authenticating a python script to be able to use a signing key from Key Vault

Question

HTTP/Rest - need to authenticate a code/token/etc in order to pass data to keyvault so that keyvault will sign data with a key in the Key Vault.

Azure has quite a few docs on how to register my app, create credentials for it in the key vault, but then for it to authenticate via OATH2 (first step is getting a code, (then later, a token?) via REST) I keep getting redirected to log in.

Am I missing something? I want my python script to run unattended. I have created its ID and wrote down the plaintext password it gave me that it warned would never be displayed again. Not sure how to use REST in this case as I really cannot auth to any application, I dont really even have any application - the Azure people told me to just put ANY url in the box when I registered the APP in AAD.

Answer 1

You need to use client credentials flow. In this flow you send your credentials to AAD and it'll send you back a token. Then you can call Key Vault with that.

V1: https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-oauth2-client-creds-grant-flow

V2: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow