英文:
Azure AD MFA without a browser?
问题
这个问题之前已经被问过了，但是在不同的背景下。我需要能够在没有加载浏览器的终端上通过多因素身份验证（MFA）来认证到Azure AD（Entra）。我在Linux上使用了Python的msal库。目前我只能使用用户名和密码进行认证。
我已经尝试了一些方法，比如使用selenium等。有人有什么想法吗？
英文:
This has been asked before, but in a different context. I need to be able to authenticate to Azure AD (Entra) via MFA from a terminal, where there is no possibility to load a browser. This is on Linux, and I've been using the python msal library. Right now I can only authenticate with username and password.
I've been grasping at straws, such as using selenium, etc. Anyone have any ideas?
答案1
得分: 2
在不支持Web浏览器的环境中（例如无头Linux服务器上的终端），如果你想使用类似于MSAL的库，你将无法使用依赖于基于浏览器重定向的标准交互式OAuth流程。
对于没有浏览器的终端工具，我通常建议使用"设备代码流"。
- 应用程序请求Azure AD提供设备代码。
- Azure AD返回设备代码、用户代码和验证URL。
- 用户被指示在另一台设备上（如手机或桌面电脑）浏览到验证URL，并输入用户代码。完成后，他们将在该独立设备上完成标准的交互式MFA过程。
- 同时，应用程序定期使用设备代码轮询Azure AD，以检查用户是否已完成MFA过程。
- 用户完成MFA后，Azure AD将向应用程序返回访问令牌。
了解更多信息，请访问以下链接：
https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code
你还可以在以下链接找到使用Python实现设备代码流的示例代码：
https://github.com/Azure-Samples/ms-identity-python-devicecodeflow
英文:
Library like MSAL in an environment that doesn't support a web browser (e.g., terminal in a headless Linux server), you won't be able to use the standard interactive OAuth flows which rely on a browser-based redirect.
For Terminal Based tools without browser, I generally recommend using the "Device Code Flow".
- The application asks Azure AD to provide a device code.
- Azure AD returns a device code, a user code, and a verification URL.
- The user is instructed to browse to the verification URL on a separate device (like their phone or a desktop) and input the user code. Upon doing so, they'll then complete the standard interactive MFA process on that separate device.
- Meanwhile, the application periodically polls Azure AD with the device code to check if the user has completed the MFA process.
- Once the user completes the MFA, Azure AD returns an access token to the application.
https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code
https://github.com/Azure-Samples/ms-identity-python-devicecodeflow
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论