azure OAUTH 单点登录

Azure AD OAuth提供了一种安全的单点登录（SSO）解决方案，它允许用户使用他们的Azure AD凭据登录到多个应用程序和服务中，而无需在每个应用程序中都进行身份验证。下面是Azure AD OAuth单点登录的步骤：

1.创建Azure AD应用程序并获取应用程序ID和机密。
2.将应用程序ID和机密用于获取Azure AD访问令牌。
3.使用访问令牌调用Azure AD Graph API以获取用户详细信息。
4.使用用户详细信息创建本地用户帐户并将其用于登录到应用程序。

下面是一个使用Azure AD OAuth单点登录的Python示例：

from flask import Flask, redirect, request, session
import msal

app = Flask(__name__)
app.secret_key = "YOUR_SECRET_KEY"
app.config['SESSION_TYPE'] = 'filesystem'
CLIENT_ID = "YOUR_CLIENT_ID"
CLIENT_SECRET = "YOUR_CLIENT_SECRET"
AUTHORITY = "https://login.microsoftonline.com/YOUR_TENANT_ID"
REDIRECT_PATH = "/getAToken"
SCOPE = ["User.ReadBasic.All"]

@app.route("/")
def index():
    if not session.get("user"):
        return redirect("/login")
    return "Hello, {}!".format(session["user"]["displayName"])

@app.route("/login")
def login():
    session["state"] = str(uuid.uuid4())
    auth_url = _build_auth_url(scopes=SCOPE, state=session["state"])
    return redirect(auth_url)

@app.route(REDIRECT_PATH)
def authorized():
    if request.args.get('state') != session.get("state"):
        return redirect("/")
    if "error" in request.args:
        return "Login failed: {}".format(request.args["error"])
    if request.args.get("code"):
        cache = _load_cache()
        result = _build_msal_app(cache=cache).acquire_token_by_authorization_code(
            request.args["code"],
            scopes=SCOPE,
            redirect_uri=url_for("authorized", _external=True))
        if "error" in result:
            return "Token acquisition failed: {}".format(result["error"])
        session["user"] = _get_user_from_graph(result["access_token"])
        _save_cache(cache)
    return redirect("/")

def _load_cache():
    cache = msal.SerializableTokenCache()
    if session.get("token_cache"):
        cache.deserialize(session["token_cache"])
    return cache

def _save_cache(cache):
    if cache.has_state_changed:
        session["token_cache"] = cache.serialize()

def _build_msal_app(cache=None, authority=None):
    return msal.ConfidentialClientApplication(
        CLIENT_ID, authority=authority or AUTHORITY,
        client_credential=CLIENT_SECRET, token_cache=cache)

def _build_auth_url(authority=None, scopes=None, state=None):
    return _build_msal_app(authority=authority).get_authorization_request_url(
        scopes or [],
        state=state or str(uuid.uuid4()),
        redirect_uri=url_for("authorized", _external=True))

def _get_user_from_graph(token):
    graph_url = "https://graph.microsoft.com/v1.0/me"
    headers = {"Authorization": "Bearer " + token}
    response = requests.get(graph_url, headers=headers)
    return response.json()

if __name__ == "__main__":
    app.run()