使用用户分配的托管ID的 azure 函数 - 无法写入存储队列

Question

我一直在尝试将我的 dotnet core 6.0 函数应用程序从基于连接字符串的函数应用程序更改为使用用户分配的托管标识。我没有设置 key 保管库。

现在，当我在本地运行代码时，一切正常(尽管我通过在 local.settings.json 中定义 Azure* 环境变量来在本地使用 azure cli 凭据

当我将函数发布到 azure 时，我在运行 Web 触发器时收到 http 400 错误。完整的错误消息如下所示:

2022-05-13T18:21:21Z   [Information]   Executing 'CreateWorkspace' (Reason='This function was programmatically called via the host APIs.', Id=asdf-asdf-44a3-asdf-asdfasdf)
2022-05-13T18:21:21Z   [Information]   Received following payload: {
    "name": "May13-Test1", 
    "readonly": true,
    "owners": [        
            {"name": "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="e19184808f9495a19880898e8ecf828e8c" rel="noreferrer noopener nofollow">[email protected]</a>"},
            {"name": "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="80e2f5f4f4e5f2c0f9e1e8efefaee3efed" rel="noreferrer noopener nofollow">[email protected]</a>"}
    ]
}
2022-05-13T18:21:21Z   [Information]   DefaultAzureCredential.GetToken invoked. Scopes: [ https://storage.azure.com/.default ] ParentRequestId: ea21b20f-057b-4f41-a4af-b991133f6e75
2022-05-13T18:21:21Z   [Information]   EnvironmentCredential.GetToken invoked. Scopes: [ https://storage.azure.com/.default ] ParentRequestId: asdf-057b-asdf-a4af-asdfasdf
2022-05-13T18:21:21Z   [Information]   EnvironmentCredential.GetToken was unable to retrieve an access token. Scopes: [ https://storage.azure.com/.default ] ParentRequestId: asdf-057b-4f41-a4af-asdf Exception: Azure.Identity.CredentialUnavailableException (0x80131500): EnvironmentCredential authentication unavailable. Environment variables are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot
2022-05-13T18:21:21Z   [Information]   ManagedIdentityCredential.GetToken invoked. Scopes: [ https://storage.azure.com/.default ] ParentRequestId: asdf-asdf-asdf-asdf-asdfasdfasdf
2022-05-13T18:21:21Z   [Information]   Request [asdf-d47d-asdf-a715-asdf] GET http://localhost:8081/msi/token?api-version=2019-08-01&resource=REDACTED
X-IDENTITY-HEADER:REDACTED
x-ms-client-request-id:5ef27cc5-d47d-42b3-a715-b6ffd5cc9dfd
x-ms-return-client-request-id:true
User-Agent:azsdk-net-Identity/1.6.0,(.NET 6.0.0-rtm.21522.10; Linux 5.4.81-microsoft-standard #1 SMP Thu Dec 3 23:47:24 UTC 2020)
client assembly: Azure.Identity
2022-05-13T18:21:22Z   [Warning]   Error response [5ef27cc5-d47d-42b3-a715-b6ffd5cc9dfd] 400 Bad Request (00.2s)
Date:Fri, 13 May 2022 18:21:19 GMT
Server:Kestrel
Transfer-Encoding:chunked
Content-Type:application/json; charset=utf-8
2022-05-13T18:21:22Z   [Information]   ManagedIdentityCredential.GetToken was unable to retrieve an access token. Scopes: [ https://storage.azure.com/.default ] ParentRequestId: ea21b20f-057b-4f41-a4af-b991133f6e75 Exception: Azure.Identity.AuthenticationFailedException (0x80131500): ManagedIdentityCredential authentication failed: Service request failed.
Status: 400 (Bad Request)

Content:


Headers:
Date: Fri, 13 May 2022 18:21:19 GMT
Server: Kestrel
Transfer-Encoding: chunked
Content-Type: application/json; charset=utf-8

See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/managedidentitycredential/troubleshoot
 ---> Azure.RequestFailedException (0x80131500): Service request failed.
Status: 400 (Bad Request)

Content:


Headers:
Date: Fri, 13 May 2022 18:21:19 GMT
Server: Kestrel
Transfer-Encoding: chunked
Content-Type: application/json; charset=utf-8
2022-05-13T18:21:22Z   [Information]   DefaultAzureCredential.GetToken was unable to retrieve an access token. Scopes: [ https://storage.azure.com/.default ] ParentRequestId: ea21b20f-057b-4f41-a4af-b991133f6e75 Exception: Azure.Identity.AuthenticationFailedException (0x80131500): ManagedIdentityCredential authentication failed: Service request failed.
Status: 400 (Bad Request)

Content:


Headers:
Date: Fri, 13 May 2022 18:21:19 GMT
Server: Kestrel
Transfer-Encoding: chunked
Content-Type: application/json; charset=utf-8

See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/managedidentitycredential/troubleshoot
 ---> Azure.RequestFailedException (0x80131500): Service request failed.
Status: 400 (Bad Request)

Content:


Headers:
Date: Fri, 13 May 2022 18:21:19 GMT
Server: Kestrel
Transfer-Encoding: chunked
Content-Type: application/json; charset=utf-8
2022-05-13T18:21:22Z   [Information]   ManagedIdentityCredential authentication failed: Service request failed.
Status: 400 (Bad Request)

Content:


Headers:
Date: Fri, 13 May 2022 18:21:19 GMT
Server: Kestrel
Transfer-Encoding: chunked
Content-Type: application/json; charset=utf-8

See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/managedidentitycredential/troubleshoot
2022-05-13T18:21:22Z   [Information]   Executed 'CreateWorkspace' (Succeeded, Id=70d3b480-79b5-44a3-a88e-845817c13d12, Duration=761ms)

在应用程序配置中，这就是我所拥有的:

[
  {
    "name": "APPINSIGHTS_INSTRUMENTATIONKEY",
    "value": "234234234-asdf-asdf-asdf-asdfasdfas",
    "slotSetting": false
  },
  {
    "name": "AzureServicesAuthConnectionString",
    "value": "RunAs=App;AppId={managedidentity-clientId}",
    "slotSetting": false
  },
  {
    "name": "FUNCTIONS_EXTENSION_VERSION",
    "value": "~4",
    "slotSetting": false
  },
  {
    "name": "FUNCTIONS_WORKER_RUNTIME",
    "value": "dotnet",
    "slotSetting": false
  },
  {
    "name": "MANAGEDID_CLIENT_ID",
    "value": "{managedidclientid}",
    "slotSetting": false
  },
  {
    "name": "ExtServiceBus__fullyQualifiedNamespace",
    "value": "myservicebus-bus.servicebus.windows.net",
    "slotSetting": false
  },
  {
    "name": "ExtStorageQueue__queueServiceUri",
    "value": "https://mystorageaccount.queue.core.windows.net/",
    "slotSetting": false
  },
  {
    "name": "ExtStorageTableName",
    "value": "provisionedWorkspaces",
    "slotSetting": false
  },
  {
    "name": "WEBSITE_MOUNT_ENABLED",
    "value": "1",
    "slotSetting": false
  },
  {
    "name": "WEBSITE_RUN_FROM_PACKAGE",
    "value": "https://mystorageaccount.blob.core.windows.net/function-releases/asdf-asdf-6b1b-asdf-asdf-asdf.zip?sv=2018-03-28&sr=b&sig=asdf%2Fxch%asdf%3D&st=2022-05-13T17%3A17%3A27Z&se=2032-05-13T17%3A22%3A27Z&sp=r",
    "slotSetting": false
  }
]

代码

这就是 http 触发器的样子

[FunctionName("CreateWorkspace")]
    public async Task<IActionResult> CreateWorkspace(
        [HttpTrigger(AuthorizationLevel.Anonymous, "post", Route = "widget/workspaces")] HttpRequest req,
         [Queue("workspaces"), StorageAccount("ExtStorageQueue")] ICollector<string> messageQueue,
        ILogger log)
    {    
            WorkspaceResponse response = new WorkspaceResponse();
            try{  
                
                var content = await new StreamReader(req.Body).ReadToEndAsync();
                log.LogInformation($"Received following payload: {content}");

                var workspaceRequest = JsonConvert.DeserializeObject<Workspace>(content);                    
                //this doesn't work messageQueue.Add(JsonConvert.SerializeObject(workspaceRequest)); 
                //write to storage table.         
                response = await storage.ProvisioningRequest(workspaceRequest, req.HttpContext.Items["MS_AzureFunctionsRequestID"].ToString(), "enqueued");                                    
            }
        catch(Exception ex) 
        {
            log.LogInformation(ex.Message);
            response.status = "Error: Invalid Request";
            response.requestId=null;
        }
        return new OkObjectResult(JsonConvert.SerializeObject(response));              
    }

托管 ID 已分配给应用程序:

以下 RBAC 角色已分配给托管 ID:

问题

有什么方法可以手动触发尝试使用此用户分配的托管 ID 获取 token 吗？该错误消息似乎表明它在尝试获取各种类型的凭据的 token 时即将死亡。

有没有办法将 DefaultAzureCredentialoptions 添加到 http 触发器？所以我可以做这样的事情:

 var clientId = Environment.GetEnvironmentVariable("MANAGEDID_CLIENT_ID");
 DefaultAzureCredentialOptions options = new DefaultAzureCredentialOptions()
 {
        Diagnostics =
        {
             LoggedHeaderNames = { "x-ms-request-id" },
             LoggedQueryParameters = { "api-version" },
             IsLoggingContentEnabled = true
        },
        ExcludeVisualStudioCodeCredential = true,
        ExcludeAzureCliCredential = true,
        ExcludeManagedIdentityCredential = false,
        ExcludeAzurePowerShellCredential = true,
        ExcludeSharedTokenCacheCredential = true,
        ExcludeInteractiveBrowserCredential = true,
        ExcludeVisualStudioCredential = true,                        
        ManagedIdentityClientId = clientId
        };
        DefaultAzureCredential credential = new DefaultAzureCredential(options);

换句话说，有没有办法强制 http 触发器处理程序只尝试一种类型的凭据？

我还能做些什么来尝试排除故障吗？我已经这样做了几天了，但似乎无法继续下去。

Answer 1

我相信您已将数据平面角色应用于您的身份，但这并不提供您想要的数据访问权限

存储队列数据贡献者和 Azure 资源管理器读取者角色

这已记录在案here