Reusing a token obtained from InteractiveBrowserCredential

问题

I am running this code to obtain a Bearer token from the InteractiveBrowserCreedentail and log in to azure blob storage:

cred = InteractiveBrowserCredential(authority="login.microsoftonline.com", tenant_id="**", client_id="**")
token = cred.get_token()

print(token)

blobber = BlobServiceClient(account_url="https://**.blob.core.windows.net", credential=cred)

blobs = blobber.list_containers()
for b in blobs:
    print(b)

This works well.

I am trying to reuse the token in another call, this time a direct rest interaction:

import requests

auth_header = ("Authorization", "Bearer " + "***")
version = ("x-ms-version", "2017-11-09")
response = requests.get("https://***.blob.core.windows.net/?comp=list", headers=dict([auth_header, version]))

I get a 403 response saying:

Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.

According to official documentation, this should be working.

What am I missing?

回答1:

According to my research, when you request AD access token and call Azure blob storage, the scope must contain https://storage.azure.com/user_impersonation or https://storage.azure.com/.default. For more details, please refer to the document. In other words, the request url should be like

https://login.microsoftonline.com/<tenat id>/oauth2/v2.0/authorize?client_id=<>
&scope=https://storage.azure.com/user_impersonation
&...

But when I run the cred.get_token(), the request url just be like below. The scope does not contain https://storage.azure.com/user_impersonation or https://storage.azure.com/.default. So you cannot call Azure Blob rest api with the token.

https://login.microsoftonline.com/<tenat id>/oauth2/v2.0/authorize?
client_id=<>
&scope=offline_access openid profile&state=204238ac-4fcd-44f2-9eed-528ab4d9c37
&...

Meanwhile, I do test, if we run the code blob_service_client = BlobServiceClient(account_url="https://blobstorage0516.blob.core.windows.net/", credential=cred), the request url is

https://login.microsoftonline.com/<tenat id>/oauth2/v2.0/authorize?
client_id=<>
&scope=https://storage.azure.com/.default offline_access openid profile&state=204238ac-4fcd-44f2-9eed-528ab4d9c37
&...

来源：https://stackoverflow.com/questions/60204464/reusing-a-token-obtained-from-interactivebrowsercredential