python - Azure:访问 token 是从错误的受众或资源获取的

Question

尝试创建一个简单的任务来列出 Azure 门户中的所有资源。我按照给定 URL 中的指示操作并成功收到 token 。

http://azure-sdk-for-python.readthedocs.org/en/latest/resourcemanagement.html#authentication

但是使用 token 和 superscription_id 的组合，我收到以下错误。

错误:

azure.common.AzureHttpError: {"error"{"code":"AuthenticationFailed","message":"The access token has been obtained from wrong audience or resource '00000002-0000-0000-c000-000000000000'. It should exactly match (including forward slash) with one of the allowed audiences 'https://management.core.windows.net/','https://management.azure.com/'."}}  

我已在 Active Directory 中创建了一个应用程序，并将所有权限分配给 Windows Active Directory

以下是获取token的代码:

def get_token_from_client_credentials(endpoint, client_id, client_secret):
    payload = {
        'grant_type': 'client_credentials',
        'client_id': client_id,
        'client_secret': client_secret
        # 'resource': 'https://management.core.windows.net/',
    }
    response = requests.post(endpoint, data=payload).json()
    return response['access_token']

auth_token = get_token_from_client_credentials(endpoint='https://login.microsoftonline.com/11111111111-1111-11111-1111-111111111111/oauth2/token',
             client_id='22222222-2222-2222-2222-222222222222',
             client_secret='test/one/year/secret/key',

尝试在以下代码中使用此 token :

def get_list_resource_groups(access_token, subscription_id):
    cred = SubscriptionCloudCredentials(subscription_id, access_token)
    resource_client = ResourceManagementClient(cred)
    resource_group_list = resource_client.resource_groups.list(None)
    rglist = resource_group_list.resource_groups
    return rglist

Answer 1

That is not impacting (its an optional parameter)

实际上，Service to Service Calls Using Client Credentials中需要resource参数访问 token 的流程，此参数告诉您的应用程序从哪里获取 token 。由于您需要对 ARM 请求进行身份验证，因此需要在 get_token_from_client_credentials()

中设置 'resource': 'https://management.core.windows.net/' >

我们还可以从您的错误消息中获取信息:

The access token has been obtained from wrong audience or resource '00000002-0000-0000-c000-000000000000'. It should exactly match (including forward slash) with one of the allowed audiences 'https://management.core.windows.net/','https://management.azure.com/'

如有任何疑问，请随时告诉我。