How to connect Stardog with an Entra ID account using MSAL PublicClientApplication and pystardog

Created by Steve Place, Modified on Thu, Oct 17 at 4:17 PM by Steve Place

To do this, you can use the below Python code. The allowPublicClient setting needs to be set to true in the Azure portal for it to work. You can find that setting under Authentication -> Advanced Settings -> Allow public client flows.

#!/usr/bin/env python
# coding: utf-8

import os
import dataclasses
import msal
import stardog
import requests


# obtain from Azure Portal
client_id = "<<GUID>>"
tenant_id = "<<GUID>>"
# this could be .us or other tld depending on govcloud or not.
# it can be found by clicking the endpoints button in Azure Portal
authority = f"https://login.microsoftonline.us/{tenant_id}"
# stardog server address
endpoint = "https://examplestardogurl.test:443"
# database name
db = "test"

token_cache = msal.TokenCache()
app = msal.PublicClientApplication(
    client_id,
    authority=authority,
    token_cache=token_cache,
)
scopes = [f"api://{client_id}/user_login"]
flow = app.initiate_device_flow(scopes)

print(flow["message"])
input("Press Enter to continue after authenticating...")

token = app.acquire_token_by_device_flow(flow)
access_token = token["access_token"]

@dataclasses.dataclass(frozen=True)
class BearerAuth(requests.auth.AuthBase):
    token: str

    def __call__(self, r):
        r.headers["Authorization"] = f"Bearer {self.token}"
        return r

# this instance will insert the Bearer token in the header of each request for authentication
# when passed with the connection details.
auth = BearerAuth(access_token)

conn_details = {
    "endpoint": endpoint,
    "auth": auth,
}

with stardog.Admin(**conn_details) as admin:
    dbs = admin.databases()
    print("Stardog has these databases: ", dbs)

# query example
with stardog.Connection(db, **conn_details) as conn:
    results = conn.select('select * { ?s ?p ?o }')
    print(results)

To learn more about pystardog, see our documentation.