c# - 尝试连接时，Azure Vault 中的 GetSecret 抛出 NullReferenceException

Question

我有以下问题:

我正在尝试使用证书凭据连接到 Azure Vault。

当尝试读取 secret 时，我收到带有内部 NullReferenceException 的 AuthenticationFailedException。

为了简洁起见，我仅包含 NullReferenceException 的堆栈跟踪:

This exception was originally thrown at this call stack:
    Azure.Identity.AadIdentityClient.CreateClientAssertionJWT(string, string, System.Security.Cryptography.X509Certificates.X509Certificate2)
    Azure.Identity.AadIdentityClient.CreateClientCertificateAuthRequest(string, string, System.Security.Cryptography.X509Certificates.X509Certificate2, string[])
    Azure.Identity.AadIdentityClient.Authenticate(string, string, System.Security.Cryptography.X509Certificates.X509Certificate2, string[], System.Threading.CancellationToken)
    Azure.Identity.ClientCertificateCredential.GetToken(Azure.Core.TokenRequestContext, System.Threading.CancellationToken)

代码:

            string keyVaultUrl = "https://somevault.vault.azure.net/";
            var clientId = "<Application (client) ID>";
            var tenantId = "<Directory (tenant) ID>";
            X509Certificate2 clientCertificate = new X509Certificate2(@"someCerFile.cer");
            ClientCertificateCredential certificateCreadential = new ClientCertificateCredential(tenantId, clientId, clientCertificate);
            var client = new SecretClient(new Uri(keyVaultUrl), certificateCreadential);
            var secret = client.GetSecret("Password"); //This line throws the exception

保险柜配置是根据此处概述的步骤完成的:

https://learn.microsoft.com/en-us/azure/key-vault/general/authentication

有什么想法吗？

Answer 1

不幸的是，异常并没有多大帮助。但是，我认为这里的问题是您需要为 X509Certificate2 提供私钥，以便 ClientCertificateCredential 可以签署客户端断言。 .cer 文件只是证书的公共(public)部分。您需要提供一个 .pfx 文件，其中还包含证书和私钥。