在本机应用程序中使用ClientSecretCredential对BlobServiceClient进行身份验证

Question

我正在尝试进行身份验证，以在本机.net应用程序中使blob存储区蔚蓝。以下代码产生403。我看不到触发任何身份验证流（例如，未同意或TFA提示），但也许不应该这样。客户端注册配置为具有user_impersonation范围的本机应用程序。我想知道应该采取什么步骤进行故障排除。

var credential = new ClientSecretCredential(tenantid, appid, clientSecret);                                
client = new BlobServiceClient(accountUri, credential);

// Make a service request to verify we've successfully authenticated
var foo= await client.GetPropertiesAsync();

响应：

Azure.RequestFailedException: This request is not authorized to perform this operation using this permission.
RequestId:73e54cff-401e-004d-7211-685a00000000
Time:2020-08-01T14:37:01.2280787Z
Status: 403 (This request is not authorized to perform this operation using this permission.)
ErrorCode: AuthorizationPermissionMismatch

Headers:
x-ms-request-id: 73e54cff-401e-004d-7211-685a00000000
x-ms-client-request-id: a9a34270-db76-424b-ac33-750b2cdb2ffb
x-ms-version: 2019-12-12
x-ms-error-code: AuthorizationPermissionMismatch
Date: Sat, 01 Aug 2020 14:37:00 GMT
Server: Windows-Azure-Blob/1.0,Microsoft-HTTPAPI/2.0
Content-Length: 279
Content-Type: application/xml

Answer 1

如果要客户端凭据流访问Azure存储，则需要将Azure RABC角色（存储Blob数据贡献者）分配给Azure AD应用程序。有关更多详细信息，请参阅document

例如

1. Register Azure AD application via Azure Portal。

2. Create a client secret for the application

3. Azure RABC角色（存储Blob数据贡献者）到Azure AD应用程序。

4. 代码

var clientId = "42e0d***2d988c4";
            var secret = "Gbx2***fQpIjoae:";
            var tenant = "e4c9ab4***2a757fb";

            ClientSecretCredential credential = new ClientSecretCredential(tenant, clientId, secret);
            string accountName = "jimtestdiag924";

            string url = string.Format("https://{0}.blob.core.windows.net/", accountName);
            var client = new BlobServiceClient(new Uri(url), credential);

            var foo = await client.GetPropertiesAsync();