使用 X509Certificate2 的 Azure 管理 API 身份验证问题

Question

我在带有证书授权的 azure 管理 API 中的授权存在问题。使用 Microsoft.Azure.Management.Sql 时出现错误：“AuthenticationFailedInvalidHeader: Authentication failed。‘Authorization’标头以无效格式提供。”但是当我用几乎相同的代码使用 Microsoft.WindowsAzure.Management.Sql 时，一切正常，但这是这个库的旧版本。我需要更新的版本，因为旧的看起来不支持弹性池。

这项工作很好

using System;
using System.Collections.Generic;
using System.Security.Cryptography.X509Certificates;
using Microsoft.WindowsAzure;
using Microsoft.WindowsAzure.Management.Sql;
using Microsoft.WindowsAzure.Management.Sql.Models;

namespace Test2
{
    class Program
    {
        private static ServerListResponse servers;
        private static string _resourceGroupName = "xxx";
        private static string subscriptionId = "xxx";
        private static string certThumbprint = "xxx";

        static void Main(string[] args)
        {
            X509Certificate2 cert = GetCertificate(certThumbprint);

            SubscriptionCloudCredentials credentials = new CertificateCloudCredentials(subscriptionId, cert);
            SqlManagementClient client = new SqlManagementClient(credentials);

            servers = client.Servers.List();

            Console.ReadKey();
        }            
    }
}

这会产生错误

using System;
using System.Collections.Generic;
using System.Security.Cryptography.X509Certificates;
using System.Threading.Tasks;
using Microsoft.Azure;
using Microsoft.Azure.Management.Sql;
using Microsoft.Azure.Management.Sql.Models;

namespace Test2
{
    class Program
    {
        private static ServerListResponse servers;
        private static string _resourceGroupName = "xxx";
        private static string subscriptionId = "xxx";
        private static string certThumbprint = "xxx";

        static void Main(string[] args)
        {
            X509Certificate2 cert = GetCertificate(certThumbprint);

            SubscriptionCloudCredentials credentials = new CertificateCloudCredentials(subscriptionId, cert);
            SqlManagementClient client = new SqlManagementClient(credentials);

            Task.Run(async () =>
            {
                servers = await client.Servers.ListAsync(_resourceGroupName);
            }).Wait();

            Console.ReadKey();
        }               
    }
}

Answer 1

对于 Microsoft.Azure，他们更改了授权策略。 X509Certificates 不再像那样受支持。但是，您可以将 ADAL 与交互式登录或服务主体一起使用。

这是一个示例代码：

交互式登录：

using System;
using System.Security;
using Microsoft.Azure.Management.Sql;
using Microsoft.IdentityModel.Clients.ActiveDirectory;
using Microsoft.Azure;

namespace GetSqlARM
{
    class Program
    {
        static void Main(string[] args)
        {
            var token = GetTokenCloudCredentials();
            SqlManagementClient client = new SqlManagementClient(token);

            var server = client.Servers.Get("<Your Resource Group>", "<Your Sql Server>");

            System.Console.WriteLine(server.ToString());
            System.Console.WriteLine("Press ENTER to continue");
            System.Console.ReadLine();
        }

        public static TokenCloudCredentials GetTokenCloudCredentials()
        {
            String tenantID = "<Your Tenant ID>";
            String loginEndpoint = "https://login.windows.net/";
            Uri redirectURI = new Uri("urn:ietf:wg:oauth:2.0:oob");
            String clientID = "1950a258-227b-4e31-a9cf-717495945fc2";
            String subscriptionID = "<Your Subscription ID>";
            String resource = "https://management.core.windows.net/";
            String authString = loginEndpoint + tenantID;

            AuthenticationContext authenticationContext = new AuthenticationContext(authString, false);

            var promptBehaviour = PromptBehavior.Auto;

            var userIdentifierType = UserIdentifierType.RequiredDisplayableId;

            var userIdentifier = new UserIdentifier("<Your Azure Account>", userIdentifierType);

            var authenticationResult = authenticationContext.AcquireToken(resource, clientID, redirectURI, promptBehaviour, userIdentifier);

            return new TokenCloudCredentials(subscriptionID, authenticationResult.AccessToken);
        }
    }
}

服务负责人：

将上述程序中的GetTokenCloudCredentials方法替换为以下内容。

    public static TokenCloudCredentials GetTokenCloudCredentials()
    {
        String tenantID = "<Your Tenant ID>";
        String loginEndpoint = "https://login.windows.net/";
        String subscriptionID = "<Your Subscription ID>";
        String authString = loginEndpoint + tenantID;
        String clientID = "<Your Client ID>";
        String key = "<Your Client Key>";
        var clientCred = new ClientCredential(clientID, key);
        String resource = "https://management.core.windows.net/";

        AuthenticationContext authenticationContext = new AuthenticationContext(authString, false);

        var authenticationResult = authenticationContext.AcquireToken(resource, clientCred);

        return new TokenCloudCredentials(subscriptionID, authenticationResult.AccessToken);
    }

为了使用服务主体代码，您需要关注this article创建一个服务主体。

对于那些包，我使用的是以下版本：

• Microsoft.Azure.Management.Sql，v0.46.0-prerelease
• Microsoft.IdentityModel.Clients.ActiveDirectory，v2.26.305102204
• Microsoft.Rest.ClientRuntime.Azure，v3.2.0

Answer 2

新的 api 使用资源管理器，其中典型的场景是使用客户端 id /secret 或用户名/密码进行身份验证。

也就是说，如果您想坚持使用证书，这当然是可能的，但确实需要进行一些设置工作。 ARM 基本上“通过”应用程序进行身份验证，您可以在该应用程序上配置 pki。不久前我写过关于配置的文章（使用 PowerShell，但应该是可转移的）：

http://hindenes.com/trondsworking/2015/07/19/certificate-based-authentication-to-azure-resource-manager-using-powershell/