Hello, 

I’m using the Cognite Python SDK to query some data from the OpenIndustrialData project. I’m confused about the new OIDC authentication process.

https://docs.cognite.com/dev/guides/sdk/python/) mentions that the following arguments should be passed to the `CogniteClient`:

from cognite.client import CogniteClient

client = CogniteClient(
    token_url= "<token-url>",
    token_client_id= "<your-client-id>",
    token_client_secret="<client-secret>",
    token_scopes="<scope>",
    project= "<your-cognite-project>",
    base_url=f"https://{$cdf_cluster}.cognitedata.com",
    client_name="<your-client-name>",
)

Alternatively, an api-key can be passed (although this process is being deprecated):

from cognite.client import CogniteClient

c = CogniteClient(api_key="<your-api-key>",
                  client_name="<your-client-name>")

However, as of cognite-sdk Python package version 4.0.1 the `CogniteClient` still expects `config` of class `ClientConfig` as an argument. Passing `token_url` or `api_key` as an argument throws an “unexptected keyword argument” error.

Would you be able to clarify how we are expected to authenticate to access data from the OpenIndustrialData project using the Python SDK?

Thanks

Hi Denis,

Our engineering team has done some changes to authenticate CDF via SDK on the 15th Aug 2022 as stated in Cognite python sdk repository. 

https://github.com/cognitedata/cognite-sdk-python/blob/f7821557cec0be48c4a1e7a8aa6ba741775137a4/CHANGELOG.md

SDK team has already updated this in our python sdk docs. However, some code samples and parts of the docs are still not updated and I have opened a separate bug to update those.

You can use the below code sample to access OpenIndustrialData project with interactive login and token refresh.

import atexit
import os

from cognite.client import CogniteClient, ClientConfig
from cognite.client.credentials import Token
from msal import PublicClientApplication, SerializableTokenCache

# Contact Project Administrator to get these
TENANT_ID = "48d5043c-cf70-4c49-881c-c638f5796997"
CLIENT_ID = "1b90ede3-271e-401b-81a0-a4d52bea3273"
CDF_CLUSTER = "api"  # api, westeurope-1 etc
COGNITE_PROJECT = "publicdata"

CACHE_FILENAME = "cache.bin"
SCOPES =  f"https://{CDF_CLUSTER}.cognitedata.com/user_impersonation"]

AUTHORITY_HOST_URI = "https://login.microsoftonline.com"
AUTHORITY_URI = AUTHORITY_HOST_URI + "/" + TENANT_ID
PORT = 53000


def create_cache():
    cache = SerializableTokenCache()
    if os.path.exists(CACHE_FILENAME):
        cache.deserialize(open(CACHE_FILENAME, "r").read())
    atexit.register(lambda:
        open(CACHE_FILENAME, "w").write(cache.serialize()) if cache.has_state_changed else None
    )
    return cache


def authenticate_azure(app):
    # Firstly, check the cache to see if this end user has signed in before
    accounts = app.get_accounts()
    if accounts:
        creds = app.acquire_token_silent(SCOPES, account=accountsn0])
    else:
        # interactive login - make sure you have http://localhost:port in Redirect URI in App Registration as type "Mobile and desktop applications"
        creds = app.acquire_token_interactive(scopes=SCOPES, port=PORT,)

    return creds


app = PublicClientApplication(client_id=CLIENT_ID, authority=AUTHORITY_URI)


def get_token():
    return authenticate_azure(app)p"access_token"]



cnf = ClientConfig(client_name="my-special-client", project="publicdata", credentials=Token(get_token))
client = CogniteClient(cnf)

print(client.iam.token.inspect())

Thanks,

Shehan.

Hi @gontcharovd! You’re right, it has been changed in the most recent version of the Python SDK, and the new pattern should be documented here: https://cognite-docs.readthedocs-hosted.com/projects/cognite-sdk-python/en/latest/cognite.html#authenticate

I wrote an example of how you can access Open Industrial Data using OIDC with the Python SDK here. A bit of extra code is needed to manage the interactive login flow on the identity provider (Azure) for human users :)

Edit: @Shehan Karunaratne got to it just before me Now you have a couple of alternatives to choose from :) 

Hi @Shehan Karunaratne , we have extractors set-up that gets data from publicdata. How can we request for the client secret? We would not be able to use the interactive log-in.

Hi, I used to be able to log in to “publicdata” with Cognite Charts, but after Nov 1st that’s no longer possible it seems. Is there a simple recipe for logging in using other means today?

Hi @Christoffer Lange, 

It is possible for me to log in to publicdata via Charts. For that, 

1. Navigate to https://charts.cogniteapp.com/.
2. Select Sign in with Microsoft.
3. Select Europe 1 (Google) as CDF cluster, and click Sign in as a guest user.
4. Enter the following Tenant id: 48d5043c-cf70-4c49-881c-c638f5796997
5. Click Continue and sign in with your credentials.
6. You should be able to see the publicdata project.

Let me know if there is any issue!

Best regards,

Madina

Hello,

I am using cognite javascript sdk to load 3d model from openindustrialdata project. I am following the documentation mentioned here https://github.com/cognitedata/cognite-sdk-js/blob/master/guides/authentication.md#how-to-authenticate-with-the-sdk but its not generating any token. I am using the values of client id, tenantid mentioned in the section Details to create the cognite client when using JavaScript applications of this thread. It is not executing code in gettoken function as account from session storage is always coming null. Would some one look into this and let me achieve connecting to public data from angular app and load 3d model using reveal/cognite viewer

cluster = 'api'
   baseUrl = `https://${this.cluster}.cognitedata.com`;

  scopes = s
    `${this.baseUrl}/DATA.VIEW`,
    `${this.baseUrl}/IDENTITY`
  ];

  // MSAL configuration
  configuration: Configuration = {
    auth: {
      clientId: "dea6bb8d-0f48-4bf0-a469-176fc19edc14",
      authority: "https://login.microsoftonline.com/48d5043c-cf70-4c49-881c-c638f5796997",
    },
  };

 pca = new PublicClientApplication(this.configuration);
 getToken = async () => {
    const accountId = sessionStorage.getItem("account");
    //if(accountId != null){
    const account = this.pca.getAccountByLocalId(accountId)!;
    const token = await this.pca.acquireTokenSilent({
      account,
      scopes:this.scopes,
    }).catch(e => {
      return this.pca.acquireTokenPopup({
      account,
      scopes:this.scopes,
      });
    });
    return token.accessToken;
  //}
  //return '';
  }; 

public async setupClient(){
     this.client = new CogniteClient({
      appId: 'OID-js',
      project: 'publicdata',
      getToken: this.getToken
    });

    await this.client.authenticate();
  }