Microsoft MSAL - 获取多个范围的令牌

在 Azure Active Directory 中，我有一个应用程序需要在以下范围内使用 MicrosoftGraphAPI 和 SharePointAPI：

GraphAPI scopes:

"https://graph.microsoft.com/User.Read.All",
"https://graph.microsoft.com/Group.Read.All",
"https://graph.microsoft.com/Sites.Read.All",
"https://graph.microsoft.com/Calendars.Read.Shared",
"https://graph.microsoft.com/MailboxSettings.Read",
"https://graph.microsoft.com/Files.Read.All"

SharePointAPI scopes:

"https://microsoft.sharepoint-df.com/AllSites.Read",
"https://microsoft.sharepoint-df.com/AllSites.FullControl",
"https://microsoft.sharepoint-df.com/User.Read.All"

我正在尝试获取该应用程序的令牌：

from msal import PublicClientApplication
AUTHORITY = 'https://login.microsoftonline.com/common'

scopes = [ "https://microsoft.sharepoint-df.com/AllSites.Read",
           "https://microsoft.sharepoint-df.com/AllSites.FullControl",
           "https://microsoft.sharepoint-df.com/User.Read.All"
           "https://graph.microsoft.com/User.Read.All",
           "https://graph.microsoft.com/Group.Read.All",
           "https://graph.microsoft.com/Sites.Read.All",
           "https://graph.microsoft.com/Calendars.Read.Shared",
           "https://graph.microsoft.com/MailboxSettings.Read",
           "https://graph.microsoft.com/Files.Read.All"
         ]

app = PublicClientApplication(client_id, authority=AUTHORITY)
flow = app.initiate_device_flow(scopes=scopes)

但是在 WebUI 中批准该应用程序后，我收到以下错误：

'error_description': 'AADSTS28000: Provided value for the input parameter scope is not valid 
because it contains more than one resource. Scope https://graph.microsoft.com/Calendars.Read.Shared 
https://graph.microsoft.com/Files.Read.All https://graph.microsoft.com/Group.Read.All 

https://graph.microsoft.com/MailboxSettings.Read https://graph.microsoft.com/Sites.Read.All 

https://graph.microsoft.com/User.Read.All https://microsoft.sharepoint-df.com/AllSites.FullControl 
https://microsoft.sharepoint-df.com/AllSites.Read https://microsoft.sharepoint-df.com/User.Read.All 
offline_access openid profile is not valid'

这是预期的行为。您不能混合资源（图表、共享点等），但您可以使用相同的刷新令牌为每个附加资源获取 1 个访问令牌 https://learn.microsoft.com/en-us/azure/active-directory/azuread-dev/v1-protocols-oauth-code#refreshing-the-access-tokens.

您可以在 MSAL 中实现这一目标调用以下方法 https://learn.microsoft.com/en-us/dotnet/api/microsoft.identity.client.publicclientapplication.microsoft-identity-client-ibyrefreshtoken-acquiretokenbyrefreshtoken?view=azure-dotnet#Microsoft_Identity_Client_PublicClientApplication_Microsoft_Identity_Client_IByRefreshToken_AcquireTokenByRefreshToken_System_Collections_Generic_IEnumerable_System_String__System_String_:

PublicClientApplication.AcquireTokenByRefreshToken(IEnumerable<string> scopes, string refreshToken);