如何解决 Azure ADFS 设置中的 Power BI API 令牌问题？

Question

The code was working fine until we have setup the federated Azure AD (SSO). More info on this link. https://blogs.msdn.microsoft.com/azuredev/2018/01/22/accessing-the-power-bi-apis-in-a-federated-azure-ad-setup/

The source code is developed in python.

def token():

    username,password = login() #get login
    data = {
        'grant_type': 'password',
        'scope': 'openid',
        'resource': 'https://analysis.windows.net/powerbi/api',
        'client_id': '******',
        'username': username,
        'password': password
    }
    endpoint = 'https://login.microsoftonline.com/common/oauth2/token'
    r = requests.post(endpoint, data=data)
    data = r.json()
    access_token = data['access_token']
    headers = {'Content-Type': "application/json",
        'Authorization': 'Bearer ' +access_token}
    return headers

Error:
    access_token = data['access_token']
    KeyError: 'access_token'

Does anyone had this issue and resolved it?

Thanks in advance

Answer 1

The reason this is not working is by default Azure AD will block ROPC flow for a Federated account. This flow only works if you are using a cloud account (onmicrosoft.com domain) for security reasons. If you need to authenticate with a Federated account, it's better if you use the ADAL library. We have an ADAL Java library here. https://github.com/AzureAD/azure-activedirectory-library-for-java/wiki/Acquiring-Tokens-with-username-and-password

Also, please note that:

Microsoft recommends you do not use the ROPC flow. In most scenarios, more secure alternatives are available and recommended. This flow requires a very high degree of trust in the application, and carries risks which are not present in other flows. You should only use this flow when other more secure flows can't be used.

Reference:

https://github.com/MicrosoftDocs/azure-docs/issues/34108