azure - 无法使用 Azure 中的服务主体获取经典 Web 角色

Question

下面的代码在身份验证起作用的地方起作用。但是，当我尝试使用服务原则作为身份验证时，身份验证失败。

工作脚本:

var context = new AuthenticationContext(azureAdUrl + azureADTenant);
var credential = new UserPasswordCredential(azureUsername, azurePassword);
var authParam = new PlatformParameters(PromptBehavior.RefreshSession, null);
var tokenInfo = context.AcquireTokenAsync("https://management.core.windows.net/", azureADClientId, credential);

TokenCloudCredentials tokencreds = new TokenCloudCredentials(subscriptionId, tokenInfo.Result.AccessToken);

ComputeManagementClient computeClient = new ComputeManagementClient(tokencreds);
string deploymentName = computeClient.Deployments.GetBySlot(serviceName, DeploymentSlot.Production).Name;
string label = computeClient.Deployments.GetBySlot(serviceName, DeploymentSlot.Production).Label;

不工作:

AuthenticationFailed: The JWT token does not contain expected audience uri 'https://management.core.windows.net/'.

ClientCredential cc = new ClientCredential(applicationClientID, accessKey);
var context = new AuthenticationContext("https://login.windows.net/" + AzureTenantId);
var tokenInfo = context.AcquireTokenAsync("https://management.azure.com/", cc);

tokenInfo.Wait();

if (tokenInfo == null)
{
    throw new InvalidOperationException("Failed to obtain the JWT token");
}

TokenCloudCredentials tokencreds = new TokenCloudCredentials(subscriptionId, tokenInfo.Result.AccessToken);

ComputeManagementClient computeClient = new ComputeManagementClient(tokencreds);
string deploymentName = computeClient.Deployments.GetBySlot(serviceName, DeploymentSlot.Production).Name;

Answer 1

我认为不可能使用服务主体访问经典的Azure资源。

经典 Azure 资源通过没有任何服务主体概念的服务管理 API 进行管理。仅当为管理员或共同管理员获取 token 时，它才支持 token 。

您需要使用实际用户的用户名/密码才能使用服务管理 API。