Azure MSI : Login failed for user ''

Question

我正在尝试使用 MSI token 从应用服务连接到数据库，并且收到

Login failed for user ''.

当我使用 ARM 部署应用服务时，我生成了一个输出，确保它创建了一个服务主体:

 {
  "principalId":"98f2c1f2-0a86-4ff1-92db-d43ec0edxxxx","
  tenantId":"e6d2d4cc-b762-486e-8894-4f5f440dxxxx",
  "type":"SystemAssigned"
 }

我还检查了 Kudu 的环境变量并具有:

MSI_ENDPOINT = http://127.0.0.1:41239/MSI/token/
MSI_SECRET = 7C1B16Fxxxxxxxxxxxxx

我在 Azure 门户中提供了一个连接字符串，如下所示:

Data Source=nzmoebase0001bt.database.windows.net;Initial Catalog=nzmoebase0001bt;Connect Timeout=300;MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;

As an offside, ain't that cool that MSI (theoretically) allows one to cut/paste from source code to a public forum without fear of leaving a secret?! Just sayin'.... Now...if only I could get it to work!!!

我已将主体作为所有者添加到数据库中...

但我仍然得到:

Login failed for user ''.

我还应该尝试什么？

谢谢。

@juunas:正在使用以下方式添加 token :

    static async Task AttachAccessTokenToDbConnection(IDbConnection dbConnection)
    {
        SqlConnection sqlConnection = dbConnection as SqlConnection;
        if (sqlConnection == null)
        {
            return;
        }
        string msiEndpoint = Environment.GetEnvironmentVariable("MSI_ENDPOINT");
        if (string.IsNullOrEmpty(msiEndpoint))
        {
            return;
        }

        var msiSecret = Environment.GetEnvironmentVariable("MSI_SECRET");
        if (string.IsNullOrEmpty(msiSecret))
        {
            return;
        }

        // To get around:
        // "Cannot set the AccessToken property if 'UserID', 'UID', 'Password', or 'PWD' has been specified in connection string."
        var terms = new[] {"UserID","Password","PWD=","UID=" };
        string connectionString = dbConnection.ConnectionString;

        foreach (var term in terms)
        {
            if (connectionString.Contains(term, StringComparison.InvariantCultureIgnoreCase))
            {
                return;
            }
        }

        string accessToken = await AppCoreDbContextMSITokenFactory.GetAzureSqlResourceTokenAsync();
        sqlConnection.AccessToken = accessToken;
    }

更新:从 Entity Framework 获得一些进展(不完全确定发生了什么变化)

This operation requires a connection to the 'master' database. Unable to create a connection to the 'master' database because the original database connection has been opened and credentials have been removed from the connection string. Supply an unopened connection.

我根据网上的一些建议添加了Persist Security Info = True，但没有太大变化。

Data Source=nzmoebase0001bt.database.windows.net;Initial Catalog=nzmoebase0001bt;MultipleActiveResultSets=False;Persist Security Info = True;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;

根据@evilSnobu，我终于开始跟踪并捕获了 token :

 .eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI....

使用 jwt.io 解码得到:

{
  "typ": "JWT",
  "alg": "RS256",
  "x5t": "FSimuFrFNoC0sJXGmv13nNZceDc",
  "kid": "FSimuFrFNoC0sJXGmv13nNZceDc"
}.{
  "aud": "https://database.windows.net/",
  "iss": "https://sts.windows.net/e6d2d4cc-b762-486e-8894-4f5f440dxxxx/",
  "iat": 1522783025,
  "nbf": 1522783025,
  "exp": 1522786925,
  "aio": "Y2NgYPjNdyJd9zrzpLavJSEzNIuPAAA=",
  "appid": "d1057cea-461b-4946-89a9-d76439c2xxxx",
  "appidacr": "2",
  "e_exp": 262800,
  "idp": "https://sts.windows.net/e6d2d4cc-b762-486e-8894-4f5f440dxxxx/",
  "oid": "98f2c1f2-0a86-4ff1-92db-d43ec0edxxxx",
  "sub": "98f2c1f2-0a86-4ff1-92db-d43ec0edxxxx",
  "tid": "e6d2d4cc-b762-486e-8894-4f5f440dxxxx",
  "uti": "59bqKWiSL0Gf0bTCI0AAAA",
  "ver": "1.0"
}.[Signature]

对于我未经训练的眼睛来说，这看起来很棒(？)。但我仍然得到:

System.Data.SqlClient.SqlException: Login failed for user ''.

这似乎来自与 EntityFramework 的启动架构检查过程更深层的消息联系:

[InvalidOperationException: This operation requires a connection to the 'master' database. Unable to create a connection to the 'master' database because the original database connection has been opened and credentials have been removed from the connection string. Supply an unopened connection.]

非常感谢任何和所有建议。谢谢!

Answer 1

我现在正在追寻“此操作需要连接到'master'数据库”错误，按照本文档: https://learn.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-connect-msi

我认为分配 token 后包含以下行很关键:

Database.SetInitializer<MyDatabaseContext>(null);

就我而言，我们有一些显式运行 Entity Framework 迁移的代码导致了错误。当我们禁用它时，应用程序开始按预期工作。