Question

我正在尝试使用以下链接中提供的MSI示例：

https://docs.microsoft.com/en-us/python/azure/python-sdk-azure-authenticate?view=azure-python#mgmt-auth-msi

为此，我创建了一个Linux VM，在其上安装了MSI扩展并在python应用程序中运行代码，当我运行该python应用程序时，我收到以下错误：

[azureuser@vish-redhat ~]$ python msi-auth.py 
No handlers could be found for logger "msrestazure.azure_active_directory"
Traceback (most recent call last):
  File "msi-auth.py", line 10, in <module>
    subscription = next(subscription_client.subscriptions.list())
  File "/usr/lib/python2.7/site-packages/msrest/paging.py", line 121, in __next__
    self.advance_page()
  File "/usr/lib/python2.7/site-packages/msrest/paging.py", line 107, in advance_page
    self._response = self._get_next(self.next_link)
  File "/usr/lib/python2.7/site-packages/azure/mgmt/resource/subscriptions/v2016_06_01/operations/subscriptions_operations.py", line 207, in internal_paging
    request, header_parameters, **operation_config)
  File "/usr/lib/python2.7/site-packages/msrest/service_client.py", line 191, in send
    session = self.creds.signed_session()
  File "/usr/lib/python2.7/site-packages/msrestazure/azure_active_directory.py", line 685, in signed_session
    self.set_token()
  File "/usr/lib/python2.7/site-packages/msrestazure/azure_active_directory.py", line 681, in set_token
    self.scheme, _, self.token = get_msi_token(self.resource, self.port, self.msi_conf)
  File "/usr/lib/python2.7/site-packages/msrestazure/azure_active_directory.py", line 590, in get_msi_token
    result = requests.post(request_uri, data=payload, headers={'Metadata': 'true'})
  File "/usr/lib/python2.7/site-packages/requests/api.py", line 108, in post
    return request('post', url, data=data, json=json, **kwargs)
  File "/usr/lib/python2.7/site-packages/requests/api.py", line 50, in request
    response = session.request(method=method, url=url, **kwargs)
  File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 464, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 576, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python2.7/site-packages/requests/adapters.py", line 415, in send
    raise ConnectionError(err, request=request)
requests.exceptions.ConnectionError: ('Connection aborted.', error(111, 'Connection refused'))
[azureuser@vish-redhat ~]$

代码：

from msrestazure.azure_active_directory import MSIAuthentication
from azure.mgmt.resource import ResourceManagementClient, SubscriptionClient

# Create MSI Authentication
credentials = MSIAuthentication()


# Create a Subscription Client
subscription_client = SubscriptionClient(credentials)
subscription = next(subscription_client.subscriptions.list())
subscription_id = subscription.subscription_id

# Create a Resource Management client
resource_client = ResourceManagementClient(credentials, subscription_id)


# List resource groups as an example. The only limit is what role and policy are assigned to this MSI token.
for resource_group in resource_client.resource_groups.list():
    print(resource_group.name)

Answer 1

您需要在Linux VM中安装Python SDK。请参阅此official document。

pip install azure

此外，您需要在订阅级别为您的VM授予所有者角色。

有关此问题的详情，请参阅此link。

现在，您可以使用此代码在VM上进行测试。我在实验室测试，它对我有用。

注意：您需要将resource_client = ResourceManagementClient(credentials, subscription_id)修改为resource_client = ResourceManagementClient(credentials, str(subscription_id))，它需要字符串类型。

Answer 2

连接错误通常是因为扩展程序尚不可用。您可以尝试使用带有az login --msi

的CLI提供扩展

https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/how-to-use-vm-sign-in

如果可行，则可以使用MSI支持正确创建VM。它没有，可能你的扩展没有正确配置。

请注意，我们更改了从VM内部获取带有MSI的令牌的方法。我们现在使用IMDS： https://docs.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service

从CLI的下一个版本（2018年4月的第一个版本）开始，CLI将直接使用IMDS进行身份验证，而不再使用VM扩展。这已经在0.4.25版本的基础库msrestazure中提供。这个将完全绕过您的VM扩展以使用IMDS，现在是首选方案。您可以尝试使用此版本的msrestazure吗？如果它适用于0.4.25而不是0.4.24，这可能意味着您的VM扩展未正确安装，但您不关心，因为它是一个弃用的场景：）

请注意，为了获取令牌，您的VM不需要任何特殊权限或订阅所有权。但是，要使此令牌有用，您需要它:)。但由于您的错误与“获取令牌”部分有关而非权限，我建议您在以后遇到权限问题时可能需要此补充信息：

https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/howto-assign-access-cli

（完全披露，我在SDK / CLI团队的MS工作并编写了MSI支持）

使用托管服务标识（MSI）在VM中验证python应用程序

2 个答案: