azure - 使用用户分配的身份时.NetCore 2.2 API 无法从 AAD 获取 token

Question

使用用户分配的托管标识时，我们无法从 Azure 应用服务查询 azure 中的 sql 数据库(如果我们使用系统分配的托管标识，则可以正常工作)

该应用程序是一个 .net core 2.2 Web API 应用程序。

我们为 Azure 应用服务设置了用户分配的身份。

已使用以下命令将此身份设置为 ad sql 管理员:

az sql server ad-admin create --resource-group iactests --server iactestsql --object-id -u iactestmanagementIdentity

token 的生成方式如下:

services.AddDbContext<SchoolContext>(options => options.UseSqlServer(new 
SqlConnection
        {
            ConnectionString = configuration.GetConnectionString("SchoolContext"),
            AccessToken = isDevelopmentEnvironment ? null : new AzureServiceTokenProvider().GetAccessTokenAsync("https://database.windows.net/").Result
        }), ServiceLifetime.Scoped);

这是我们得到的错误:

    Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProviderException: Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried the following 3 methods to get an access token, but none of them worked.
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried to get token using Managed Service Identity. Access token could not be acquired. MSI ResponseCode: BadRequest, Response: 
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Visual Studio Token provider file not found at "D:\local\LocalAppData\.IdentityService\AzureServiceAuth\tokenprovider.json"
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried to get token using Azure CLI. Access token could not be acquired. 'az' is not recognized as an internal or external command,
operable program or batch file.


at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAuthResultAsyncImpl(String authority, String resource, String scope)
at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAuthenticationResultAsync(String resource, String tenantId)
at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAccessTokenAsync(String resource, String tenantId)
--- End of inner exception stack trace ---

如果我们使用系统分配身份并将 sql 广告管理员配置为所述身份，则效果很好

有什么想法吗？

提前致谢

Answer 1

自 1.2.0-preview2 release 起，AppAuthentication 库现在支持为 Azure VM 和应用服务指定用户分配的身份。 。

要使用用户分配的身份，您需要设置以下格式的 AppAuthentication 连接字符串:

RunAs=App;AppId={ClientId of user-assigned identity}

AppAuthentication 连接字符串可以设置为传递给 AzureServiceTokenProvider 构造函数的参数，或在 AzureServicesAuthConnectionString 环境变量中指定。有关 AppAuthentication 连接字符串的更多信息，请参阅 here .