Question

我正在尝试从Azure的密钥库中检索一些秘密，但是我似乎无法使用@ azure / identity模块进行身份验证。

版本：

"@azure/identity": "^1.0.0-preview.6",
"@azure/keyvault-secrets": "^4.0.0-preview.9",

我有一个azure函数应用程序，并且我已经使用local.settings.json在生产环境和本地配置了该应用程序，并为以下各项填充了正确的值：

{
    "IsEncrypted": false,
    "Values": {
        "AZURE_CLIENT_ID": "REDACTED",
        "AZURE_CLIENT_SECRET": "REDACTED",
        "AZIRE_TENANT_ID": "REDACTED"
    },
    "ConnectionStrings": {}
}

通过Azure Active Directory注册的应用=>应用注册。
禁用登录
创建的应用秘密

然后，我将应用程序添加到具有“读取器”角色的密钥库中，从而使其能够“获取”秘密，但没有别的，甚至没有列出：

现在，当我尝试取回秘密时：

import { KeyVaultSecret, SecretClient } from '@azure/keyvault-secrets';
import { EnvironmentCredential } from '@azure/identity';

export const GetSecret = async (key: string): Promise<string> => {
    try {
        const credential: EnvironmentCredential = new EnvironmentCredential();

        console.log('CREDENTIAL: ', credential);
        console.log('CLIENT SECRET', process.env.AZURE_CLIENT_SECRET);
        console.log('CLIENT ID', process.env.AZURE_CLIENT_ID);

        const url = 'https://tlabs-vault.vault.azure.net';
        const client = new SecretClient(url, credential);
        let secret: KeyVaultSecret = await client.getSecret(key);
        return secret.value;
    } catch (err) {
        console.error('Error getting secret from Azure Vault', err);
    }
};

但这不起作用，在控制台上，我看到凭据的结果为：

EnvironmentCredential { _credential: undefined }

以及引发错误的完整请求：

request:
[10/28/2019 1:14:16 PM]    WebResource {
[10/28/2019 1:14:16 PM]      streamResponseBody: false,
[10/28/2019 1:14:16 PM]      url:
[10/28/2019 1:14:16 PM]       'https://REDACTED_VAULT_NAME.vault.azure.net/secrets/REDACTED_SECRET_NAME/?api-version=7.0',
[10/28/2019 1:14:16 PM]      method: 'GET',
[10/28/2019 1:14:16 PM]      headers: HttpHeaders { _headersMap: [Object] },
[10/28/2019 1:14:16 PM]      body: undefined,
[10/28/2019 1:14:16 PM]      query: undefined,
[10/28/2019 1:14:16 PM]      formData: undefined,
[10/28/2019 1:14:16 PM]      withCredentials: false,
[10/28/2019 1:14:16 PM]      abortSignal: undefined,
[10/28/2019 1:14:16 PM]      timeout: 0,
[10/28/2019 1:14:16 PM]      onUploadProgress: undefined,
[10/28/2019 1:14:16 PM]      onDownloadProgress: undefined,
[10/28/2019 1:14:16 PM]      proxySettings: undefined,
[10/28/2019 1:14:16 PM]      keepAlive: true,
[10/28/2019 1:14:16 PM]      operationSpec:
[10/28/2019 1:14:16 PM]       { httpMethod: 'GET',
[10/28/2019 1:14:16 PM]         path: 'secrets/{secret-name}/{secret-version}',
[10/28/2019 1:14:16 PM]         urlParameters: [Array],
[10/28/2019 1:14:16 PM]         queryParameters: [Array],
[10/28/2019 1:14:16 PM]         responses: [Object],
[10/28/2019 1:14:16 PM]         serializer: [Serializer] } },
[10/28/2019 1:14:16 PM]   response:
[10/28/2019 1:14:16 PM]    { body:
[10/28/2019 1:14:16 PM]       '{"error":{"code":"Unauthorized","message":"Request is missing a Bearer or PoP token."}}',
[10/28/2019 1:14:16 PM]      headers: HttpHeaders { _headersMap: [Object] },
[10/28/2019 1:14:16 PM]      status: 401,
[10/28/2019 1:14:16 PM]      parsedBody: { error: [Object] } },
[10/28/2019 1:14:16 PM]   details:
[10/28/2019 1:14:16 PM]    { error:
[10/28/2019 1:14:16 PM]       { code: 'Unauthorized',
[10/28/2019 1:14:16 PM]         message: 'Request is missing a Bearer or PoP token.' } } }

Answer 1

请关注此博客，了解如何Integrate Key Vault Secrets With Azure Functions。

主要步骤是Enable system-asigned managed identity for the Function App和Add Key Vault access policy for the Function App。

这些操作之后，请不要忘记使用@Microsoft.KeyVault(SecretUri={copied identifier for the username secret})在Function App配置中添加Key Vault机密参考。如果设置正确，配置后将显示以下图片。

下面是我的测试结果，我使用os.environ[name]来获取机密。

@ azure / keyvault-secrets'请求缺少承载或PoP令牌错误401'

1 个答案: