且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

使用 Azure Active Directory 进行身份验证 - 如何以编程方式接受用户凭据

更新时间:2023-12-03 18:54:58

Azure Active Directory 支持资源所有者密码凭据授予(grant_type=password)流程.但是,在使用它之前,请考虑是否真的需要它.正如 OAuth 2.0 RFC 中所说:

The Resource Owner Password Credentials Grant (grant_type=password) flow is supported by Azure Active Directory. However, before using it, consider if it is truly required. As it says in the OAuth 2.0 RFC:

资源所有者密码凭据(即用户名和密码)可以直接用作授权许可来获取访问令牌.仅当资源所有者和客户端之间存在高度信任时(例如,客户端是设备操作系统或高特权应用程序的一部分),并且当其他授权授予类型为不可用(例如授权码).

The resource owner password credentials (i.e., username and password) can be used directly as an authorization grant to obtain an access token. The credentials should only be used when there is a high degree of trust between the resource owner and the client (e.g., the client is part of the device operating system or a highly privileged application), and when other authorization grant types are not available (such as an authorization code).

如果您确定其他支持的流程肯定不适用于您的场景,那么请务必遵循 RFC 中的第二条建议:

If you have determined that the other supported flows will definitely not work for your scenario, then also be sure to follow the second bit of advice in the RFC:

即使此授权类型需要客户端直接访问资源所有者凭据,资源所有者凭据仍用于单个请求并交换访问令牌.这种授权类型可以通过将凭据与长期访问令牌或刷新令牌交换,消除客户端存储资源所有者凭据以备将来使用的需要.

Even though this grant type requires direct client access to the resource owner credentials, the resource owner credentials are used for a single request and are exchanged for an access token. This grant type can eliminate the need for the client to store the resource owner credentials for future use, by exchanging the credentials with a long-lived access token or refresh token.

(在这两种情况下都加了重点.)

(Emphasis added in both cases.)

GitHub 上有一个使用此流程的 .NET 和 ADAL 示例,它应该足够简单,可以在 Python 中实现:https://github.com/AzureADSamples/NativeClient-Headless-DotNet

There's a .NET and ADAL sample on GitHub that uses this flow, and it should be simple enough to implement in Python: https://github.com/AzureADSamples/NativeClient-Headless-DotNet

您可以在任何地方托管您的应用程序,它不需要在 Azure 上.这适用于所有流程.

You can host your application anywhere you want, it doesn't need to be on Azure. This applies to all flows.