用于本地 rpmsg 解密的具有移动设备扩展的 AD RMS 失败并显示 "The service didn't accept the auth token"

Question

我正在使用 MIP SDK 尝试解密 rpmsg 文件。我可以在我的环境中使用它，但无法在我的客户环境中使用它。在此阶段，创建文件处理程序的调用失败并显示以下日志跟踪：

Error   2022-04-28 11:11:08.849 http_director_impl.cpp:258  LinkWorksite (2960) "HTTP operation failed Failed with: [AccessDeniedError: 'The service didn't accept the auth token. Challenge:['Bearer realm=""api.rms.rest.com"", authorization=""https://adfs.rrrrrrr.com/adfs/oauth2/authorize""']']" mipns::HttpDirectorImpl::OnHttpOperationFailed  4660
Error   2022-04-28 11:11:08.849 protection_engine_impl.cpp:797  LinkWorksite (2960) "Failed API call: protection_engine_create_consuming_protection_handler Failed with: [AccessDeniedError: 'The service didn't accept the auth token. Challenge:['Bearer realm=""api.rms.rest.com"", authorization=""https://adfs.rrrrrrr.com/adfs/oauth2/authorize""'], CorrelationId=c824d818-37ad-4309-b327-051da5e2f477, CorrelationId.Description=ProtectionEngine']"    mipns::ProtectionEngineImpl::CreateProtectionHandlerForConsumption  4660
Warning 2022-04-28 11:11:08.849 common/api_utils.h:249  LinkWorksite (2960) "Start calling error callback for API: protection_engine_create_consuming_protection_handler"   mipns::TryExecuteFailureCallback::<lambda_ee801bdedc20f37e6b5feb9b736714ff>::operator ()    4660
Warning 2022-04-28 11:11:08.849 common/api_utils.h:251  LinkWorksite (2960) "Ended calling error callback for API: protection_engine_create_consuming_protection_handler"   mipns::TryExecuteFailureCallback::<lambda_ee801bdedc20f37e6b5feb9b736714ff>::operator ()    4660
Trace   2022-04-28 11:11:08.849 oneds_telemetry_delegate.cpp:40 LinkWorksite (2960) "OneDSTelemetryDelegate::WriteEvent(protection_engine_create_consuming_protection_handler)" mipns::OneDSTelemetryDelegate::WriteEvent   4660
Trace   2022-04-28 11:11:08.849 oneds_helper.cpp:293    LinkWorksite (2960) "OneDsHelper::WriteEvent(protection_engine_create_consuming_protection_handler)"    mipns::OneDSHelper::WriteTelemetryEvent 4660
Info    2022-04-28 11:11:08.849 diagnostic_utils.cpp:73 LinkWorksite (2960) "Send Telemetry. Event Name : [protection_engine_create_consuming_protection_handler]
    App.ApplicationId: [adfasefas-9023-4a44-9a5e-9369d10bdbb5], Pii: [None]
    App.ApplicationName: [Link Documents MIP Integration], Pii: [None]
    App.ApplicationVersion: [2.1.1], Pii: [None]
    App.SessionId: [], Pii: [None]
    Engine.SessionId: [], Pii: [None]
    Event.CorrelationId: [c824d818-37ad-4309-b327-051da5e2f477], Pii: [None]
    Event.CorrelationIdDescription: [ProtectionEngine], Pii: [None]
    Event.Duration: [0.569734], Pii: [None]
    Event.ErrorType: [AccessDeniedError], Pii: [None]
    Event.Failed.File: [src\protection\api_impl\protection_engine_impl.cpp], Pii: [None]
    Event.Failed.Func: [mipns::ProtectionEngineImpl::CreateProtectionHandlerForConsumption::<lambda_a8fc66003c9962d3cc715d8ff0880d0a>::operator ()], Pii: [None]
    Event.Failed.Line: [727], Pii: [None]
    Event.Failed.Message: [Failed to create protection handler. Failed with: [AccessDeniedError: 'The service didn't accept the auth token. Challenge:['Bearer realm=""api.rms.rest.com"", authorization=""https://adfs.rrrrrrr.com/adfs/oauth2/authorize""'], CorrelationId=c824d818-37ad-4309-b327-051da5e2f477, CorrelationId.Description=ProtectionEngine']], Pii: [None]
    Event.ParentCorrelationId: [50c0b566-3e8c-4308-8518-6b0ee17ac510], Pii: [None]
    Event.ParentCorrelationIdDescription: [ProtectionProfile], Pii: [None]
    Event.UniqueId: [7805865d-bd65-4e0c-8097-5e36ca195739], Pii: [None]
    EventInfo.Level: [10], Pii: [None]
    EventInfo.PrivTags: [33554432], Pii: [None]
    MIP.Version: [1.11.64], Pii: [None]
    PL.KeyType: [Single], Pii: [None]
    iKey: [ce9aa5fb5a414ecebb15af10715bd8ff-831d197e-fc97-4df6-b998-c8c13a0fc3ce-6768], Pii: [None]
"   mipns::WriteTelemetryEventToLog 4660
Info    2022-04-28 11:11:08.849 protection_engine_impl.cpp:797  LinkWorksite (2960) "Ended API call: protection_engine_create_consuming_protection_handler" mipns::ProtectionEngineImpl::CreateProtectionHandlerForConsumption  4660

乍一看，AD FS 设置似乎不正确。但是，我在文档中来回浏览，却不清楚这是怎么发生的。任何有关此问题的建议或经验以及如何解决它都会非常有帮助。

Answer 1

原来这里的问题是一个过期的“可信用户域”证书。在这里查看完整的解释：

https://social.technet.microsoft.com/wiki/contents/articles/33666.expired-adrms-tud-including-live-id-support-may-cause-mobile-device-support-to-fail.aspx

用于本地 rpmsg 解密的具有移动设备扩展的 AD RMS 失败并显示 "The service didn't accept the auth token"

AD RMS with Mobile Device Extension for on-prem rpmsg decryption fails with "The service didn't accept the auth token"

microsoft-information-protection