当我拥有令牌时，使用 Python 调用 SharePoint API 获取 401 响应

Question

我已在 Azure 中注册了我的应用程序并具有 API 权限，如下所示：

这是我的Python代码。

import requests
from msal import ConfidentialClientApplication

client_id = "xxxxxxxxxxxxxxxxxxxxx"
client_secret = "yyyyyyyyyyyyyyyyyyyyy"
tenant_id = "tttttttttttttttttttttttttttttttttttttttt"
site_url = "https://{mytenent}.sharepoint.com/sites/mysite"
resource = "https://{mytenent}"

# Authenticate using client ID and secret
authority = f"https://login.microsoftonline.com/{tenant_id}"
app = ConfidentialClientApplication(
    client_id=client_id,
    authority=authority,
    client_credential=client_secret,
)

scope=[resource + "/.default"]
token_response = app.acquire_token_for_client(scopes=scope)


access_token = token_response.get("access_token") #token_response["access_token"]
print(access_token)

endpoint_url = f"{site_url}/_api/web"
headers = {
    "Authorization": "Bearer " + access_token,
    "Accept": "application/json;odata=verbose",
    "Content-Type": "application/json;odata=verbose",
}
print(endpoint_url)
response = requests.get(endpoint_url, headers=headers)

# Check for errors in the SharePoint API response
if response.status_code == 200:
    data = response.json()
    print("SharePoint Site Title:", data["d"]["Title"])
else:
    print("SharePoint API Error:")
    print("Status Code:", response.status_code)
    print("Response:", response.text)

通过代码 print(access_token) 我可以获取令牌字符串，所以我认为我在获取令牌时做得正确。但是我在调用 SharePoint API 时收到 401 响应。

状态代码：401 响应：{"error_description":"ID3035: 请求 无效或格式错误。”}

可能是什么问题？谢谢你的建议。

Answer 1

我注册了一个 Entra ID 应用程序并授予了 API 权限，如下所示：

最初，当我在我的环境中运行 python 代码时，我遇到了同样的错误，如下所示：

import requests
from msal import ConfidentialClientApplication

client_id = "xxxxxxxxxxxxxxxxxxxxx"
client_secret = "yyyyyyyyyyyyyyyyyyyyy"
tenant_id = "tttttttttttttttttttttttttttttttttttttttt"
site_url = "https://{mytenent}.sharepoint.com/sites/mysite"
resource = "https://{mytenent}"

# Authenticate using client ID and secret
authority = f"https://login.microsoftonline.com/{tenant_id}"
app = ConfidentialClientApplication(
    client_id=client_id,
    authority=authority,
    client_credential=client_secret,
)

scope=[resource + "/.default"]
token_response = app.acquire_token_for_client(scopes=scope)


access_token = token_response.get("access_token") #token_response["access_token"]
print(access_token)

endpoint_url = f"{site_url}/_api/web"
headers = {
    "Authorization": "Bearer " + access_token,
    "Accept": "application/json;odata=verbose",
    "Content-Type": "application/json;odata=verbose",
}
print(endpoint_url)
response = requests.get(endpoint_url, headers=headers)

# Check for errors in the SharePoint API response
if response.status_code == 200:
    data = response.json()
    print("SharePoint Site Title:", data["d"]["Title"])
else:
    print("SharePoint API Error:")
    print("Status Code:", response.status_code)
    print("Response:", response.text)

回复：

要解决该错误，您可以切换到委托流程，例如交互流程、授权代码流程等。在您授予委托类型的权限时生成令牌。

在我的例子中，我运行了下面的修改后的代码，使用交互式流程来生成令牌，并成功获得了响应，如下所示：

import requests
import msal

client_id = "appId"
tenant_id = "tenantId"
site_url = "https://tenant.sharepoint.com/sites/sridemosite"
resource = "https://tenant.sharepoint.com"

# Authenticate using client ID and secret
authority = f"https://login.microsoftonline.com/{tenant_id}"

app = msal.PublicClientApplication(
    client_id,
    authority=authority,
)
scope=[resource + "/.default"]
token_response = app.acquire_token_interactive(scopes=scope)
access_token = token_response['access_token']
print(access_token)

endpoint_url = f"{site_url}/_api/web"
headers = {
    "Authorization": "Bearer " + access_token,
    "Accept": "application/json;odata=verbose",
    "Content-Type": "application/json;odata=verbose",
}
print()
print(endpoint_url)
response = requests.get(endpoint_url, headers=headers)

# Check for errors in the SharePoint API response
if response.status_code == 200:
    data = response.json()
    print("SharePoint Site Title:", data["d"]["Title"])
else:
    print("SharePoint API Error:")
    print("Status Code:", response.status_code)
    print("Response:", response.text)

回复：

使用交互式流程时，请确保启用公共客户端流程并在移动和桌面应用程序平台中添加重定向 URI：

或者，您也可以通过授予Application类型的权限，使用客户端证书生成访问令牌，请参阅以下博客：

获取 SharePoint REST API 的仅应用程序访问令牌，作者：Martin Loitzl