Azure托管标识错误-找不到访问令牌的标识

Question

我正在尝试以编程方式获取Azure数据工厂的托管标识对象（使用Python）。

为此，我遵循以下步骤：

1. 在Azure Active Directory中注册应用程序以获取客户端ID、添加客户端机密、租户ID、范围

head = {"Authorization": "Bearer {}".format(request_token)} 
#request_token is the access token from #2   
requests.get('https://manahtml" target="_blank">gement.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DataFactory/factories/{factoryName}?api-version=2018-06-01', headers = head)

如链接中提供：https://docs.microsoft.com/en-us/azure/data-factory/data-factory-service-identity

完成这些步骤后，#5的响应为error=“invalid\u token”，error\u description=“找不到访问令牌的标识”

应用注册没有用于检查托管标识的标识部分。

我是不是错过了一步？

请查找下面的代码。谢谢你的时间！

import sys  
import json
import logging

import requests
import msal



input_client_id = <client_id>
input_authority = "https://login.microsoftonline.com/<tenant_id>"
input_secret = <client_Secret>
input_scope = ["https://graph.microsoft.com/.default"]
input_endpoint = "https://graph.microsoft.com/v1.0/applications"

app = msal.ConfidentialClientApplication(
    input_client_id, authority=input_authority,
    client_credential=input_secret,
    # token_cache=...  # Default cache is in memory only.
                       # You can learn how to use SerializableTokenCache from
                       # https://msal-python.rtfd.io/en/latest/#msal.SerializableTokenCache
    )


result = app.acquire_token_for_client(scopes=input_scope)

print('Access Token', result['access_token'])
request_token = result['access_token']
head = {"Authorization": "Bearer {}".format(request_token)}
response = requests.get('{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DataFactory/factories/{factoryName}?api-version=2018-06-01', headers=head)

部分错误响应：

{'Cache-Control': 'no-cache', 'Pragma': 'no-cache', 'Content-Type': 'application/json; charset=utf-8', 'Expires': '-1', 'WWW-Authenticate': 'Bearer authorization_uri="https://login.windows.net/<tenant_id>", error="invalid_token", error_description="Could not find identity for access token."'

Answer 1

尝试更换范围<代码>https://graph.microsoft.com/.default带https://management.azure.com/.default 。

当您请求azure管理Rest API时，您需要此范围。