azure - 无法获取 Azure Key Value secret 值

Question

我正在尝试从我创建的 Azure key 保管库获取 secret (dbUser 密码)。当我运行下面的代码时，它会抛出异常，无法获取有效的 token 。

        public static string GetDBConnectString(ILogger logger)
        {
            try
            {
                string dbUserName = Environment.GetEnvironmentVariable("SqlDBUsername"); // [dbUserName]
                logger.LogInformation($"Info: Creating DB Connection string as user {dbUserName}.");
                AzureServiceTokenProvider azureServiceTokenProvider = new AzureServiceTokenProvider();
                KeyVaultClient keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
                string vaultConnect = Environment.GetEnvironmentVariable("SqlDBKeyvault"); // ["https://keyvault.vault.azure.net/secrets/dbUserName/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"]
                // The below line fails
                SecretBundle secret = keyVaultClient.GetSecretAsync(vaultConnect).GetAwaiter().GetResult();
                string sqlConnection = string.Format(Environment.GetEnvironmentVariable("SqlDBConnectionString"), dbUserName, secret.Value);
                return sqlConnection;
            }
            catch (Exception ex)
            {
                logger.LogError(ex.Message, ex);
                return string.Empty;
            }
        }

Exception.Message = "Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. Exception Message: Tried the following 3 methods to get an access token, but none of them worked. Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. Exception Message: Tried to get token using Managed Service Identity. Unable to connect to the Managed Service Identity (MSI) endpoint. Please check that you are running on an Azure resource that has MSI setup. Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Exception for Visual Studio token provider Microsoft.Asal.TokenService.exe : TS003: Error, TS002: The account '[email protected]' was not found in the tenant 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'. "

我在这里看到了各种解决方案，其中创建了 ClientId 授权，但所有这些解决方案都需要用户名/密码来创建，这违背了保管库的目的？

有没有人有不需要用户凭据即可打开保管库的解决方案？

Answer 1

有两种类型的身份:系统分配的身份和用户分配的身份。您需要的是系统分配的身份，您的 Azure 函数将用于从 key 保管库检索 secret 。

您应该添加一个设置来从 key 保管库中检索该 secret 值，而不是读取函数内的 secret 值。

示例:

Key           Value
MySecret      @Microsoft.KeyVault(SecretUri=secret_uri_with_version)

然后在您的代码中，您将使用:

 Environment.GetVariable("MySecret);

更多信息:

https://azure.microsoft.com/en-us/blog/simplifying-security-for-serverless-and-web-apps-with-azure-functions-and-app-service/

https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=dotnet