c# - Azure KeyVault : how to create clientId and clientSecret?

Question

我想将我的应用程序连接到 KeyVault。通常，我可以创建一个新客户端 key 并在我的代码中使用它。

var _keyVaultClient = new KeyVaultClient(
    async (string authority, string resource, string scope) =>
{
    var authContext = new AuthenticationContext(authority);
    var clientCred = new ClientCredential(clientId, clientSecret);
    var result = await authContext.AcquireTokenAsync(resource, clientCred);
    return result.AccessToken;
});

我可以创建一个new client secret来自 Azure 门户。

现在，我在 KeyVault 中找不到此选项。

在Program.cs中我有类似的东西

var keyVaultEndpoint = new Uri(Environment.GetEnvironmentVariable("VaultUri"));
configApp.AddAzureKeyVault(keyVaultEndpoint, new DefaultAzureCredential());

本地工作正常，但当我将应用程序部署到 Azure 时出现此错误:

Application '/LM/W3SVC/1699246683/ROOT' with physical root'C:\home\site\wwwroot' has exited from Program.Main with exit code ='0'. First 30KB characters of captured stdout and stderr logs:

[10:15:57 FTL] Host terminated unexpectedlyAzure.Identity.CredentialUnavailableException: DefaultAzureCredentialfailed to retrieve a token from the included credentials.

EnvironmentCredential authentication unavailable. Environmentvariables are not fully configured.

ManagedIdentityCredentialauthentication unavailable, no managed identity endpoint found.

SharedTokenCacheCredential authentication unavailable. No accountswere found in the cache.

at Azure.Identity.DefaultAzureCredential.GetTokenAsync(Boolean isAsync,TokenRequestContext requestContext, CancellationTokencancellationToken) atAzure.Identity.DefaultAzureCredential.GetTokenAsync(TokenRequestContextrequestContext, CancellationToken cancellationToken) atAzure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.AuthenticateRequestAsync(HttpMessagemessage, Boolean async) atAzure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.ProcessCoreAsync(HttpMessagemessage, ReadOnlyMemory1 pipeline, Boolean async) at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory1 pipeline, Boolean async) atAzure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message,ReadOnlyMemory1 pipeline, Boolean async) at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory1 pipeline) atAzure.Core.Pipeline.HttpPipelineSynchronousPolicy.ProcessAsync(HttpMessagemessage, ReadOnlyMemory1 pipeline) at Azure.Core.Pipeline.HttpPipeline.SendRequestAsync(Request request, CancellationToken cancellationToken) at Azure.Security.KeyVault.KeyVaultPipeline.SendRequestAsync(Request request, CancellationToken cancellationToken) at Azure.Security.KeyVault.KeyVaultPipeline.GetPageAsync[T](Uri firstPageUri, String nextLink, Func1 itemFactory, StringoperationName, CancellationToken cancellationToken) atAzure.Core.PageResponseEnumerator.FuncAsyncPageable1.AsPages(String continuationToken, Nullable1 pageSizeHint)+MoveNext() atAzure.Core.PageResponseEnumerator.FuncAsyncPageable1.AsPages(String continuationToken, Nullable1pageSizeHint)+System.Threading.Tasks.Sources.IValueTaskSource<System.Boolean>.GetResult()at Azure.AsyncPageable1.GetAsyncEnumerator(CancellationToken cancellationToken)+MoveNext() at Azure.AsyncPageable1.GetAsyncEnumerator(CancellationTokencancellationToken)+MoveNext() atAzure.AsyncPageable1.GetAsyncEnumerator(CancellationToken cancellationToken)+System.Threading.Tasks.Sources.IValueTaskSource<System.Boolean>.GetResult() at Azure.Extensions.AspNetCore.Configuration.Secrets.AzureKeyVaultConfigurationProvider.LoadAsync() at Azure.Extensions.AspNetCore.Configuration.Secrets.AzureKeyVaultConfigurationProvider.LoadAsync() at Azure.Extensions.AspNetCore.Configuration.Secrets.AzureKeyVaultConfigurationProvider.Load() at Microsoft.Extensions.Configuration.ConfigurationRoot..ctor(IList1providers) atMicrosoft.Extensions.Configuration.ConfigurationBuilder.Build() atMicrosoft.Extensions.Hosting.HostBuilder.BuildAppConfiguration() atMicrosoft.Extensions.Hosting.HostBuilder.Build() atSkoruba.IdentityServer4.STS.Identity.Program.Main(String[] args) inC:\Projects\IdentityServer4\src\Skoruba.IdentityServer4.STS.Identity\Program.cs:line26

Process Id: 13436. File Version: 13.1.20234.8. Description: IISASP.NET Core Module V2 Request Handler. Commit:c75b3f7a2fb9fe21fd96c93c070fdfa88a2fbe97

Answer 1

您正在使用 DefaultAzureCredential，它将部署时常用的身份验证凭据与开发环境中用于身份验证的凭据结合起来。 DefaultAzureCredential 将尝试按顺序通过以下机制进行身份验证。

它在您本地工作的原因很可能是它能够使用本地盒子(上面的橙色盒子)进行身份验证。

现在，对于已部署的环境，您需要执行以下操作之一:

1. 设置 Managed Service Identity并授予对 Key Vault 的访问权限。例如，在 Azure 应用服务中，从门户中的“身份”边栏选项卡启用该功能，然后在 key 保管库中分配访问策略(身份名称将与应用服务名称相同)。

或者，2. 在 Environment Variables 中设置客户端凭据(例如，如果是 Web 应用程序，则在应用程序设置中)。