如何使用Python SDK将本地自签名证书上传至Entra ID应用注册

完全可以使用Microsoft Graph Python SDK实现这个需求，以下是具体实现步骤：

1. 前置准备 #

• 安装依赖包：

  pip install azure-identity msgraph-sdk
  

• 确保操作账号拥有足够权限：比如Application.ReadWrite.All或Application.ReadWrite.OwnedBy，并配置好身份验证所需的凭据（如客户端ID、租户ID、客户端密钥，根据身份验证方式调整）。

2. 实现代码示例 #

先读取本地生成的.cer证书文件，提取公钥并转换为base64编码，再通过Graph API将证书添加到目标应用注册：

from azure.identity import ClientSecretCredential
from msgraph import GraphServiceClient
from msgraph.generated.models.key_credential import KeyCredential
from msgraph.generated.models.key_type import KeyType
from msgraph.generated.models.key_usage import KeyUsage
import base64
import datetime

# 1. 配置身份验证与目标信息
tenant_id = "你的租户ID"
client_id = "你的客户端ID"
client_secret = "你的客户端密钥"
app_object_id = "目标应用注册的对象ID"
cert_path = "C:\\Users\\admin\\Desktop\\{certificateName}.cer"  # 替换为你的实际证书路径

# 2. 读取证书并转换为base64格式公钥
with open(cert_path, "rb") as cert_file:
    cert_data = cert_file.read()
    base64_cert = base64.b64encode(cert_data).decode("utf-8")

# 3. 构建证书参数对象
key_credential = KeyCredential(
    display_name="自签名验证证书",
    key=base64_cert,
    type=KeyType.AsymmetricX509Cert,
    usage=KeyUsage.Verify,
    start_date_time=datetime.datetime.now(datetime.timezone.utc),
    end_date_time=datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(days=365)  # 设置证书有效期
)

# 4. 初始化Graph客户端并提交证书
credential = ClientSecretCredential(tenant_id, client_id, client_secret)
graph_client = GraphServiceClient(credential)

# 追加证书（若需保留原有证书，需先调用get接口获取现有列表再合并）
await graph_client.applications.by_application_id(app_object_id).patch({
    "keyCredentials": [key_credential]
})

注意：若目标应用已存在其他证书，直接替换keyCredentials会覆盖原有证书。如需追加，需先调用get接口获取现有证书列表，合并新证书后再提交更新。

内容的提问来源于stack exchange，提问作者Zayn Lauren