python - Azure Active Directory 错误。访问 token 来自错误的颁发者

Question

我正在尝试调用 Azure ARM Rest API 来创建资源组。我传递tenant_id、client_id 和client_secret 来获取访问 token ，该 token 稍后将用作授权 header 。我的代码如下所示。应用程序ID是应用程序外的客户端ID，应用程序 secret 是选择持续时间后生成的 key 。

import adal
import requests
token_response = adal.acquire_token_with_client_credentials(
    'https://login.microsoftonline.com/' + '<tenantId>',
    '<ApplicationId>',
    '<Application Secret>'
)
access_token = token_response.get('accessToken')

endpoint = 'https://management.azure.com/subscriptions/xxxx/resourcegroups/resourcename?api-version=2015-01-01'

headers = {"Authorization": 'Bearer ' + access_token}
json_output = requests.put(endpoint,headers=headers).json()
print json_output

但这给我带来了如下错误

{u'error': {u'message': u"The access token is from the wrong issuer 'https://sts
.windows.net/xxx/'. It must match the tenant 'h
ttps://sts.windows.net/xxx/' associated with th
is subscription. Please use the authority (URL) 'https://login.windows.net/xxx' to get the token. Note, if the subscription is
transferred to another tenant there is no impact to the services, but informatio
n about new tenant could take time to propagate (up to an hour). If you just tra
nsferred your subscription and see this error message, please try back later.",
u'code': u'InvalidAuthenticationTokenTenant'}}

此错误意味着什么以及我是否传递了正确的凭据。如果我使用错误中提到的凭据，我会收到另一个错误，指出未找到具有提到的 client_id 的应用程序。

Answer 1

正如消息所说，您需要使用 login.windows.net 而不是 login.microsoftonline.com:

token_response = adal.acquire_token_with_client_credentials(
'https://login.windows.net/' + '<tenantId>',
'<ApplicationId>',
'<Application Secret>'