Question

我正在尝试使用azure sdk创建服务主体。但是，我收到一个错误

{"odata.error":{"code":"Authorization_RequestDenied","message":{"lang":"en","value":"Insufficient privileges to complete the operation."}}}

我在做什么错？我正在执行以下操作：

使用“所有者”角色创建服务主体

az ad sp create-for-rbac -n "OrbitTest5" --role Owner --sdk-auth

通过环境变量将创建的服务主体的凭据传递给凭据提供者

public class AzureAppEnvCredentialProvider implements AzureCredentialProvider {
  public static final String ENV_CLIENT_ID = "CLIENT_ID";
  public static final String ENV_TENANT_ID = "TENANT_ID";
  public static final String ENV_SUBSCRIPTION_ID = "SUBSCRIPTION_ID";
  public static final String ENV_CLIENT_SECRET = "CLIENT_SECRET";

  private final String subscriptionId;

  public AzureAppEnvCredentialProvider() {
    this.subscriptionId = Preconditions.checkNotNull(System.getenv(ENV_SUBSCRIPTION_ID));
  }

  @Override
  public AzureTokenCredentials getCredentials() {
    final String clientId = Preconditions.checkNotNull(System.getenv(ENV_CLIENT_ID));
    final String tenantId = Preconditions.checkNotNull(System.getenv(ENV_TENANT_ID));
    final String clientSecret = Preconditions.checkNotNull(System.getenv(ENV_CLIENT_SECRET));
    return new ApplicationTokenCredentials(clientId, tenantId, clientSecret, AzureEnvironment.AZURE);
  }

  @Override
  public String getSubscriptionId() {
    return this.subscriptionId;
  }
}

使用凭据通过java sdk创建服务主体

    azureAuthClient = Azure.configure().authenticate(credentialProvider.getCredentials());

    final ServicePrincipal servicePrincipal = 
        azureAuthClient.servicePrincipals()
        .define(clusterId)
        .withNewApplication("http://easycreate.azure.com/" + clusterId)
          .definePasswordCredential("sppass")
          .withPasswordValue("StrongPass!12")
          .attach()
        .create();

然后我得到一个例外。我知道我的凭据是有效的，因为我可以使用sdk创建资源组并从Azure Web控制台查看它。

com.microsoft.azure.management.graphrbac.GraphErrorException：状态码403，{“ odata.error”：{“ code”：“ Authorization_RequestDenied”，“ message”：{“ lang”：“ en”，“ value “：”权限不足，无法完成操作。“}}} 在sun.reflect.NativeConstructorAccessorImpl.newInstance0（本机方法）处在sun.reflect.NativeConstructorAccessorImpl.newInstance（NativeConstructorAccessorImpl.java:62）在sun.reflect.DelegatingConstructorAccessorImpl.newInstance（DelegatingConstructorAccessorImpl.java:45）在java.lang.reflect.Constructor.newInstance（Constructor.java:423）在com.microsoft.rest.ServiceResponseBuilder.build（ServiceResponseBuilder.java:122）在com.microsoft.azure.AzureResponseBuilder.build（AzureResponseBuilder.java:56）在com.microsoft.azure.management.graphrbac.implementation.ApplicationsInner.createDelegate（ApplicationsInner.java:194）在com.microsoft.azure.management.graphrbac.implementation.ApplicationsInner.access $ 000（ApplicationsInner.java:45）在com.microsoft.azure.management.graphrbac.implementation.ApplicationsInner $ 2.call（ApplicationsInner.java:181）在com.microsoft.azure.management.graphrbac.implementation.ApplicationsInner $ 2.call（ApplicationsInner.java:177）在rx.internal.operators.OnSubscribeMap $ MapSubscriber.onNext（OnSubscribeMap.java:69）在retrofit2.adapter.rxjava.CallArbiter.deliverResponse（CallArbiter.java:120）在retrofit2.adapter.rxjava.CallArbiter.emitResponse（CallArbiter.java:102）在retrofit2.adapter.rxjava.CallExecuteOnSubscribe.call（CallExecuteOnSubscribe.java:46）在retrofit2.adapter.rxjava.CallExecuteOnSubscribe.call（CallExecuteOnSubscribe.java:24）在rx.Observable.unsafeSubscribe（Observable.java:10327）在rx.internal.operators.OnSubscribeMap.call（OnSubscribeMap.java:48）在rx.internal.operators.OnSubscribeMap.call（OnSubscribeMap.java:33）在rx.internal.operators.OnSubscribeLift.call（OnSubscribeLift.java:48）在rx.internal.operators.OnSubscribeLift.call（OnSubscribeLift.java:30）在rx.Observable.unsafeSubscribe（Observable.java:10327）在rx.internal.operators.OnSubscribeMap.call（OnSubscribeMap.java:48）在rx.internal.operators.OnSubscribeMap.call（OnSubscribeMap.java:33）在rx.Observable.unsafeSubscribe（Observable.java:10327）在rx.internal.operators.OnSubscribeMap.call（OnSubscribeMap.java:48）在rx.internal.operators.OnSubscribeMap.call（OnSubscribeMap.java:33）在rx.Observable.unsafeSubscribe（Observable.java:10327）在rx.internal.operators.OnSubscribeMap.call（OnSubscribeMap.java:48）在rx.internal.operators.OnSubscribeMap.call（OnSubscribeMap.java:33）在rx.internal.operators.OnSubscribeLift.call（OnSubscribeLift.java:48）在rx.internal.operators.OnSubscribeLift.call（OnSubscribeLift.java:30）在rx.Observable.unsafeSubscribe（Observable.java:10327）在rx.internal.operators.OperatorSubscribeOn $ SubscribeOnSubscriber.call（OperatorSubscribeOn.java:100）在rx.internal.schedulers.CachedThreadScheduler $ EventLoopWorker $ 1.call（CachedThreadScheduler.java:230）在rx.internal.schedulers.ScheduledAction.run（ScheduledAction.java:55）在java.util.concurrent.Executors $ RunnableAdapter.call（Executors.java:511）在java.util.concurrent.FutureTask.run（FutureTask.java:266）在java.util.concurrent.ScheduledThreadPoolExecutor $ ScheduledFutureTask.access $ 201（ScheduledThreadPoolExecutor.java:180）在java.util.concurrent.ScheduledThreadPoolExecutor $ ScheduledFutureTask.run（ScheduledThreadPoolExecutor.java:293）在java.util.concurrent.ThreadPoolExecutor.runWorker（ThreadPoolExecutor.java:1149）在java.util.concurrent.ThreadPoolExecutor $ Worker.run（ThreadPoolExecutor.java:624）在java.lang.Thread.run（Thread.java:748）

Answer 1

正如我提到的，如果要创建servicePrincipal，则资源应为http://graph.windows.net或https://graph.microsoft.com。

因此，我们需要添加权限来操作Azure AD Graph API或Microsoft Graph API。

并且不要忘记 Grant permission 。

我使用Azure Active Directory API对其进行了测试。我可以正常工作。

演示代码：

ApplicationTokenCredentials credentials = new ApplicationTokenCredentials(client,
               tenant,
                key,
                AzureEnvironment.AZURE);

Azure.Authenticated azureAuthClient = Azure.configure().authenticate(credentials);
String clusterId = "xxxxxxx";
ServicePrincipal servicePrincipal =
                azureAuthClient.servicePrincipals()
                        .define(clusterId)
                        .withNewApplication("http://easycreate.azure.com/" + clusterId)
                        .definePasswordCredential("sppass")
                        .withPasswordValue("StrongPass!12")
                        .attach()
                        .create();

使用Azure Java sdk创建服务主体失败

1 个答案: