Microsoft MSAL是否具有“资源所有者密码凭据授予"授权支持?

本文介绍了Microsoft MSAL是否具有“资源所有者密码凭据授予"授权支持?的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！ 问题描述

MSAL是否具有资源所有者密码凭据授予授权[docs.microsoft/en-us/azure/active-directory/develop/v2-oauth-ropc]支持?

Does MSAL have Resource Owner Password Credentials Grant authorization[docs.microsoft/en-us/azure/active-directory/develop/v2-oauth-ropc] support?

推荐答案

是的，适用于Python的MSAL支持ROPC流(资源所有者密码凭据授予)，示例此处.

Yes, MSAL for Python supports ROPC flow(Resource Owner Password Credentials Grant), sample here.

""" The configuration file would look like this: { "authority": "login.microsoftonline/organizations", "client_id": "your_client_id", "username": "your_username@your_tenant", "password": "This is a sample only. You better NOT persist your password.", "scope": ["User.ReadBasic.All"], // You can find the other permission names from this document // docs.microsoft/en-us/graph/permissions-reference "endpoint": "graph.microsoft/v1.0/users" // You can find more Microsoft Graph API endpoints from Graph Explorer // developer.microsoft/en-us/graph/graph-explorer } You can then run this sample with a JSON configuration file: python sample.py parameters.json """ import sys # For simplicity, we'll read config file from 1st CLI param sys.argv[1] import json import logging import requests import msal # Optional logging # logging.basicConfig(level=logging.DEBUG) # Enable DEBUG log for entire script # logging.getLogger("msal").setLevel(logging.INFO) # Optionally disable MSAL DEBUG logs config = json.load(open(sys.argv[1])) # Create a preferably long-lived app instance which maintains a token cache. app = msal.PublicClientApplication( config["client_id"], authority=config["authority"], # token_cache=... # Default cache is in memory only. # You can learn how to use SerializableTokenCache from # msal-python.rtfd.io/en/latest/#msal.SerializableTokenCache ) # The pattern to acquire a token looks like this. result = None # Firstly, check the cache to see if this end user has signed in before accounts = app.get_accounts(username=config["username"]) if accounts: logging.info("Account(s) exists in cache, probably with token too. Let's try.") result = app.acquire_token_silent(config["scope"], account=accounts[0]) if not result: logging.info("No suitable token exists in cache. Let's get a new one from AAD.") # See this page for constraints of Username Password Flow. # github/AzureAD/microsoft-authentication-library-for-python/wiki/Username-Password-Authentication result = app.acquire_token_by_username_password( config["username"], config["password"], scopes=config["scope"]) if "access_token" in result: # Calling graph using the access token graph_data = requests.get( # Use token to call downstream service config["endpoint"], headers={'Authorization': 'Bearer ' + result['access_token']},).json() print("Graph API call result: %s" % json.dumps(graph_data, indent=2)) else: print(result.get("error")) print(result.get("error_description")) print(result.get("correlation_id")) # You may need this when reporting a bug if 65001 in result.get("error_codes", []): # Not mean to be coded programatically, but... # AAD requires user consent for U/P flow print("Visit this to consent:", app.get_authorization_request_url(config["scope"]))