Python从SharePoint下载文件遇AADSTS53003错误，求现代认证方案

以下是几种符合Azure AD条件访问策略要求、可用于从SharePoint下载文件的现代认证方案：

1. MSAL用户名密码认证（非交互式，需IT允许该流程） #

通过微软官方的MSAL库实现用户名密码流认证，适合无需用户手动操作的自动化场景。

首先安装依赖：

pip install msal requests

示例代码：

import msal
import requests

# 配置信息
CLIENT_ID = "你的Azure AD应用客户端ID"
TENANT_ID = "你的租户ID"
USERNAME = "你的账号"
PASSWORD = "你的密码"
SHAREPOINT_SITE_URL = "https://yourtenant.sharepoint.com/sites/yoursite"
FILE_PATH = "/sites/yoursite/Shared Documents/test.txt"
DOWNLOAD_TO = "./test.txt"

# 初始化MSAL客户端
app = msal.PublicClientApplication(CLIENT_ID, authority=f"https://login.microsoftonline.com/{TENANT_ID}")

# 获取token
result = app.acquire_token_by_username_password(
    USERNAME,
    PASSWORD,
    scopes=["https://yourtenant.sharepoint.com/.default"]
)

if "access_token" in result:
    # 调用SharePoint REST API下载文件
    headers = {
        "Authorization": f"Bearer {result['access_token']}"
    }
    file_url = f"{SHAREPOINT_SITE_URL}/_api/web/getfilebyserverrelativeurl('{FILE_PATH}')/$value"
    response = requests.get(file_url, headers=headers)
    
    with open(DOWNLOAD_TO, "wb") as f:
        f.write(response.content)
else:
    print(f"认证失败: {result.get('error_description')}")

2. MSAL设备码认证（交互式，支持MFA） #

适合需要多因素认证（MFA）的场景，用户需通过浏览器输入验证码完成登录。

示例代码：

import msal
import requests

CLIENT_ID = "你的Azure AD应用客户端ID"
TENANT_ID = "你的租户ID"
SHAREPOINT_SITE_URL = "https://yourtenant.sharepoint.com/sites/yoursite"
FILE_PATH = "/sites/yoursite/Shared Documents/test.txt"
DOWNLOAD_TO = "./test.txt"

app = msal.PublicClientApplication(CLIENT_ID, authority=f"https://login.microsoftonline.com/{TENANT_ID}")

# 启动设备码流程
flow = app.initiate_device_flow(scopes=["https://yourtenant.sharepoint.com/.default"])
if "user_code" not in flow:
    raise ValueError(f"设备码流程启动失败: {flow.get('error_description')}")

# 提示用户登录
print(flow["message"])
result = app.acquire_token_by_device_flow(flow)

if "access_token" in result:
    headers = {"Authorization": f"Bearer {result['access_token']}"}
    file_url = f"{SHAREPOINT_SITE_URL}/_api/web/getfilebyserverrelativeurl('{FILE_PATH}')/$value"
    response = requests.get(file_url, headers=headers)
    
    with open(DOWNLOAD_TO, "wb") as f:
        f.write(response.content)
else:
    print(f"认证失败: {result.get('error_description')}")

3. 客户端证书认证（服务端到服务端） #

适合无人值守的服务场景，需提前在Azure AD注册应用并上传证书，无需用户交互。

示例代码：

import msal
import requests

CLIENT_ID = "你的Azure AD应用客户端ID"
TENANT_ID = "你的租户ID"
CERT_PATH = "./your_certificate.pem"
CERT_THUMBPRINT = "证书指纹"
SHAREPOINT_SITE_URL = "https://yourtenant.sharepoint.com/sites/yoursite"
FILE_PATH = "/sites/yoursite/Shared Documents/test.txt"
DOWNLOAD_TO = "./test.txt"

# 使用证书初始化MSAL客户端
app = msal.ConfidentialClientApplication(
    CLIENT_ID,
    authority=f"https://login.microsoftonline.com/{TENANT_ID}",
    client_credential={"thumbprint": CERT_THUMBPRINT, "private_key": open(CERT_PATH).read()}
)

# 获取token
result = app.acquire_token_for_client(scopes=["https://yourtenant.sharepoint.com/.default"])

if "access_token" in result:
    headers = {"Authorization": f"Bearer {result['access_token']}"}
    file_url = f"{SHAREPOINT_SITE_URL}/_api/web/getfilebyserverrelativeurl('{FILE_PATH}')/$value"
    response = requests.get(file_url, headers=headers)
    
    with open(DOWNLOAD_TO, "wb") as f:
        f.write(response.content)
else:
    print(f"认证失败: {result.get('error_description')}")

4. 使用Office365-REST-Python-Client库（封装式实现） #

该库专门针对Office 365服务封装了认证和API操作，简化开发流程。

安装依赖：

pip install office365-rest-python-client

示例代码（设备码认证）：

from office365.sharepoint.client_context import ClientContext
from office365.runtime.auth.device_code_provider import DeviceCodeProvider

CLIENT_ID = "你的Azure AD应用客户端ID"
SHAREPOINT_SITE_URL = "https://yourtenant.sharepoint.com/sites/yoursite"
FILE_RELATIVE_PATH = "/sites/yoursite/Shared Documents/test.txt"
DOWNLOAD_TO = "./test.txt"

# 初始化设备码认证提供器
provider = DeviceCodeProvider(CLIENT_ID)
ctx = ClientContext(SHAREPOINT_SITE_URL).with_authentication_provider(provider)

# 获取文件并下载
file = ctx.web.get_file_by_server_relative_url(FILE_RELATIVE_PATH)
with open(DOWNLOAD_TO, "wb") as local_file:
    file.download(local_file).execute_query()

内容的提问来源于stack exchange，提问作者frank