使用Python代碼,展現如何從Azure AD 中獲取目標資源的 Access Token。html
如要了解如何從AAD中獲取 client id,client secret,tenant id,請參考博文:【Azure Developer】Python代碼經過AAD認證訪問微軟Azure密鑰保管庫(Azure Key Vault)中機密信息(Secret) 中的操做步驟一欄。python
1)調用 ClientSecretCredential 方法,經過client_id, client_secret ,tenant_id 以及 authority=AzureAuthorityHosts.AZURE_CHINA,初始化 credentials 對象api
2)調用對象中的 get_token方法,特別注意參數 scopes 的傳遞,如 "https://microsoftgraph.chinacloudapi.cn/.default", 若是缺乏.default,則會提示參數錯誤(詳見[碰見問題]部分)app
from azure.identity import ClientSecretCredential credentials = ClientSecretCredential(client_id='xxxxxxxx-xxxx-xxxx-xxxx-76f50363af33', client_secret='.~V9ij1.5Y_F8rL_k8DNpj~RSLFf~H56nH', tenant_id='xxxxxxxx-xxxx-xxxx-xxxx-1316152d9587',authority=AzureAuthorityHosts.AZURE_CHINA) token =credentials.get_token("https://microsoftgraph.chinacloudapi.cn/.default") print(token)
1) 調用 ServicePrincipalCredentials 方法,一樣經過參數 client_id, secret, tenant, resource 和 china='true' , 初始化 credentials 對象ide
2) 解析credentials對象,獲取Token中的 access_token屬性值。credentials.token['access_token']post
print("方式二: ServicePrincipalCredentials") from azure.common.credentials import ServicePrincipalCredentials credentials = ServicePrincipalCredentials(client_id='xxxxxxxx-xxxx-xxxx-xxxx-76f50363af33', secret='.~xxxx.xxxx~xxxx~xxxx', tenant='xxxxxxxx-xxxx-xxxx-xxxx-1316152d9587', resource='https://microsoftgraph.chinacloudapi.cn/', china='true') access_token = credentials.token['access_token'] print(access_token)
PS: 使用 https://jwt.io/ 能夠Decoded token 內容。已可讀方式查看。ui
Traceback (most recent call last): File "client.py", line 7, in <module> print(credentials.get_token(scopes="")) File "C:\Users\bulu\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.8_qbz5n2kfra8p0\LocalCache\local-packages\Python38\site-packages\azure\identity\_internal\get_token_mixin.py", line 64, in get_tokent_token_mixin.py", line 64,
in get_token raise ValueError('"get_token" requires at least one scope') ValueError: "get_token" requires at least one scope
錯誤的緣由就是輸入的scope參數不正確。須要輸入「https://microsoftgraph.chinacloudapi.cn/.default" 攜帶.default。 url
The
/.default
scope is built in for every application that refers to the static list of permissions configured on the application registration. Source: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#the-default-scopespa
The /.default scope: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#the-default-scopecode
identity Package: https://docs.microsoft.com/zh-cn/python/api/azure-identity/azure.identity?view=azure-python
AzureAuthorityHosts Class:https://docs.microsoft.com/zh-cn/python/api/azure-identity/azure.identity.azureauthorityhosts?view=azure-python