c# - Visual Studio 2019 TokenService.exe 失败，出现意外错误 : TS003: Error, TS004:无法获取访问 token

Question

环境:

Microsoft Visual Studio Community 2019
Version 16.11.9
VisualStudio.16.Release/16.11.9+32106.194

目标框架是.NET 5.0

尝试在使用 Visual Studio 建立与我们的 Azure Keyvault 的连接时进行本地测试。使用新的 Azure Identity 客户端库。

安装的 NuGet 软件包:

• Azure.Identity
• Azure.Extensions.AspNetCore.Configuration.Secrets

相关代码如下所示:

using Azure.Identity;

Microsoft.Extensions.Configuration.ConfigurationBuilder config_builder;

Azure.Identity.DefaultAzureCredentialOptions default_azure_credential_options;

Azure.Identity.DefaultAzureCredential azure_credential_default;


// Exclude all to begin with ...

default_azure_credential_options = new DefaultAzureCredentialOptions
   {

   ExcludeAzureCliCredential = true,
   ExcludeAzurePowerShellCredential = true,
   ExcludeEnvironmentCredential = true,
   ExcludeInteractiveBrowserCredential = true,
   ExcludeManagedIdentityCredential = true,
   ExcludeSharedTokenCacheCredential = true,
   ExcludeVisualStudioCodeCredential = true,
   ExcludeVisualStudioCredential = true

   };


// Try to use the Visual Studio credential ...

default_azure_credential_options.ExcludeVisualStudioCredential = false;

// Create credentials and add Azure KeyVault config keys / values ...

azure_credential_default = new DefaultAzureCredential( default_azure_credential_options );

config_builder.AddAzureKeyVault( keyvault_uri, azure_credential_default );

...

config_builder.Build();

根据文档，我通过 Visual Studio 登录到我们的 Azure 帐户。

此外，根据文档，当发生此错误时，我注销并再次登录我们的 Azure 帐户(再次通过 Visual Studio)。但是，当调用 Build() 方法时，会引发以下异常:

Azure.Identity.CredentialUnavailableException: Process "D:\apps\VStudioNet2019\Common7\IDE\Extensions\rahssdlq.j5o\TokenService\Microsoft.Asal.TokenService.exe" has failed with unexpected error: TS003: Error, TS004: Unable to get access token.  'AADSTS50020: User account '{EmailHidden}' from identity provider 'live.com' does not exist in tenant 'Microsoft Services' and cannot access the application '872cd9fa-d31f-45e0-9eab-6e460a02d1f1'(Visual Studio) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.
Trace ID: 819fe58d-fe72-4688-9750-d88409882f00
Correlation ID: 7443c9c8-757a-44af-992d-b2576add5941
Timestamp: 2022-01-26 19:24:16Z'.
 ---> System.InvalidOperationException: TS003: Error, TS004: Unable to get access token.  'AADSTS50020: User account '{EmailHidden}' from identity provider 'live.com' does not exist in tenant 'Microsoft Services' and cannot access the application '872cd9fa-d31f-45e0-9eab-6e460a02d1f1'(Visual Studio) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.
Trace ID: 819fe58d-fe72-4688-9750-d88409882f00
Correlation ID: 7443c9c8-757a-44af-992d-b2576add5941
Timestamp: 2022-01-26 19:24:16Z'
   at Azure.Identity.VisualStudioCredential.RunProcessesAsync(List`1 processStartInfos, Boolean async, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at Azure.Identity.DefaultAzureCredential.GetTokenFromSourcesAsync(TokenCredential[] sources, TokenRequestContext requestContext, Boolean async, CancellationToken cancellationToken)
   at Azure.Identity.DefaultAzureCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage)
   at Azure.Identity.DefaultAzureCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Identity.DefaultAzureCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.AuthenticateRequestAsync(HttpMessage message, Boolean async)
   at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.ProcessCoreAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
   at Azure.Core.Pipeline.RedirectPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
   at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
   at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
   at Azure.Core.Pipeline.HttpPipeline.SendRequestAsync(Request request, CancellationToken cancellationToken)
   at Azure.Security.KeyVault.KeyVaultPipeline.SendRequestAsync(Request request, CancellationToken cancellationToken)
   at Azure.Security.KeyVault.KeyVaultPipeline.GetPageAsync[T](Uri firstPageUri, String nextLink, Func`1 itemFactory, String operationName, CancellationToken cancellationToken)
   at Azure.Core.PageResponseEnumerator.FuncAsyncPageable`1.AsPages(String continuationToken, Nullable`1 pageSizeHint)+MoveNext()
   at Azure.Core.PageResponseEnumerator.FuncAsyncPageable`1.AsPages(String continuationToken, Nullable`1 pageSizeHint)+System.Threading.Tasks.Sources.IValueTaskSource<System.Boolean>.GetResult()
   at Azure.AsyncPageable`1.GetAsyncEnumerator(CancellationToken cancellationToken)+MoveNext()
   at Azure.AsyncPageable`1.GetAsyncEnumerator(CancellationToken cancellationToken)+MoveNext()
   at Azure.AsyncPageable`1.GetAsyncEnumerator(CancellationToken cancellationToken)+System.Threading.Tasks.Sources.IValueTaskSource<System.Boolean>.GetResult()
   at Azure.Extensions.AspNetCore.Configuration.Secrets.AzureKeyVaultConfigurationProvider.LoadAsync()
   at Azure.Extensions.AspNetCore.Configuration.Secrets.AzureKeyVaultConfigurationProvider.LoadAsync()
   at Azure.Extensions.AspNetCore.Configuration.Secrets.AzureKeyVaultConfigurationProvider.Load()
   at Microsoft.Extensions.Configuration.ConfigurationRoot..ctor(IList`1 providers)
   at Microsoft.Extensions.Configuration.ConfigurationBuilder.Build()

已咨询并尝试了以下方法(没有任何帮助或工作):

• https://learn.microsoft.com/en-us/dotnet/api/overview/azure/service-to-service-authentication#appauthentication-troubleshooting

• https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/TROUBLESHOOTING.md#troubleshooting-default-azure-credential-authentication-issues

有人有关于如何使用 VisualStudio 凭据进行身份验证的有效示例(分步)吗？

顺便说一句，如果我设置 ExcludeAzureCliCredential = false，并通过 Azure CLI 登录到我们的 Azure 帐户，则一切正常 - 但我仍然想知道如何使 VisualStudio 凭据选项发挥作用。

更新:2022 年 1 月 27 日 ...

终于能够让 Visual Studio 凭据正常工作——但是，它需要提供租户 ID。修改后的代码为:

Microsoft.Extensions.Configuration.ConfigurationBuilder config_builder;

Azure.Identity.DefaultAzureCredentialOptions default_azure_credential_options;

Azure.Identity.DefaultAzureCredential azure_credential_default;


// Exclude all to begin with ...

default_azure_credential_options = new DefaultAzureCredentialOptions
   {

   ExcludeAzureCliCredential = true,
   ExcludeAzurePowerShellCredential = true,
   ExcludeEnvironmentCredential = true,
   ExcludeInteractiveBrowserCredential = true,
   ExcludeManagedIdentityCredential = true,
   ExcludeSharedTokenCacheCredential = true,
   ExcludeVisualStudioCodeCredential = true,
   ExcludeVisualStudioCredential = true

   };


// Try to use the Visual Studio credential ...

default_azure_credential_options.ExcludeVisualStudioCredential = false;


/*
The tenant ID of the user to authenticate.  The default is null and will authenticate users to 
their default tenant. The value can also be set by setting the environment variable AZURE_TENANT_ID.
Here we set the value explicitly.  The value was obtained AFTER logging into Azure via the CLI, i.e.:
 > az login
 > az account list
   [
    {
     ...
     "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
     ...
    }
   ]
*/

default_azure_credential_options.VisualStudioTenantId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";

// Create credentials and add Azure KeyVault config keys / values ...

azure_credential_default = new DefaultAzureCredential( default_azure_credential_options );

config_builder.AddAzureKeyVault( keyvault_uri, azure_credential_default );

...

config_builder.Build();

上面的代码确实有效，但是，我似乎在官方文档中找不到任何说明需要租户 ID 的内容。据我所知，通过 Visual Studio IDE 登录 Azure 后应自动获取凭据(但这不起作用)。请参阅官方文档中的通过 Visual Studio 进行身份验证部分:Azure Identity client library for .NET - Version 1.5.0 - 没有提到需要租户 ID。

提前致谢。

Answer 1

感谢@Christopher Scott - 解决方案是安装以下 NuGet 包:

PM> Install-Package Azure.Security.KeyVault.Secrets -Version 4.3.0-beta.4

上述软件包“有一个新功能，将尝试执行租户发现”。

将上述包包含在项目中后，我就可以使用 Visual Studio 凭据在本地运行应用程序，而无需显式设置租户 ID。

希望 Azure.Extensions.AspNetCore.Configuration.Secrets 包很快就会更新，以使用较新的 Azure.Security.KeyVault.Secrets 包(它所依赖的)，那么原来的两个 NuGet 包将只需要使用(根据原始帖子)。