python - 未使用 Python 在 MS Fabric API 中为服务主体 token 授予身份验证

Question

我正在尝试使用 VScode 中的 Python 连接到 Microsoft Fabric 中的 OneLake API。

到目前为止我已经

1. 使用这些 API 权限在 Azure 中注册了应用

然后为我的服务主体创建了一个 key

然后我尝试使用 azure.identity 通过此函数获取 token :

from azure.identity import ClientSecretCredential, AuthenticationRequiredError

def get_access_token(app_id, client_secret, directory_id):
    try:
        # Create the ClientSecretCredential using the provided credentials
        credential = ClientSecretCredential(
            client_id=app_id,
            client_secret=client_secret,
            tenant_id=directory_id
            #scope="https://storage.azure.com/.default"
        )

        # Use the credential to get the access token
        token = credential.get_token("https://storage.azure.com/.default").token

        return token, credential

    except AuthenticationRequiredError as e:
        print("Authentication failed. Please check your credentials.")
        raise e

    except Exception as e:
        print("An error occurred while getting the access token:")
        print(str(e))
        raise e
    
access_token, credential = get_access_token(app_id, client_secret, directory_id)

看来我得到了 token 。但权限、范围或访问权限有问题。因为当我运行此函数来检查连接时，我收到状态代码 400

def check_connection_with_onelake(access_token):
    base_url = "https://onelake.dfs.fabric.microsoft.com/9c3ffd43-b537-4ca2-b9ba-0c59d0094033/Files/sample?resource=file" 
    token_headers = {
        "Authorization": "Bearer " + access_token
    }

    try:
        response = requests.put(base_url, headers=token_headers)

        if response.status_code == 200:
            print("Connection with OneLake is successful.")
        else:
            print("Failed to connect with OneLake. Status code:", response.status_code)

    except requests.exceptions.RequestException as e:
        print("An error occurred while checking the connection:", str(e))

# Assuming 'access_token' is already defined and contains a valid access token
check_connection_with_onelake(access_token)

我还以管理员身份向 Fabric 工作区中的用户添加了应用的服务主体

我在哪里缺少访问权限以及如何授予正确的访问权限？

引用文献: https://learn.microsoft.com/en-us/fabric/onelake/onelake-access-api https://amitchandak.medium.com/on-premise-python-code-to-local-sql-server-data-to-microsoft-fabric-lakehouse-using-token-d15b8795e349

Answer 1

我注册了一个 Azure AD 应用程序并授予了 API 权限，如下所示:

在我的 Fabric 工作区中，我将上述服务主体添加为 Admin，与您相同:

当我在我的环境中运行你的 python 代码时，我也得到了状态代码 400。为了知道确切的错误，我打印了响应的内容，如下所示:

import requests
from azure.identity import ClientSecretCredential, AuthenticationRequiredError

def get_access_token(app_id, client_secret, directory_id):
    try:
        # Create the ClientSecretCredential using the provided credentials
        credential = ClientSecretCredential(
            client_id=app_id,
            client_secret=client_secret,
            tenant_id=directory_id
            #scope="https://storage.azure.com/.default"
        )

        # Use the credential to get the access token
        token = credential.get_token("https://storage.azure.com/.default").token

        return token, credential

    except AuthenticationRequiredError as e:
        print("Authentication failed. Please check your credentials.")
        raise e

    except Exception as e:
        print("An error occurred while getting the access token:")
        print(str(e))
        raise e
    
access_token, credential = get_access_token("appId", "secret", "tenantId")


def check_connection_with_onelake(access_token):
    base_url = "https://onelake.dfs.fabric.microsoft.com/0f0050d1-5601-47d0-9eb6-xxxxxxx/Files/sample?resource=file" 
    token_headers = {
        "Authorization": "Bearer " + access_token
    }

    try:
        response = requests.put(base_url, headers=token_headers)

        if response.status_code == 200:
            print("Connection with OneLake is successful.")
        else:
            print("Failed to connect with OneLake. Status code:", response.status_code)
            print(response.content)

    except requests.exceptions.RequestException as e:
        print("An error occurred while checking the connection:", str(e))

# Assuming 'access_token' is already defined and contains a valid access token
check_connection_with_onelake(access_token)

回应:

The error occurred as you missed adding LakehouseId afterworkspace ID in your base URL and you need to use GET request tocheck connection by removing resource=file.

当您在浏览器中打开它时，您可以在地址栏中的 /lakehouses/ 中找到 LakehouseId，如下所示:

当我通过更改 base_url 和请求类型运行修改后的代码时，我成功获得了响应，如下所示:

import requests
from azure.identity import ClientSecretCredential, AuthenticationRequiredError

def get_access_token(app_id, client_secret, directory_id):
    try:
        # Create the ClientSecretCredential using the provided credentials
        credential = ClientSecretCredential(
            client_id=app_id,
            client_secret=client_secret,
            tenant_id=directory_id
            #scope="https://storage.azure.com/.default"
        )

        # Use the credential to get the access token
        token = credential.get_token("https://storage.azure.com/.default").token

        return token, credential

    except AuthenticationRequiredError as e:
        print("Authentication failed. Please check your credentials.")
        raise e

    except Exception as e:
        print("An error occurred while getting the access token:")
        print(str(e))
        raise e
    
access_token, credential = get_access_token("appId", "secret", "tenantId")


def check_connection_with_onelake(access_token):
    base_url = "https://onelake.dfs.fabric.microsoft.com/0f0050d1-5601-47d0-9eb6-xxxxxxx/37a6ca4e-27b6-437b-800c-xxxxxxxxxx/Files/sample" 
    token_headers = {
        "Authorization": "Bearer " + access_token
    }

    try:
        response = requests.get(base_url, headers=token_headers)

        if response.status_code == 200:
            print("Connection with OneLake is successful.")
        else:
            print("Failed to connect with OneLake. Status code:", response.status_code)
            print(response.content)

    except requests.exceptions.RequestException as e:
        print("An error occurred while checking the connection:", str(e))

# Assuming 'access_token' is already defined and contains a valid access token
check_connection_with_onelake(access_token)

回应: