Azure Managed Identity 本地调试身份验证失败

Question

我有一个非常基本的例子，但我似乎无法开始工作。我正在使用的用户是订阅所有者，因此应该可以访问所有内容。如果我运行在它尝试实际获取 blob 文本时执行以下操作：

StorageException: Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.

using Microsoft.Azure.Services.AppAuthentication;
using Microsoft.WindowsAzure.Storage.Auth;
using Microsoft.WindowsAzure.Storage.Blob;
using System;
using System.Threading;
using System.Threading.Tasks;

namespace testmsistorageaccess
{
    class Program
    {
        public static void Main()
        {
            AzureServiceTokenProvider azureServiceTokenProvider = new AzureServiceTokenProvider();
            var tokenAndFrequency = TokenRenewerAsync(azureServiceTokenProvider,
                                                        CancellationToken.None).GetAwaiter().GetResult();

            TokenCredential tokenCredential = new TokenCredential(tokenAndFrequency.Token,
                                                                    TokenRenewerAsync,
                                                                    azureServiceTokenProvider,
                                                                    tokenAndFrequency.Frequency.Value);

            StorageCredentials storageCredentials = new StorageCredentials(tokenCredential);

            var storageUri = new Uri("https://mystorageaccount.blob.core.windows.net");
            var client = new CloudBlobClient(storageUri, storageCredentials);
            var container = client.GetContainerReference("bob");
            string content = container.GetBlockBlobReference("bob.xml").DownloadTextAsync().Result;
            Console.WriteLine($"Got {content}");
        }

        private static async Task<NewTokenAndFrequency> TokenRenewerAsync(Object state, CancellationToken cancellationToken)
        {
            const string StorageResource = "https://storage.azure.com/";
            var authResult = await ((AzureServiceTokenProvider)state).GetAuthenticationResultAsync(StorageResource);
            var next = (authResult.ExpiresOn - DateTimeOffset.UtcNow) - TimeSpan.FromMinutes(5);
            if (next.Ticks < 0)
            {
                next = default(TimeSpan);
            }
            return new NewTokenAndFrequency(authResult.AccessToken, next);
        }
    }
}

不确定我在这里做错了什么，我已经检查过它正在尝试使用的用户并且看起来正确并且具有正确的 AD 租户 ID：

我看到有人提到使用 UTCNow 检查我本地机器上的时间，并确认它与 GMT 时间是正确的，除此之外我没有发现任何其他关于如何调试它的信息。

感谢任何帮助

Answer 1

订阅所有者 != 数据访问。您需要向用户添加存储 blob 贡献者或存储 blob reader 角色。

Azure Managed Identity 本地调试身份验证失败

Azure Managed Identity local debug authentication failure

c#

azure

azure-storage

azure-managed-identity