使用 MSAL 和 Python 连接到 Power BI REST API

Question

我在 Azure Active Directory 中注册了我的 Power BI 应用程序，并具有选择的 API 权限（例如 User.Read）。我已尽力遵循 MSAL 文档，同时搜索此网站和其他网站并尝试了一些我找到的代码 sn-ps，但我没有任何运气。我无法使用公共客户端应用程序生成令牌，我使用机密的应用程序更进一步 - 我生成了一个令牌并将请求发送到网站并被困在这里，因为我不确定具体的错误是什么.我也不确定我可以显示多少请求文本，因为我不确定哪些是机密的，哪些不是。

根据我上面提到的研究，我花了几个小时尝试使用 MSAL 以各种方式连接到 PBI REST API，并认为是时候寻求帮助了。先感谢您！

这是我的代码，删除了特定的 ID：

#Import msal and requests
import msal
import requests

#Multiple parameters that will be needed
client_id = 'client id code'
client_credential = 'client secret code'
authority = 'https://login.microsoftonline.com/tenant id code'
redirect_uri = 'https://login.microsoftonline.com/common/oauth2/nativeclient'
power_bi_api = 'https://analysis.windows.net/powerbi/api/'
power_bi_api_root = 'https://api.powerbi.com/'
scopes_list = [
    power_bi_api + 'User.Read',
    power_bi_api + 'Dashboard.Read.All',
    power_bi_api + 'Dataset.Read.All',
    power_bi_api + 'Gateway.Read.All',
    power_bi_api + 'Workspace.Read.All'
]
endpoint = 'https://login.microsoftonline.com/tenant id code/oauth2/v2.0/authorize'

#Create a confidential client application
app = msal.ConfidentialClientApplication(
    client_id = client_id,
    client_credential = client_credential,
    authority = authority
)

#Generate a token
token_gen = app.acquire_token_for_client(
    scopes = 'https://analysis.windows.net/powerbi/api/.default'
)
#Returns token_type = Bearer, and gives an access_token
#I'm not sure why I need to use .default here instead of scopes_list,
#  but it didn't work otherwise

#Here is where I'm stuck
header = {'Authorization': 'Bearer ' + token_gen['access_token']}
api_out = requests.get(endpoint, headers = header)
#Returns status code 200

Answer 1

在我工作场所的 AAD 管理员的帮助下，我能够解决这个问题。管理员能够为我注册的应用程序提供管理员权限。然后我使用下面的代码直接使用我的用户名和密码获取令牌，而不是我在问题中所做的：

import msal

#Client ID from Azure Active Directory (AAD)
clientID = 'my-client-id'
#Authority is https://login.microsoftonline.com/ and tenant ID (from AAD)
authority = 'https://login.microsoftonline.com/my-tenant-id'
#Root address for PBI app
pbiAPI = 'https://analysis.windows.net/powerbi/api/'
#List of scopes available in AAD - must have all scopes listed in AAD
scopesList = [
    'https://graph.microsoft.com/User.Read',
    'https://graph.microsoft.com/User.ReadBasic.All',
    pbiAPI + 'Dashboard.Read.All',
    pbiAPI + 'Dataflow.Read.All',
    pbiAPI + 'Dataset.Read.All',
    pbiAPI + 'Gateway.Read.All',
    pbiAPI + 'Pipeline.Read.All',
    pbiAPI + 'Report.Read.All',
    pbiAPI + 'Workspace.Read.All'
]
    
#Create a public client application
app = msal.PublicClientApplication(
    client_id = clientID,
    authority = authority
    )

#Create an object to hold token acquisition results
result = None

#If there is nothing in the result object, acquire a token using username/password
if not result:
    result = app.acquire_token_by_username_password(
        username = 'myusername',
        password = 'my password',
        scopes = scopesList
    )

#If there is an access token in the result, show it
if "access_token" in result:
    print(result['access_token'])
#Otherwise, print the error
    print(result.get('error'))
    print(result.get('error_description'))
    print(result.get('correlation_id'))