问题描述
今天按照How to configure Exchange Server on-premises to use Hybrid Modern Authentication说明配置Exchange Server 2019 CU14后引入的启用OWA HMA功能，配置好OAuth后OWA页面可正常跳转微软登录认证，但无法正常登录本地OWA，而是无限跳转到登录页面。
F12看到可以正常从Azure AD拿到token：
1 | GET https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=... |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 | <html> <head> <title>Working...</title> </head> <body> <form method="POST" name="hiddenform" action="https://mail.cfan.space/owa/"> <input type="hidden" name="code" value="(删了)" <input type="hidden" name="id_token" value="(删了)" <input type="hidden" name="state" value="(删了)" <input type="hidden" name="session_state" value="(删了)"/> <input type="hidden" name="correlation_id" value="(删了)"/> <noscript> <p>Script is disabled. Click Submit to continue.</p> <input type="submit" value="Submit"/> </noscript> </form> <script language="javascript" nonce='(删了)'> document.forms[0].submit(); </script> </body> </html> |
POST回OWA后，OWA会在Cookie设置一个OpenIdConnect.token.v1：
1 2 3 4 5 6 | HTTP/1.1 302 Found ... Location: https://mail.cfan.space/owa/ ... Set-Cookie: OpenIdConnect.token.v1=(删了); expires=Sat, 15-Feb-2025 12:46:23 GMT; path=/; secure; HttpOnly ... |
再次跳转OWA后就出错了：
1 2 3 4 5 6 | HTTP/1.1 302 Found ... Location: https://login.windows.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=... ... WWW-Authenticate: Bearer client_id="00000002-0000-0ff1-ce00-000000000000", trusted_issuers="00000001-0000-0000-c000-000000000000@6bd132f0-670d-42b2-9869-a74e42a0fd4b", token_types="app_asserted_user_v1 service_asserted_app_v1", error="invalid_token" ... |
导致再次跳转到微软登录验证。
查看日志
打开Exchange的日志
C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Owa
C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Ecp
可以看到以下上面两次OWA请求对应OAuthExtension相关的日志（这里拿了ECP日志）：
1 2 | POST ... S:ServiceCommonMetadata.OAuthExtraInfo=Category:V1IdToken|ScenarioType:V1OpenId|;S:ServiceCommonMetadata.OAuthLatency=Parse:5|JwtSecurityTokenValidator:1|ExtPostAuth:8|;S:ServiceCommonMetadata.OAuthExtensionInfo=GetT:{""OpenIdConnect"":{""idToken"":""nonce is null""}}|PostAuth:{""OpenIdConnect"":{""E.RCM"":true ""E.RA"":2 ""E.R"":""PostToGet"" ""E.RU"":""https://mail.cfan.space/ecp/""}} GET ... S:ServiceCommonMetadata.OAuthError=Microsoft.Exchange.Security.OAuth.InvalidOAuthTokenException: The token should have valid permissions or linked account associated with partner application ''00000002-0000-0ff1-ce00-000000000000''.\r\n 在 Microsoft.Exchange.Security.OAuth.PermissionValidator.Validate(OAuthAuthenticationInput authenticationInput OAuthAuthenticationOutput authenticationOutput OAuthRequestContext oAuthRequestContext)\r\n 在 Microsoft.Exchange.Security.OAuth.Common.ValidatorManagerBase.Validate(OAuthAuthenticationInput authenticationInput OAuthRequestContext oAuthRequestContext)\r\n 在 Microsoft.Exchange.Security.OAuth.AuthenticatorOAuth.AuthenticateInternal(OAuthRequestContext oAuthRequestContext String rawToken String authScheme Uri targetUri)\r\n 在 Microsoft.Exchange.Security.OAuth.OAuthHttpModule.DoFullAuth(HttpContext context)';S:ServiceCommonMetadata.OAuthErrorCategory=InvalidGrant;S:ServiceCommonMetadata.OAuthExtraInfo=Category:V1ExchangeSelfIssuedSessionActAs|ScenarioType:ExchangeSelfIssuedSession|AppId:00000002-0000-0ff1-ce00-000000000000|ErrorCode:NoAuthorizationValuePresent|;S:ServiceCommonMetadata.OAuthLatency=Init:5|Parse:3|PermissionValidator:8|;S:ServiceCommonMetadata.OAuthExtensionInfo=OnError:{""OpenIdConnect"":{""E.RA"":2 ""E.R"":""Challenge"" ""E.RU"":""https://login.windows.net/common/oauth2/authorize""}} |
可以看到第一次V1OpenId成功认证后变为ExchangeSelfIssuedSession，但ExchangeSelfIssuedSession认证时出现以下问题
1 | Microsoft.Exchange.Security.OAuth.InvalidOAuthTokenException: The token should have valid permissions or linked account associated with partner application '00000002-0000-0ff1-ce00-000000000000'. |
可见问题关键点：
- 本地Exchange的
Partner Application未正确配置Exchange Online的LinkedAccount。
解决方案
检查Partner Application配置
运行以下命令确认配置：
1 | Get-PartnerApplication | Format-Table Name, LinkedAccount |
发现Exchange Online的LinkedAccount为空
设置正确的 LinkedAccount
1 | Set-PartnerApplication "Exchange Online" -LinkedAccount "cfan.space/Users/Exchange Online-ApplicationAccount" |
此步骤作用：
- 绑定Partner Application到正确的 本地
Exchange Online-ApplicationAccount账户。 - 允许Exchange Server正确处理OAuth身份验证。
0 评论