无法使用带有 Streamlit 的 MSAL 获取访问令牌

Question

我的学校项目的一部分是使用 Streamlit 和 MSAL 构建一个简单的登录页面，与 Azure Entra ID 作为身份提供程序集成。目前，我能够重定向到新页面进行身份验证。但是一旦完成身份验证，我将收到一条错误消息：“AADSTS9002327：为“单页应用程序”客户端类型颁发的令牌只能被兑换通过跨源请求。跟踪 ID：b609a4d4-f55d-4d18-ad83-63bc34601e00 关联 ID：d38d1ddb-438d-4cf7-858e-7edb817836b4”。
我的 Streamlit 登录页面位于 localhost 8503 上，我想重定向到同一页面或 8501.. 有人可以帮我解决为什么我没有获得访问令牌吗

import streamlit as st
from msal import PublicClientApplication

# Initialize MSAL PublicClientApplication
app = PublicClientApplication(
    "<client_id>",
    authority="https://login.microsoftonline.com/<tenant_ID>",
    client_credential=None
    )

# Function to acquire and use token
def acquire_and_use_token():
    result = None

    # Attempt to get token from cache or acquire interactively
    accounts = app.get_accounts()
    if accounts:
        result = app.acquire_token_silent(["User.Read"], account=accounts[0])
    else:
        result = app.acquire_token_interactive(scopes=["<Not_sure_what_to_enter>"], prompt="select_account")

    # Check if token was obtained successfully
    if "access_token" in result:
        st.write("Token acquisition successful!")
        st.write("Access token:", result["access_token"])

    else:
        st.error("Token acquisition failed")
        st.error(result.get("error_description", "No further details"))
    if result and "access_token" in result:
        st.session_state.token = result["access_token"]
# Streamlit app UI
st.title("Azure Entra ID Authentication with MSAL and Streamlit")


if st.button("Login"):
    acquire_and_use_token()
    # Update session state with token
    

# Display token if available
if st.session_state.token:
    st.write("Access token:", st.session_state.token)
st.write(st.session_state)

**挣扎了好几天，请帮我解决问题，我正在尝试获取access_token。 **

Answer 1

如果您尝试通过在“单页应用程序”平台下添加重定向URI来获取交互流令牌，通常会发生错误，如下所示：

最初，当我运行代码以交互方式获取令牌并将重定向 URI 作为 SPA 时，我也遇到了相同的错误：

要解决错误，请删除“单页应用程序”平台下的重定向URI并将其添加到“移动和桌面应用程序”中，如下所示：

当我在上述更改后运行以下代码以交互方式获取令牌时，我成功获得了

response，令牌如下：

import streamlit as st
from msal import PublicClientApplication

# Initialize MSAL PublicClientApplication
app = PublicClientApplication(
    "appId",
    authority="https://login.microsoftonline.com/tenantId",
    client_credential=None
    )

# Function to acquire and use token
def acquire_and_use_token():
    result = None

    # Attempt to get token from cache or acquire interactively
    accounts = app.get_accounts()
    if accounts:
        result = app.acquire_token_silent(["User.Read"], account=accounts[0])
    else:
        result = app.acquire_token_interactive(scopes=["User.Read"], prompt="select_account")

    # Check if token was obtained successfully
    if "access_token" in result:
        st.write("Token acquisition successful!")
        st.write("Access token:", result["access_token"])

    else:
        st.error("Token acquisition failed")
        st.error(result.get("error_description", "No further details"))
    if result and "access_token" in result:
        st.session_state.token = result["access_token"]
# Streamlit app UI
st.title("Azure Entra ID Authentication with MSAL and Streamlit")


if st.button("Login"):
    acquire_and_use_token()
    # Update session state with token

Streamlit 应用程序 UI：