针对 Azure 事件中心的 RBAC 身份验证

Question

我希望使用 RBAC 对 Azures 事件中心进行身份验证。当前的实现是在 Python 中并使用 SAS，但我们希望更好地控制访问。我只在C# 中找到了如何做到这一点。是否可以在 Python 或 Java 中实现？

Answer 1

是的，它在 azure-eventhub v5 Python SDK 中受支持，pypi 上提供。

我假设您已经了解这些 RBAC 机制的工作原理，熟悉 AzureAD/Identity/Credential 等概念。

您可以在设置EventHubProducerClient/EventHubConsumerClient时关注sample code来配置您的凭据：

import os
from azure.eventhub import EventData, EventHubProducerClient
from azure.identity import EnvironmentCredential


fully_qualified_namespace = os.environ['EVENT_HUB_HOSTNAME']
eventhub_name = os.environ['EVENT_HUB_NAME']

credential = EnvironmentCredential()

# Note: One has other options to specify the credential.  For instance, DefaultAzureCredential.
# Default Azure Credentials attempt a chained set of authentication methods, per documentation here: https://github.com/Azure/azure-sdk-for-python/tree/master/sdk/identity/azure-identity
# For example user to be logged in can be specified by the environment variable AZURE_USERNAME, consumed via the ManagedIdentityCredential
# Alternately, one can specify the AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET to use the EnvironmentCredentialClass.
# The docs above specify all mechanisms which the defaultCredential internally support.
#
# credential = DefaultAzureCredential()

producer = EventHubProducerClient(fully_qualified_namespace=fully_qualified_namespace,
                                  eventhub_name=eventhub_name,
                                  credential=credential)

with producer:
    event_data_batch = producer.create_batch()
    while True:
        try:
            event_data_batch.add(EventData('Message inside EventBatchData'))
        except ValueError:
            # EventDataBatch object reaches max_size.
            # New EventDataBatch object can be created here to send more data.
            break
    producer.send_batch(event_data_batch)

print('Finished sending.')

如果您是 v1 用户，您可以关注migration guide from v1 to v5 来迁移您的程序。