2017-06-14 62 views
0

我正在使用adal节点js库1.22,并尝试使用用户名和密码对用户进行身份验证。我得到“无法获得本地发行人证书”错误。用户是联合的,并且在领域发现上发生错误。ADAL节点js用户名密码验证

var context = new AuthenticationContext(authorityUrl); 

context.acquireTokenWithUsernamePassword(resource, sampleParameters.username, sampleParameters.password, sampleParameters.clientId, function(err, tokenResponse) { 
    if (err) { 
    console.log('well that didn\'t work: ' + err.stack); 
    } else { 
    console.log(tokenResponse); 
    } 
}); 

错误堆栈:

Stack: 
Error: unable to get local issuer certificate 
    at Error (native) 
    at TLSSocket.<anonymous> (_tls_wrap.js:1092:38) 
    at emitNone (events.js:86:13) 
    at TLSSocket.emit (events.js:185:7) 
    at TLSSocket._finishInit (_tls_wrap.js:610:8) 
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:440:38) 
{ Error: unable to get local issuer certificate 
    at Error (native) 
    at TLSSocket.<anonymous> (_tls_wrap.js:1092:38) 
    at emitNone (events.js:86:13) 
    at TLSSocket.emit (events.js:185:7) 
    at TLSSocket._finishInit (_tls_wrap.js:610:8) 
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:440:38) code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY' } 
Wed, 14 Jun 2017 08:44:17 GMT:079c7b70-6ae1-461c-b433-cc3fe0c22783 - TokenRequest: VERBOSE: getTokenFunc returned with err 
well that didn't work: Error: unable to get local issuer certificate 
    at Error (native) 
    at TLSSocket.<anonymous> (_tls_wrap.js:1092:38) 
    at emitNone (events.js:86:13) 
    at TLSSocket.emit (events.js:185:7) 
    at TLSSocket._finishInit (_tls_wrap.js:610:8) 
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:440:38) 

你能请告知我缺少什么证书和在哪里可以找到它。

编辑

通过代码挖掘后,我发现,注释掉的代码的全球agent.ca部分解决了这个问题,图书馆是能够执行后几步,但它有一个问题从ADFS返回令牌响应。

日志:

Wed, 14 Jun 2017 10:39:39 GMT:425e3117-a495-4f8e-8a12-e7e64dd0e37b - OAuth2Client: INFO: Get TokenServer returned this correlationId: 425e3117-a495-4f8e-8a12-e7e64dd0e37b 
Wed, 14 Jun 2017 10:39:39 GMT:425e3117-a495-4f8e-8a12-e7e64dd0e37b - OAuth2Client: ERROR: Get Token request returned http error: 401 and server response: {"error":"invalid_client","error_description":"AADSTS70002: The request body must contain the following parameter: 'client_secret or client_assertion'.\r\nTrace ID: aadf1560-18ec-46f9-83b6-5932c2131200\r\nCorrelation ID: 425e3117-a495-4f8e-8a12-e7e64dd0e37b\r\nTimestamp: 2017-06-14 10:39:41Z","error_codes":[70002],"timestamp":"2017-06-14 10:39:41Z","trace_id":"aadf1560-18ec-46f9-83b6-5932c2131200","correlation_id":"425e3117-a495-4f8e-8a12-e7e64dd0e37b"} 

有没有,我忘了任何配置,

if (!parametersFile) { 
    sampleParameters = { 
    tenant : 'tenant.onmicrosoft.com', 
    authorityHostUrl : 'https://login.microsoftonline.com', 
    clientId : 'aa461028-1fgf-46e5-ab9b-5adca324febc', 
    username : '[email protected]', 
    password : 'lamepassword' 
    }; 
} 

var authorityUrl = sampleParameters.authorityHostUrl + '/' + sampleParameters.tenant; 

var resource = '00000002-0000-0000-c000-000000000000'; 

回答

0

资源所有者流量强烈反对,并在某些情况下,像联盟用户或用户的要求MFA ,将无法正常工作。此流程是您的应用程序直接处理用户的用户名和密码,并将请求中的请求发送给身份提供商。如果作为认证的一部分需要进行任何额外的交互,例如需要第二个因素或处理联合,则此方法将不起作用。由于这些原因和简单的安全原则(不再需要应用程序处理用户名和密码),最好避免这种流程。

既然你是在处理与联盟用户,资源拥有者不会为你让你有两个首选的替代工作:

有关在这两个选项之间进行选择的更多信息,请参阅"Web Application to Web API" scenario in the "Azure AD Authentication Scenarios" documentation