azure - 什么是 Azure 服务主体？

Question

我的要求很简单。我想通过 shell 脚本以非交互模式登录 Azure，但“az login -u 用户名 -p 密码”命令给出以下错误:

Get Token request returned http error: 400 and server response:
{"error":"invalid_grant","error_description":"AADSTS70002: Error
validating credentials. : SAML token is invalid. : The element 
with ID 'xxxxxx' was either unsigned or the signature was 
invalid.

一些网站告诉我创建一个服务主体。现在我的问题是，什么是服务主体，以及如何创建服务主体，以便我可以从 shell 脚本执行命令(用于创建不同的资源，例如应用程序网关)？

Answer 1

请引用此official document .

An Azure service principal is a security identity used by user-created apps, services, and automation tools to access specific Azure resources. Think of it as a 'user identity' (login and password or certificate) with a specific role, and tightly controlled permissions to access your resources. It only needs to be able to do specific things, unlike a general user identity. It improves security if you only grant it the minimum permissions level needed to perform its management tasks.

如果要使用 Azure CLi 2.0 创建新的服务主体(sp)。您可以使用您的 Azure AD 用户登录。然后执行以下命令。

az ad sp create-for-rbac --name {appId} --password "{strong password}"

结果如下:

{
  "appId": "a487e0c1-82af-47d9-9a0b-af184eb87646d",
  "displayName": "MyDemoWebApp",
  "name": "http://MyDemoWebApp",
  "password": {strong password},
  "tenant": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
}

appId是您的登录用户，password是登录密码。

创建 sp 后，您还需要为其赋予 Contributor 角色，然后您就可以管理您的 Azure 资源。

az role assignment create --assignee <objectID> --role Contributor

现在，您可以使用以下命令以非交互模式登录。

az login --service-principal -u <appid> --password {password-or-path-to-cert} --tenant {tenant}