python - 尝试使用 azure-graphrbac 创建 Azure B2C 用户

Question

我们正在尝试将现有用户导入我们的 B2C 租户。为此，我们一直在尝试使用 azure-graphrbac python 库。

我已关注this注册与图形 API 一起使用的应用程序的指南。

我正在使用以下代码尝试创建用户:

from azure.graphrbac import GraphRbacManagementClient
from azure.common.credentials import ServicePrincipalCredentials
from azure.graphrbac.models import UserCreateParameters, PasswordProfile

credentials = ServicePrincipalCredentials(
    client_id="<CLIENT ID>",
    secret="<SECRET>",
    tenant="<TENANT ID>"
)

tenant_id = '<myb2ctenant>.onmicrosoft.com'

graphrbac_client = GraphRbacManagementClient(
    credentials,
    tenant_id
)

ucp = UserCreateParameters(
    user_principal_name="<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="3c51457c515d5550125f5351" rel="noreferrer noopener nofollow">[email protected]</a>",
    account_enabled=True,
    display_name='Martin T',
    mail_nickname='<mymail>',
    additional_properties={
        "signInNames": [{"type": "emailAddress", "value": "<mymail>"}]
    },
    user_type="LocalAccount",
    password_profile=PasswordProfile(
        password='<somepassword>',
        force_change_password_next_login=True
    )
)

user = graphrbac_client.users.create(ucp)

我已确保客户端 ID、 secret 和租户 ID 正确。但是，我不断收到此错误:

GraphErrorException:访问 token 丢失或格式错误。

有人知道我可能做错了什么吗？

Answer 1

正如 Laurent 所说，您需要定义资源。默认资源是 https://management.core.windows.net/。在您的场景中，您想要创建一个用户，资源是 https://graph.windows.net。

你的代码也有错误，我修改一下。以下代码对我有用。

from azure.graphrbac import GraphRbacManagementClient
from azure.common.credentials import ServicePrincipalCredentials
from azure.graphrbac.models import UserCreateParameters, PasswordProfile

credentials = ServicePrincipalCredentials(
    client_id="",
    secret="",
    resource="https://graph.windows.net",
    tenant = ''   
)

tenant_id = ''

graphrbac_client = GraphRbacManagementClient(
    credentials,
    tenant_id
)

ucp = UserCreateParameters(
    user_principal_name="",
    account_enabled=True,
    display_name='Martin T',
    ##I test in my lab, if I use this line, I will get error log and could not create a user.
    #additional_properties={
    #    "signInNames": [{"type": "emailAddress", "value": ""}]
    #},
    ##user_type only support Member or Guest, see this link https://learn.microsoft.com/en-us/python/api/azure.graphrbac.models.usercreateparameters?view=azure-python
    user_type="Member",
    mail_nickname = 'shuitest',
    password_profile=PasswordProfile(
        password='',
        force_change_password_next_login=True
    )
)

user = graphrbac_client.users.create(ucp)

请参阅此 link 中的 SDK 。