Question

我在不同租户的订阅中执行Runbook时遇到问题。

这是我到目前为止所做的：

1）创建了一个keyvault证书 2）出口.cer和.PFX证书。
3）在rpgorch-aad账户（300eab96-4619-4b6b-af42-8eb66506ab04）上创建了服务负责人 4）在自动化中创建与该服务主体的信息的连接
5）将受密码保护的PFX上载到自动化证书存储区

首先，来自同一租户的一个工作示例：

    $connectionName = 'AzureRunasConnection'
"Getting Azure Connection $connectionName"
$servicePrincipalConnection = Get-AutomationConnection -Name $connectionName         
"Logging in to Azure using Add-AzureRmAccount"
Add-AzureRmAccount -ServicePrincipal `
    -Tenant $servicePrincipalConnection.TenantID `
    -ApplicationId $servicePrincipalConnection.ApplicationId `
    -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint -Verbose

"Setting Context with Set-AzureRmContext"
Set-AzureRmContext -Tenant $servicePrincipalConnection.TenantID -SubscriptionId $servicePrincipalConnection.SubscriptionId -Verbose
"Writing Output of the Service Principal Connection"
 write-output $servicePrincipalConnection

"Testing getting resource groups."
Get-AzureRmResourceGroup

结果：

Getting Azure Connection AzureRunasConnection  
Logging in to Azure using Add-AzureRmAccount  

PSComputerName        : localhost  
PSSourceJobInstanceId : Redacted  
Environments          : {AzureCloud, AzureChinaCloud, AzureUSGovernment}  
Context               : Microsoft.Azure.Commands.Profile.Models.PSAzureContext  

Setting Context with Set-AzureRmContext  
PSComputerName        : localhost  
PSSourceJobInstanceId : Redacted  
Account               : Redacted  
Environment           : AzureCloud  
Subscription          : Redacted  
Tenant                : Redacted  

Writing Output of the Service Principal Connection  

Name                           Value                                                                                    
----                           -----                                                                                    
SubscriptionId                 Redacted                                                     
TenantId                       Redacted                                                     
ApplicationId                  Redacted                                                     
CertificateThumbprint          Redacted                                                 


Testing getting resource groups.

PSComputerName        : localhost  
PSSourceJobInstanceId : Redacted  
ResourceGroupName     : Redacted  
Location              : eastus  
Resources             :   
ResourcesTable        :   
ProvisioningState     : Succeeded  
Tags                  : {}  
TagsTable             :   
ResourceId            : /subscriptions/Redacted/resourceGroups/Redacted

现在是SAME代码，但是对于其他租户。

$connectionName = 'Redacted'
"Getting Azure Connection"  
$connectionName

$Conn = Get-AutomationConnection -Name $connectionName 

"Logging in to Azure using Add-AzureRmAccount"
Add-AzureRmAccount -ServicePrincipal `
    -Tenant $Conn.TenantID `
    -ApplicationId $Conn.ApplicationId `
    -CertificateThumbprint $Conn.CertificateThumbprint -Verbose

"Setting Context with Set-AzureRmContext"
Set-AzureRmContext -Tenant $Conn.TenantID -SubscriptionId $Conn.SubscriptionId -Verbose

"Selecting subscriptionID "
$Conn.SubscriptionID
Select-AzureSubscription -SubscriptionId $Conn.SubscriptionID 

"Testing getting resource groups."
Get-AzureRmResourceGroup

结果：

Getting Azure Connection
RPGOrchResourceManagement

Logging in to Azure using Add-AzureRmAccount

Results: 
PSComputerName        : localhost
PSSourceJobInstanceId : Redacted
Environments          : {AzureCloud, AzureChinaCloud, AzureUSGovernment}
Context               : Microsoft.Azure.Commands.Profile.Models.PSAzureContext

              Setting Context with Set-AzureRmContext
Set-AzureRmContext : Provided subscription Redacted does not exist
At ManageSingleVM:52 char:52
+ 
    + CategoryInfo          : CloseError: (:) [Set-AzureRmContext], ArgumentException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.SetAzureRMContextCommand

PSComputerName        : localhost
PSSourceJobInstanceId : Redacted
Environments          : {AzureCloud, AzureChinaCloud, AzureUSGovernment}
Context               : Microsoft.Azure.Commands.Profile.Models.PSAzureContext

              Setting Context with Set-AzureRmContext
Set-AzureRmContext : Provided subscription Redacted does not exist
At ManageSingleVM:52 char:52
+ 
    + CategoryInfo          : CloseError: (:) [Set-AzureRmContext], ArgumentException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.SetAzureRMContextCommand

Answer 1

我找到了答案。对于其他任何人，我需要在应用程序ID上运行此命令：

OncePerRequestFilter

Azure自动化：来自不同租户的服务主体帐户进行身份验证但不返回服务主体

1 个答案: