【发布时间】：2022-08-03 18:59:11
【问题描述】：
是否可以通过 Azure Batch 上的 Azure 托管标识设置访问 Azure Key Vault 机密？我已经阅读了 Microsoft 文档，我在技术上看到的唯一选择是使用基于证书的身份验证来访问 .net 控制台应用程序中的密钥库。由于托管标识可以在 Azure Batch 中使用，我认为可以利用 DefaultAzureCredential。我没有运气让它工作。
有没有人能够让它像这样工作，还是我将不得不接受使用基于证书的身份验证？ 微软，如果你看到这个......有没有什么东西可以让这样的东西与托管身份一起使用
正在使用的技术：
- Azure 托管标识：用户分配的 (id: xxxx)
- Azure 密钥库
- 将托管身份 (id: xxx) 添加到具有机密访问权限的访问策略：get、list
- Azure 批处理
- 批处理池
- 已安装托管身份 (id: xxxx)
- 应用程序：.Net 控制台应用程序（下面的代码所在的位置）
- 批处理池
- .Net 控制台应用程序
- .Net6
这是我正在尝试做的事情：
DefaultAzureCredential credential = new DefaultAzureCredential(
new DefaultAzureCredentialOptions()
{
ManagedIdentityClientId = \"xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx\"
});
Uri uri = new(\"https://xxxxxxx.vault.azure.net/\"); //Also Tried \"https://xxxxxxx.vault.azure.net/secrets/\"
SecretClient client = new(uri, credential);
var secret = await client.GetSecretAsync(secretName);
return secret?.Value.Value;
我从批处理作业的任务中收到的错误（过滤以显示 ManagedIdentityCredential 错误）
Unhandled exception. Azure.Identity.CredentialUnavailableException: ManagedIdentityCredential authentication unavailable. The requested identity has not been assigned to this resource.
Status: 400 (Bad Request)
Content:
{\"error\":\"invalid_request\",\"error_description\":\"Identity not found\"}
Headers:
Server: IMDS/150.870.65.684
Date: Wed, 27 Jul 2022 17:47:07 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 68
at Azure.Identity.ImdsManagedIdentitySource.HandleResponseAsync(Boolean async, TokenRequestContext context, Response response, CancellationToken cancellationToken)
at Azure.Identity.ManagedIdentitySource.AuthenticateAsync(Boolean async, TokenRequestContext context, CancellationToken cancellationToken)
at Azure.Identity.ImdsManagedIdentitySource.AuthenticateAsync(Boolean async, TokenRequestContext context, CancellationToken cancellationToken)
at Azure.Identity.ManagedIdentityClient.AuthenticateAsync(Boolean async, TokenRequestContext context, CancellationToken cancellationToken)
at Azure.Identity.ManagedIdentityCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage)
at Azure.Identity.ManagedIdentityCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted[T](ValueTask`1 task)
at Azure.Identity.ManagedIdentityCredential.GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.AuthenticateRequestAsync(HttpMessage message, Boolean async)
at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.ProcessCoreAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.RedirectPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted(ValueTask task)
at Azure.Core.Pipeline.RedirectPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted(ValueTask task)
at Azure.Core.Pipeline.RetryPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
at Azure.Core.Pipeline.HttpPipeline.Send(HttpMessage message, CancellationToken cancellationToken)
at Azure.Core.Pipeline.HttpPipeline.SendRequest(Request request, CancellationToken cancellationToken)
at Azure.Security.KeyVault.KeyVaultPipeline.SendRequest(Request request, CancellationToken cancellationToken)
at Azure.Security.KeyVault.KeyVaultPipeline.SendRequest[TResult](RequestMethod method, Func`1 resultFactory, CancellationToken cancellationToken, String[] path)
at Azure.Security.KeyVault.Secrets.SecretClient.GetSecret(String name, String version, CancellationToken cancellationToken)
at wileyulab.infrastructure.SimpleService.Execute(String[] args) in C:\\AzDo\\WileyU\\wiley-u-lab\\wileyulab.infrastructure\\SimpleService.cs:line 55
at wileyulab.consoleapp.simple.Program.Main(String[] args) in C:\\AzDo\\WileyU\\wiley-u-lab\\wileyulab.consoleapp.simple\\Program.cs:line 70
-
你有正确的
AZURE_TENANT_ID设置吗？ -
您是否正确配置了用户分配的身份？ docs.microsoft.com/en-us/azure/batch/managed-identity-pools
标签： .net azure-keyvault azure-batch azure-identity defaultazurecredential