Question

我正在研究使用Azure AD验证对Azure存储帐户的访问。

https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/services-support-msi#azure-services-that-support-azure-ad-authentication



    using Microsoft.Azure.Services.AppAuthentication; // 1.1.0-preview
    using Microsoft.WindowsAzure.Storage; // 9.3.0
    using Microsoft.WindowsAzure.Storage.Auth;
    using Microsoft.WindowsAzure.Storage.Blob;
    using Microsoft.WindowsAzure.Storage.Queue;
    using Microsoft.WindowsAzure.Storage.Table;
    using System;
    using System.Threading.Tasks;

    class Program
    {
        static async Task Main(string[] args)
        {
            string storageAccountName = "fill_in";

            AzureServiceTokenProvider azureServiceTokenProvider = new AzureServiceTokenProvider();

            string accessToken = await azureServiceTokenProvider.GetAccessTokenAsync("https://storage.azure.com/");//, tenantId);
            TokenCredential tokenCredential = new TokenCredential(accessToken);

            StorageCredentials storageCredentials = new StorageCredentials(tokenCredential);

            // blobs access
            CloudBlobClient cloudBlobClient = new CloudBlobClient(new StorageUri(new Uri($"https://{storageAccountName}.blob.core.windows.net")), storageCredentials);

            ContainerResultSegment containerResultSegment = await cloudBlobClient.ListContainersSegmentedAsync(null);

            CloudBlobContainer cloudBlobContainer = cloudBlobClient.GetContainerReference("test" + DateTime.Now.Ticks);

            await cloudBlobContainer.CreateIfNotExistsAsync();

            // queue access
            CloudQueueClient cloudQueueClient = new CloudQueueClient(new StorageUri(new Uri($"https://{storageAccountName}.queue.core.windows.net")), storageCredentials);

            QueueResultSegment queueResultSegment = await cloudQueueClient.ListQueuesSegmentedAsync(null);

            CloudQueue cloudQueue = cloudQueueClient.GetQueueReference("test" + DateTime.Now.Ticks);

            await cloudQueue.CreateIfNotExistsAsync();

            // table access
            CloudTableClient cloudTableClient = new CloudTableClient(new StorageUri(new Uri($"https://{storageAccountName}.table.core.windows.net")), storageCredentials);

            // this http request results in "HTTP/1.1 403 Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature." 
            TableResultSegment tableResultSegment = await cloudTableClient.ListTablesSegmentedAsync(null);

            CloudTable cloudTable = cloudTableClient.GetTableReference("test" + DateTime.Now.Ticks);

            await cloudTable.CreateIfNotExistsAsync();
        }
    }

尝试使用表会导致Microsoft.WindowsAzure.Storage.StorageException：'服务器无法验证请求。确保包括签名在内的Authorization标头的值正确形成。'

在portal.azure.com中，我确实看到了

的角色

存储Blob数据___（预览）
存储队列数据___（预览）

以这种方式使用Azure存储表目前不在范围内，还是我丢失了某些东西？

关于，弗洛里安

Answer 1

AAD身份验证尚不支持表。从可用角色中只能看到Blob和队列。

Answer 2

Azure AD集成当前可用于Blob和队列服务的预览。尚不支持表格服务。

通过AzureServiceTokenProvider for CloudTableClient进行Azure存储身份验证

2 个答案: