使用托管标识从 python azure 函数调用 API

Question

I am trying to use a python azure function to call an API running on an Azure app service. (I have managed to get the webAPI to call the function-trigger (managed-identity and all that), but the function needs data that can be retrieved from the API.)

In order to simplify authentication, my thought is to use the managed-identity within the python function and create a JWT that accompanies the requests.

credential = DefaultAzureCredential()
token = credential.get_token("api://<APPLICATION_ID>/.default")
// make call to API using token as authorization
// response 200

This currently works. APPLICATION_ID is registered within Azure AD.

It feels wrong to request a token, using the functions APPLICATION_ID as a scope. When the API in reality has nothing to do with it. But my attempts at using any other scope is met with errors.

Answer 1

It depends on the service/resource you want to access that decides the scope.

eg if you want to access storage, the scope is "https://storage.azure.com/.default".

(I work in Microsoft Azure SDK team)