通过 PHP cURL 对 login.microsoftonline.com 进行身份验证(SSL 连接错误)

Question

我正在尝试使用 PHP 从 Micorosft Dynamics CRM 2015 中提取数据。从各种来源，我了解到我必须从 login.microsoftonline.com 身份验证开始。

我正在使用 cURL 发送导致 SSL 连接错误的 XML 请求。

XML 请求：

 <s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
    <a:Action s:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue</a:Action>         
    <a:MessageID>urn:uuid:4e586759-a5cc-483c-bbd0-9f3eed7667dc</a:MessageID> 
    <a:ReplyTo>
         <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address> 
    </a:ReplyTo>
    <VsDebuggerCausalityData xmlns="http://schemas.microsoft.com/vstudio/diagnostics/servicemodelsink">uIDPo4TBVw9fIMZFmc7ZFxBXIcYAAAAAbd1LF/fnfUOzaja8sGev0GKsBdINtR5Jt13WPsZ9dPgACQAA</VsDebuggerCausalityData> 
    <a:To s:mustUnderstand="1">https://login.microsoftonline.com/RST2.srf</a:To> 
    <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
        <u:Timestamp u:Id="_0">
              <u:Created>2015-06-11T17:14:09.00Z</u:Created> 
              <u:Expires>2015-06-12T17:14:09.00Z</u:Expires> 
        </u:Timestamp>
        <o:UsernameToken u:Id="uuid-14bed392-2320-44ae-859d-fa4ec83df57f-4">
            <o:Username>{username}</o:Username> 
            <o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">{password}</o:Password> 
        </o:UsernameToken>
    </o:Security>
</s:Header>
<s:Body>
    <t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">
        <wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
            <a:EndpointReference>
                <a:Address>urn:crmemea:dynamics.com</a:Address> 
            </a:EndpointReference>
        </wsp:AppliesTo>
        <t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType> 
    </t:RequestSecurityToken>
</s:Body>

cURL 设置：

$headers = array(
        "POST " . $postUrl . " HTTP/1.1",
        "Host: " . $hostname,
        'Connection: Keep-Alive',
        "Content-type: application/soap+xml; charset=UTF-8",
        "Content-length: " . strlen($content),
);
$cURLHandle = curl_init();
$soapUrl = "https://login.microsoftonline.com/RST2.srf";
curl_setopt($cURLHandle, CURLOPT_URL, $soapUrl);
curl_setopt($cURLHandle, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($cURLHandle, CURLOPT_TIMEOUT, 60);
curl_setopt($cURLHandle, CURLOPT_SSL_VERIFYPEER, false);        
curl_setopt($cURLHandle, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
curl_setopt($cURLHandle, CURLOPT_HTTPHEADER, $headers);
curl_setopt($cURLHandle, CURLOPT_POST, 1);
curl_setopt($cURLHandle, CURLOPT_POSTFIELDS, $content);
curl_setopt($cURLHandle, CURLOPT_SSLVERSION , 3);
curl_setopt($cURLHandle, CURLOPT_FOLLOWLOCATION, TRUE);
curl_setopt($cURLHandle, CURLINFO_HEADER_OUT, false);
$fp = fopen('error.txt', 'w'); 
curl_setopt($cURLHandle, CURLOPT_STDERR, $fp);
curl_setopt($cURLHandle, CURLOPT_VERBOSE, true);        
$response = curl_exec($cURLHandle);

头：

array(5) {
  [0]=>
  string(23) "POST /RST2.srf HTTP/1.1"
  [1]=>
  string(31) "Host: login.microsoftonline.com"
  [2]=>
  string(22) "Connection: Keep-Alive"
  [3]=>
  string(49) "Content-type: application/soap+xml; charset=UTF-8"
  [4]=>
  string(20) "Content-length: 3083"
}

curl_error： 字符串（17） "SSL 连接错误"

详细错误信息：

• 即将将 （） 连接到端口 443 login.microsoftonline.com
• 正在尝试 23.97.148.36... * 已连接
• 连接到 login.microsoftonline.com （23.97.148.36） 端口 443
• 警告：忽略 SSL.Verifyhost 的值
• 战国策错误-5961
• 关闭连接 #0
• SSL 连接错误

网址版本信息：

array(9) {
  ["version_number"]=>
  int(463623)
  ["age"]=>
  int(3)
  ["features"]=>
  int(1597)
  ["ssl_version_number"]=>
  int(0)
  ["version"]=>
  string(6) "7.19.7"
  ["host"]=>
  string(23) "x86_64-redhat-linux-gnu"
  ["ssl_version"]=>
  string(22) "NSS/3.16.2.3 Basic ECC"
  ["libz_version"]=>
  string(5) "1.2.3"
  ["protocols"]=>
  array(12) {
    [0]=>
    string(4) "tftp"
    [1]=>
    string(3) "ftp"
    [2]=>
    string(6) "telnet"
    [3]=>
    string(4) "dict"
    [4]=>
    string(4) "ldap"
    [5]=>
    string(5) "ldaps"
    [6]=>
    string(4) "http"
    [7]=>
    string(4) "file"
    [8]=>
    string(5) "https"
    [9]=>
    string(4) "ftps"
    [10]=>
    string(3) "scp"
    [11]=>
    string(4) "sftp"
  }
}

如果我需要提供更多，请告诉我任何帮助将不胜感激！我想有关NSS错误-5961的任何信息都会有所帮助。

Answer 1

我怀疑这可能是您的 POST 和主机值的问题。 您成功连接到 login.microsoftonline.com 但我相信下一步是您的组织。

我已经有一段时间没有玩过这些东西了，但是我的价值观看起来像这样：-POST/Organization.svc主机 yourorganisation.api.crm5.dynamics.com

显然，您需要更改"您的组织"部分和"crm5"以匹配您所在的地区。

几年前我做了一个联系，据我所知仍然有效。http://crmtroubleshoot.blogspot.com.au/2013/07/dynamics-crm-2011-php-and-soap-using.html