in the msgraph-sdk code: https://github.com/microsoftgraph/msgraph-sdk-dotnet-core/issues/960

The workaround which worked for me was to create the authentication provider with CAE disabled, and then use it to initialize the GraphServiceClient ( had to use another constructor of GraphServiceClient).

 ClientSecretCredential credential = new ClientSecretCredentialBuilder()
                .clientId(microsoftGraphProperties.getClientId())
                .clientSecret(microsoftGraphProperties.getClientSecret())
                .tenantId(microsoftGraphProperties.getTenantId())
                .build();
        // in order to disable the cae, the provider is created with the flag set to false
        // this is workaround for https://github.com/microsoftgraph/msgraph-sdk-dotnet-core/issues/960
        // this is fixing the error "Continuous access evaluation resulted in challenge with result: InteractionRequired and code: TokenCreatedWithOutdatedPolicies"
        AzureIdentityAuthenticationProvider caeDisabledCredentialProvider = new AzureIdentityAuthenticationProvider(credential, new String[]{}, null, false, new String[]{});
        return new GraphServiceClient(caeDisabledCredentialProvider);