在您的授权请求中,使用 code+id_token response_type。您的客户端应用程序将收到一个 id_token - 一个包含用户信息的 jwt,包括可用于构建 Graph API 查询的用户租户 ID (tid)。
要求:
login.windows.net/common/oauth2/authorize?response_type=code+id_token&client_id=f034219b-9048-452a-aa0c-ce7661fcd2a0&resource=<graph api resource id>&redirect_uri=<your redirect uri>&nonce=7a16fa03-c29d-4e6a-aff7-c021b06a9b27
回复:
<redirect_uri>?code=AwABAAAAvPM1KaPlrEqdFSBzjqfTGB_K3PrvqLGyrC3bsLKpSYcEMwgiAbLpF6yKUxMRX3P1g3GqXDmmtKUkuVr0HjiWhO5EuW5RExGaucKvRhSes9Fzxm4Mxsoz0_8hbAwdC7zn8e74ENcgWwat6OLpSkYLFvBuJFvhp8k0ng3VIxJm5iMP7iC7DM1XGO5ECnwjz-Iu6MsiTwRG78L8p1x8vudlF-uAyDBkINiGRI-cFv6Q65xoU-uNWuiGBQ7H03OkDVnu29LYjrwGmJvq6yL1wzL2SyBXR8fKmmgqMTqu8jz0I94oTPYYtv-Cnq2hXP8_QpaDjiHHM6v9ymkSYnVNvSlkDgeqhwnqoU29DOEYQLNuAewzbWkIsCQJl9SCmcTtJ8Xsh75HV2KbVMHKAfZ0yLUggCAA&id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ik5HVEZ2ZEstZnl0aEV1THdqcHdBSk9NOW4tQSJ9.eyJhdWQiOiJmMDM0MjE5Yi05MDQ4LTQ1MmEtYWEwYy1jZTc2NjFmY2QyYTAiLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC82MmUxNzNlOS0zMDFlLTQyM2UtYmNkNC0yOTEyMWVjMWFhMjQvIiwiaWF0IjoxMzk3MDY0NTE3LCJuYmYiOjEzOTcwNjQ1MTcsImV4cCI6MTM5NzA2ODQxNywidmVyIjoiMS4wIiwidGlkIjoiNjJlMTczZTktMzAxZS00MjNlLWJjZDQtMjkxMjFlYzFhYTI0Iiwib2lkIjoiODRlNjg1MmMtYjJlZS00ODMwLTkyMjYtNjYwNzYzOWU2Mzc0IiwidXBuIjoiYmFkYW1zQGR1c2h5YW50Z2lsbC5jb20iLCJ1bmlxdWVfbmFtZSI6ImJhZGFtc0BkdXNoeWFudGdpbGwuY29tIiwic3ViIjoiRGVldTRUTmxPZjMwSVA2YnBBRVJlOTRNNHJ2VHpfeDdFWE5UYkNXeTFTbyIsImZhbWlseV9uYW1lIjoiQWRhbXMiLCJnaXZlbl9uYW1lIjoiQnJhZCIsIm5vbmNlIjoiN2ExNmZhMDMtYzI5ZC00ZTZhLWFmZjctYzAyMWIwNmE5YjI3IiwiY19oYXNoIjoiM01FYmNleUFYUlBtOGVMRE11cEpUZyJ9.L4FcbHGCTROgDT4Hpuc2kczSOh7HooLpUTQVpYve76Ucwyl4pFmb1IDKsES_d0stK6kyr2__Qs3ckMs5lm0SnsMuI3KIK53j3H_KeaswfbD5AYOm7gbEqA4VDcjQRVbEHW4Lyd8ij4b-Xss9O2N6ZbSKRZ-uuM78y5-lmQZ5KsRsdg7B9sLfHsRTjbrT9YryPUotbivUg3ioSZ9g3PYZwb0XiRO9enM9nYjz8rZXINB3ODr7-ccr4_n8AOWwvPunM1rXLxTZTEO3ADDU-anK_2OLH6Ab_6OMKljzigJbciol7DvBXaNZf7guHvDXV6VXTnPim2XhSOp_tcaVRj4yAA&session_state=b41d7528-2c8c-4e76-b17f-0732e8697798
解码的 id_token jwt:
aud: f034219b-9048-452a-aa0c-ce7661fcd2a0
iss: https://sts.windows.net/62e173e9-301e-423e-bcd4-29121ec1aa24/
iat: 1397064517
nbf: 1397064517
exp: 1397068417
ver: 1.0
**tid**: 62e173e9-301e-423e-bcd4-29121ec1aa24
oid: 84e6852c-b2ee-4830-9226-6607639e6374
upn: badams@dushyantgill.com
unique_name: badams@dushyantgill.com
sub: Deeu4TNlOf30IP6bpAERe94M4rvTz_x7EXNTbCWy1So
family_name: Adams
given_name: Brad
nonce: 7a16fa03-c29d-4e6a-aff7-c021b06a9b27
c_hash: 3MEbceyAXRPm8eLDMupJTg