使用用户分配的托管标识进行 Azure 服务总线身份验证

Question

我们需要运行从 Azure 应用服务和 Azure Functions 访问 Azure 服务总线 (ASB) 的应用。我们需要使用用户分配的身份进行身份验证。我们编写以下代码，该代码适用于系统分配的身份，但不适用于用户分配的身份:

var tokenProvider = TokenProvider.CreateManagedIdentityTokenProvider();
var managementClient = new ManagementClient(serviceBusEndpoint, tokenProvider);

if(await managementClient.QueueExistsAsync(queueName))
{
    return new OkObjectResult($"Queue with name {queueName} exists.");
}
else
{
    return new OkObjectResult($"Queue with name {queueName} doesn't exist.");
}

抛出此错误:

Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProviderException: Parameters: Connection String: [No connection string specified], Resource: https://servicebus.azure.net/, Authority: . Exception Message: Tried the following 3 methods to get an access token, but none of them worked.
Parameters: Connection String: [No connection string specified], Resource: https://servicebus.azure.net/, Authority: . Exception Message: Tried to get token using Managed Service Identity. Access token could not be acquired. MSI ResponseCode: BadRequest, Response: {"StatusCode":400,"Message":"No MSI found for specified ClientId/ResourceId.","CorrelationId":"dd2bcf6c-6f1d-489e-b178-ca6007502841"}
Parameters: Connection String: [No connection string specified], Resource: https://servicebus.azure.net/, Authority: . Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Visual Studio Token provider file not found at "D:\local\LocalAppData\.IdentityService\AzureServiceAuth\tokenprovider.json"
Parameters: Connection String: [No connection string specified], Resource: https://servicebus.azure.net/, Authority: . Exception Message: Tried to get token using Azure CLI. Access token could not be acquired. 'az' is not recognized as an internal or external command,
operable program or batch file.


   at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAccessTokenAsyncImpl(String authority, String resource, String scope)
   at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAccessTokenAsync(String resource, String tenantId)
   at Microsoft.Azure.ServiceBus.Primitives.ManagedIdentityTokenProvider.GetTokenAsync(String appliesTo, TimeSpan timeout)
   at Microsoft.Azure.ServiceBus.Management.ManagementClient.GetToken(String requestUri)
   at Microsoft.Azure.ServiceBus.Management.ManagementClient.SendHttpRequest(HttpRequestMessage request, CancellationToken cancellationToken)
   at Microsoft.Azure.ServiceBus.Management.ManagementClient.GetEntity(String path, String query, Boolean enrich, CancellationToken cancellationToken)
   at Microsoft.Azure.ServiceBus.Management.ManagementClient.GetQueueAsync(String queuePath, CancellationToken cancellationToken)
   at Microsoft.Azure.ServiceBus.Management.ManagementClient.QueueExistsAsync(String queuePath, CancellationToken cancellationToken)

所以核心错误是找不到指定的ClientId/ResourceId的MSI。。看起来我们需要指定客户端 ID。然后我们发现https://github.com/Azure/azure-sdk-for-net/tree/master/sdk/identity/Azure.Identity使用 ManagedIdentityCredential 我们可以在其中指定客户端 ID，但尚未弄清楚如何将其用于 ASB。

其他选项是使用 HTTP GET 请求发送到 MSI_ENDPOINT，如此处所述 https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity?context=azure%2Factive-directory%2Fmanaged-identities-azure-resources%2Fcontext%2Fmsi-context&tabs=dotnet#obtaining-tokens-for-azure-resources ，但我们可能错过了真正可用的 .net 库。

Answer 1

TokenProvider.CreateManagedIdentityTokenProvider 依赖于 Microsoft.Azure.Services.AppAuthentication用于实现托管身份。

从 Microsoft.Azure.Services.AppAuthentication 版本 1.2.1 开始支持用户分配的托管标识。文档可以找到 here 。

因此，您必须做两件事才能使此功能与您已有的代码一起工作:

1.将Microsoft.Azure.Services.AppAuthentication版本更新至最新

2.在AppService的应用设置中将AzureServicesAuthConnectionString设置为RunAs=App;AppId={用户分配标识的ClientId}。例如RunAs=应用程序；AppId=587f16c8-81ed-41c7-b19a-9ded0dbe2ca2

完成这两个步骤后，您的代码应该使用用户分配的托管标识。我用应用程序服务尝试了这一点，它对我来说效果很好。