使用 @azure/identity 访问 Key Vault 并收到错误 'Request is missing a Bearer or PoP token Error 401'

Question

我正在尝试从 Azure 的密钥库中检索一些机密，但我似乎无法使用 @azure/identity 模块进行身份验证。

版本：

"@azure/identity": "^1.0.0-preview.6",
"@azure/keyvault-secrets": "^4.0.0-preview.9",

我有一个 azure functions 应用程序，我已经在生产环境和本地使用 local.settings.json 配置了应用程序，并为

填写了正确的值

{
    "IsEncrypted": false,
    "Values": {
        "AZURE_CLIENT_ID": "REDACTED",
        "AZURE_CLIENT_SECRET": "REDACTED",
        "AZIRE_TENANT_ID": "REDACTED"
    },
    "ConnectionStrings": {}
}

通过 Azure Active Directory 注册的应用程序 => 应用程序注册。
禁用登录
已创建 App Secret

然后，我将应用程序添加到密钥库中，角色为 'reader'，使其能够 'get' 秘密，但没有别的，甚至没有列表：

现在，当我试图取回秘密时：

import { KeyVaultSecret, SecretClient } from '@azure/keyvault-secrets';
import { EnvironmentCredential } from '@azure/identity';

export const GetSecret = async (key: string): Promise<string> => {
    try {
        const credential: EnvironmentCredential = new EnvironmentCredential();

        console.log('CREDENTIAL: ', credential);
        console.log('CLIENT SECRET', process.env.AZURE_CLIENT_SECRET);
        console.log('CLIENT ID', process.env.AZURE_CLIENT_ID);

        const url = 'https://tlabs-vault.vault.azure.net';
        const client = new SecretClient(url, credential);
        let secret: KeyVaultSecret = await client.getSecret(key);
        return secret.value;
    } catch (err) {
        console.error('Error getting secret from Azure Vault', err);
    }
};

但这不起作用，在控制台上我看到凭据的结果为：

EnvironmentCredential { _credential: undefined }

以及抛出错误的完整请求：

request:
[10/28/2019 1:14:16 PM]    WebResource {
[10/28/2019 1:14:16 PM]      streamResponseBody: false,
[10/28/2019 1:14:16 PM]      url:
[10/28/2019 1:14:16 PM]       'https://REDACTED_VAULT_NAME.vault.azure.net/secrets/REDACTED_SECRET_NAME/?api-version=7.0',
[10/28/2019 1:14:16 PM]      method: 'GET',
[10/28/2019 1:14:16 PM]      headers: HttpHeaders { _headersMap: [Object] },
[10/28/2019 1:14:16 PM]      body: undefined,
[10/28/2019 1:14:16 PM]      query: undefined,
[10/28/2019 1:14:16 PM]      formData: undefined,
[10/28/2019 1:14:16 PM]      withCredentials: false,
[10/28/2019 1:14:16 PM]      abortSignal: undefined,
[10/28/2019 1:14:16 PM]      timeout: 0,
[10/28/2019 1:14:16 PM]      onUploadProgress: undefined,
[10/28/2019 1:14:16 PM]      onDownloadProgress: undefined,
[10/28/2019 1:14:16 PM]      proxySettings: undefined,
[10/28/2019 1:14:16 PM]      keepAlive: true,
[10/28/2019 1:14:16 PM]      operationSpec:
[10/28/2019 1:14:16 PM]       { httpMethod: 'GET',
[10/28/2019 1:14:16 PM]         path: 'secrets/{secret-name}/{secret-version}',
[10/28/2019 1:14:16 PM]         urlParameters: [Array],
[10/28/2019 1:14:16 PM]         queryParameters: [Array],
[10/28/2019 1:14:16 PM]         responses: [Object],
[10/28/2019 1:14:16 PM]         serializer: [Serializer] } },
[10/28/2019 1:14:16 PM]   response:
[10/28/2019 1:14:16 PM]    { body:
[10/28/2019 1:14:16 PM]       '{"error":{"code":"Unauthorized","message":"Request is missing a Bearer or PoP token."}}',
[10/28/2019 1:14:16 PM]      headers: HttpHeaders { _headersMap: [Object] },
[10/28/2019 1:14:16 PM]      status: 401,
[10/28/2019 1:14:16 PM]      parsedBody: { error: [Object] } },
[10/28/2019 1:14:16 PM]   details:
[10/28/2019 1:14:16 PM]    { error:
[10/28/2019 1:14:16 PM]       { code: 'Unauthorized',
[10/28/2019 1:14:16 PM]         message: 'Request is missing a Bearer or PoP token.' } } }

Answer 1

请关注此博客以了解如何 Integrate Key Vault Secrets With Azure Functions。

主要步骤是Enable system-asigned managed identity for the Function App和Add Key Vault access policy for the Function App。

在这些之后不要忘记使用 @Microsoft.KeyVault(SecretUri={copied identifier for the username secret}) 在 Function App 配置中添加 Key Vault 机密引用。如果设置正确，配置完成后会显示下图

下面是我的测试结果，我用os.environ[name]来获取秘钥

使用 @azure/identity 访问 Key Vault 并收到错误 'Request is missing a Bearer or PoP token Error 401'

Accessing Key Vault with @azure/identity and get error 'Request is missing a Bearer or PoP token Error 401'

azure

azure-active-directory

azure-functions

azure-keyvault

azure-sdk