Question

我正在尝试使用系统分配的App Service身份从App Service（Web API）向Azure密钥保管库进行身份验证。在Azure密钥保管库中，我创建了一个访问策略，该访问策略使App Service可以访问密钥，机密和证书（稍后将对此进行限制！）。

在App Service中，我尝试获取身份验证令牌（请参阅代码段），但是GetAccessTokenAsync给了我Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider的异常，消息如下所示。

通过搜索，我发现了很多关于此错误的描述，但没有关于原因或解决方案的有用提示。

请注意，我使用服务主体对同一密钥库进行身份验证没有问题，但是使用托管身份的想法当然是为了避免在任何地方存储客户端ID和机密之类的凭据

        var azureServiceTokenProvider = new AzureServiceTokenProvider();
        string accessToken = await azureServiceTokenProvider.GetAccessTokenAsync(VaultUrl);

        Client = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));

异常消息：

Parameters: Connection String: [No connection string specified], Resource: https://efipsexternals.vault.azure.net/, Authority: . Exception Message: Tried the following 4 methods to get an access token, but none of them worked.\r\nParameters: Connection String: [No connection string specified], Resource: https://<VAULTNAME>.vault.azure.net/, Authority: . Exception Message: Tried to get token using Managed Service Identity. Access token could not be acquired. Received a non-retryable error. MSI ResponseCode: BadRequest, Response: {\"ExceptionMessage\":\"AADSTS500011: The resource principal named https://<VAULTNAME>.vault.azure.net/ was not found in the tenant named <TENANTID>. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.\\r\\nTrace ID: 52674a60-5e9c-432c-b999-e13e326f2000\\r\\nCorrelation ID: b335c7b2-2f38-4cc0-9ec3-6662c7ee5546\\r\\nTimestamp: 2019-10-27 10:58:52Z\",\"ErrorCode\":\"invalid_resource\",\"ServiceErrorCodes\":[\"500011\"],\"StatusCode\":400,\"Message\":null,\"CorrelationId\":\"102c92f1-525a-44ee-a383-d7e40ccd2ed4\"}\r\nParameters: Connection String: [No connection string specified], Resource: https://<VAULTNAME>.vault.azure.net/, Authority: . Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Visual Studio Token provider file not found at \"D:\\local\\LocalAppData\\.IdentityService\\AzureServiceAuth\\tokenprovider.json\"\r\nParameters: Connection String: [No connection string specified], Resource: https://<VAULTNAME>.vault.azure.net/, Authority: . Exception Message: Tried to get token using Azure CLI. Access token could not be acquired. 'az' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n\r\nParameters: Connection String: [No connection string specified], Resource: https://<VAULTNAME>.vault.azure.net/, Authority: https://login.microsoftonline.com/common. Exception Message: Tried to get token using Active Directory Integrated Authentication. Access token could not be acquired. Failed to get user name from the operating system.Inner Exception : The format of the specified domain name is invalid\r\n

Answer 1

GetAccessTokenAsync方法需要一个资源标识符，例如此处https://vault.azure.com/。

// Instantiate a new KeyVaultClient object, with an access token to Key Vault
var azureServiceTokenProvider1 = new AzureServiceTokenProvider();
var kv = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider1.KeyVaultTokenCallback));

// Optional: Request an access token to Key Vault
var azureServiceTokenProvider2 = new AzureServiceTokenProvider();
string accessToken = await azureServiceTokenProvider2.GetAccessTokenAsync("https://vault.azure.com/").ConfigureAwait(false);

遇到Connection String: [No connection string specified]错误时，请尝试以下方法进行故障排除。

1。在RunAs=App;的connectionString参数中传递AzureServiceTokenProvider。这样，它将不会尝试使用不同的模式来获取令牌，并且例外情况要好一些。

2。安装/更新Microsoft.Azure.Services.AppAuthentication的最新版本。

有关更多详细信息，您可以参考此article。

Answer 2

要获取具有用于天蓝色密钥保管库的受管身份的访问令牌，您只需：

var azureServiceTokenProvider = new AzureServiceTokenProvider();
var keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));

这里不需要代码string accessToken = await azureServiceTokenProvider.GetAccessTokenAsync(VaultUrl);，它应该是问题的根本原因。您可能会将keyvault url作为参数传递给它，此处不合适。访问keyvault API的正确方法是：https://vault.azure.com/。如果要使用这段代码，可以执行以下操作：

public static async Task<string> AuthenticationCallback(string authority, string resource, string scope)
{
    Console.WriteLine($"authority:{authority}, resource:{resource}, scope:{scope}");
    return new AzureServiceTokenProvider().GetAccessTokenAsync(resource).Result;
}

static void Main(string[] args)
{
    Console.ReadLine();

    string baseUrl = "your keyvault url, for example: https://jackkv.vault.azure.net/";
    KeyVaultClient kvc = new KeyVaultClient(AuthenticationCallback);
    SecretBundle secret = kvc.GetSecretAsync(baseUrl, "testSecret").Result;
    Console.WriteLine(secret.Value);

    Console.ReadLine();
}

从应用程序服务到Azure Key Vault的身份验证失败

2 个答案: