更改密码后 Azure ChainedTokenCredential 失败
Azure ChainedTokenCredential Fails after Password Change
Azure ChainedTokenCredential 更改密码后本地开发失败。我已经使用 ChainedTokenCredential 几周来在 Azure 中使用 ManagedIdentityCredential 进行身份验证，并使用 DefaultAzureCredential 对我的 Function App 进行本地测试。一切都按预期进行。这是一个代码示例，它在 Azure 中有效但在本地仍然有效。
def get_client():
MSI_credential = ManagedIdentityCredential()
default_credential = DefaultAzureCredential()
credential_chain = ChainedTokenCredential(MSI_credential, default_credential)
storageurl = os.environ["STORAGE_ACCOUNT"]
client = BlobServiceClient(storageurl, credential=credential_chain)
return client
上周我不得不更改密码，从那以后我收到以下错误。
[2021-04-19T15:18:06.931Z] SharedTokenCacheCredential.get_token failed: Azure Active Directory error '(invalid_grant) AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '2021-02-08T20:05:01.4240000Z' and the TokensValidFrom date (before which tokens are not valid) for this user is '2021-04-15T15:49:33.0000000Z'.
[2021-04-19T15:18:06.963Z] Trace ID: xxx
[2021-04-19T15:18:06.972Z] Correlation ID: xxx
[2021-04-19T15:18:06.974Z] Timestamp: 2021-04-19 15:17:46Z'
[2021-04-19T15:18:06.977Z] DefaultAzureCredential.get_token failed: SharedTokenCacheCredential raised unexpected error "Azure Active Directory error '(invalid_grant) AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '2021-02-08T20:05:01.4240000Z' and the TokensValidFrom date (before which tokens are not valid) for this user is '2021-04-15T15:49:33.0000000Z'.
[2021-04-19T15:18:07.014Z] Trace ID: xxx
[2021-04-19T15:18:07.040Z] Correlation ID:
[2021-04-19T15:18:07.046Z] Timestamp: 2021-04-19 15:17:46Z'"
[2021-04-19T15:18:07.061Z] DefaultAzureCredential failed to retrieve a token from the included credentials.
Attempted credentials:
EnvironmentCredential: EnvironmentCredential authentication unavailable. Environment variables are not fully configured.
ManagedIdentityCredential: ManagedIdentityCredential authentication unavailable, no managed identity endpoint found.
SharedTokenCacheCredential: Azure Active Directory error '(invalid_grant) AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '2021-02-08T20:05:01.4240000Z' and the TokensValidFrom date (before which tokens are not valid) for this user is '2021-04-15T15:49:33.0000000Z'.
[2021-04-19T15:18:07.094Z] Trace ID: xxx
[2021-04-19T15:18:07.097Z] Correlation xxx
[2021-04-19T15:18:07.108Z] Timestamp: 2021-04-19 15:17:46Z'
[2021-04-19T15:18:07.111Z] ChainedTokenCredential.get_token failed: DefaultAzureCredential raised unexpected error "DefaultAzureCredential failed to retrieve a token from the included credentials.
Attempted credentials:
EnvironmentCredential: EnvironmentCredential authentication unavailable. Environment variables are not fully configured.
ManagedIdentityCredential: ManagedIdentityCredential authentication unavailable, no managed identity endpoint found.
SharedTokenCacheCredential: Azure Active Directory error '(invalid_grant) AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '2021-02-08T20:05:01.4240000Z' and the TokensValidFrom date (before which tokens are not valid) for this user is '2021-04-15T15:49:33.0000000Z'.
[2021-04-19T15:18:07.147Z] Trace ID: xxx
[2021-04-19T15:18:07.181Z] Correlation ID: xxx
[2021-04-19T15:18:07.195Z] Timestamp: 2021-04-19 15:17:46Z'"
[2021-04-19T15:18:07.201Z] ChainedTokenCredential failed to retrieve a token from the included credentials.
Attempted credentials:
ManagedIdentityCredential: ManagedIdentityCredential authentication unavailable, no managed identity endpoint found.
DefaultAzureCredential: DefaultAzureCredential failed to retrieve a token from the included credentials.
Attempted credentials:
EnvironmentCredential: EnvironmentCredential authentication unavailable. Environment variables are not fully configured.
ManagedIdentityCredential: ManagedIdentityCredential authentication unavailable, no managed identity endpoint found.
SharedTokenCacheCredential: Azure Active Directory error '(invalid_grant) AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '2021-02-08T20:05:01.4240000Z' and the TokensValidFrom date (before which tokens are not valid) for this user is '2021-04-15T15:49:33.0000000Z'.
[2021-04-19T15:18:07.241Z] Trace ID: xxx
[2021-04-19T15:18:07.264Z] Correlation ID: xxx
[2021-04-19T15:18:07.303Z] Timestamp: 2021-04-19 15:17:46Z'
我尝试解决的问题：
- 登录和注销 VSCode Azure 扩展
- 登录和注销
az cli
az account clear- 正在清除浏览器缓存。
- 正在重新启动 PC 和 VSCode。
- 正在清除 VSCode 缓存
C:\Users\<user>\AppData\Roaming\Code\CacheC:\Users\<user>\AppData\Roaming\Code\CacheData
我正在使用 Azure Extension 'Attach to Python Functions' 来 运行 调试器。我不确定 DefaultAzureCredential 是如何获得我的凭据的。我相信它存储在本地，因为当 运行 在未登录 Azure 扩展的情况下调试调试器时，我遇到了同样的错误。我以为 DefaultAzureCredential 会使用我的 Azure 扩展登录作为我进行身份验证，但我不确定。
如有任何帮助，我们将不胜感激！
在 az account clear 之后，您需要 az login 使用您最新的密码，您可以登录 Azure 门户。
DefaultAzureCredential is based on Azure Identity 客户端库。您可以使用
跳过共享缓存
default_credential = DefaultAzureCredential(exclude_shared_token_cache_credential=True)
并尝试通过 Azure CLI 进行身份验证。
问题已通过使用@Charles Lowell 的解决方案得到解决。由于使用 fzf.exe（模糊查找工具），我在查找文件时遇到了问题，默认情况下它不在隐藏文件夹中查找。删除 C:\Users\<user>\AppData\Local\.IdentityService\msal.cache 有效。
我发现的替代方法是使用 VisualStudioCodeCredential() 而不是 DefaultAzureCredential()。这使用 vscode 扩展名进行身份验证。我更喜欢这种方法，但并非所有开发人员都使用 VSCode。我很高兴 DefaultAzureCredential 开始工作。
def get_client():
MSI_credential = ManagedIdentityCredential()
vscode_credential = VisualStudioCodeCredential()
credential_chain = ChainedTokenCredential(MSI_credential, vscode_credential)
有关 DefaultAzureCredential() 的更多信息，请参见 here。
感谢大家！
Azure ChainedTokenCredential 更改密码后本地开发失败。我已经使用 ChainedTokenCredential 几周来在 Azure 中使用 ManagedIdentityCredential 进行身份验证，并使用 DefaultAzureCredential 对我的 Function App 进行本地测试。一切都按预期进行。这是一个代码示例，它在 Azure 中有效但在本地仍然有效。
def get_client():
MSI_credential = ManagedIdentityCredential()
default_credential = DefaultAzureCredential()
credential_chain = ChainedTokenCredential(MSI_credential, default_credential)
storageurl = os.environ["STORAGE_ACCOUNT"]
client = BlobServiceClient(storageurl, credential=credential_chain)
return client
上周我不得不更改密码，从那以后我收到以下错误。
[2021-04-19T15:18:06.931Z] SharedTokenCacheCredential.get_token failed: Azure Active Directory error '(invalid_grant) AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '2021-02-08T20:05:01.4240000Z' and the TokensValidFrom date (before which tokens are not valid) for this user is '2021-04-15T15:49:33.0000000Z'.
[2021-04-19T15:18:06.963Z] Trace ID: xxx
[2021-04-19T15:18:06.972Z] Correlation ID: xxx
[2021-04-19T15:18:06.974Z] Timestamp: 2021-04-19 15:17:46Z'
[2021-04-19T15:18:06.977Z] DefaultAzureCredential.get_token failed: SharedTokenCacheCredential raised unexpected error "Azure Active Directory error '(invalid_grant) AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '2021-02-08T20:05:01.4240000Z' and the TokensValidFrom date (before which tokens are not valid) for this user is '2021-04-15T15:49:33.0000000Z'.
[2021-04-19T15:18:07.014Z] Trace ID: xxx
[2021-04-19T15:18:07.040Z] Correlation ID:
[2021-04-19T15:18:07.046Z] Timestamp: 2021-04-19 15:17:46Z'"
[2021-04-19T15:18:07.061Z] DefaultAzureCredential failed to retrieve a token from the included credentials.
Attempted credentials:
EnvironmentCredential: EnvironmentCredential authentication unavailable. Environment variables are not fully configured.
ManagedIdentityCredential: ManagedIdentityCredential authentication unavailable, no managed identity endpoint found.
SharedTokenCacheCredential: Azure Active Directory error '(invalid_grant) AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '2021-02-08T20:05:01.4240000Z' and the TokensValidFrom date (before which tokens are not valid) for this user is '2021-04-15T15:49:33.0000000Z'.
[2021-04-19T15:18:07.094Z] Trace ID: xxx
[2021-04-19T15:18:07.097Z] Correlation xxx
[2021-04-19T15:18:07.108Z] Timestamp: 2021-04-19 15:17:46Z'
[2021-04-19T15:18:07.111Z] ChainedTokenCredential.get_token failed: DefaultAzureCredential raised unexpected error "DefaultAzureCredential failed to retrieve a token from the included credentials.
Attempted credentials:
EnvironmentCredential: EnvironmentCredential authentication unavailable. Environment variables are not fully configured.
ManagedIdentityCredential: ManagedIdentityCredential authentication unavailable, no managed identity endpoint found.
SharedTokenCacheCredential: Azure Active Directory error '(invalid_grant) AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '2021-02-08T20:05:01.4240000Z' and the TokensValidFrom date (before which tokens are not valid) for this user is '2021-04-15T15:49:33.0000000Z'.
[2021-04-19T15:18:07.147Z] Trace ID: xxx
[2021-04-19T15:18:07.181Z] Correlation ID: xxx
[2021-04-19T15:18:07.195Z] Timestamp: 2021-04-19 15:17:46Z'"
[2021-04-19T15:18:07.201Z] ChainedTokenCredential failed to retrieve a token from the included credentials.
Attempted credentials:
ManagedIdentityCredential: ManagedIdentityCredential authentication unavailable, no managed identity endpoint found.
DefaultAzureCredential: DefaultAzureCredential failed to retrieve a token from the included credentials.
Attempted credentials:
EnvironmentCredential: EnvironmentCredential authentication unavailable. Environment variables are not fully configured.
ManagedIdentityCredential: ManagedIdentityCredential authentication unavailable, no managed identity endpoint found.
SharedTokenCacheCredential: Azure Active Directory error '(invalid_grant) AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '2021-02-08T20:05:01.4240000Z' and the TokensValidFrom date (before which tokens are not valid) for this user is '2021-04-15T15:49:33.0000000Z'.
[2021-04-19T15:18:07.241Z] Trace ID: xxx
[2021-04-19T15:18:07.264Z] Correlation ID: xxx
[2021-04-19T15:18:07.303Z] Timestamp: 2021-04-19 15:17:46Z'
我尝试解决的问题：
- 登录和注销 VSCode Azure 扩展
- 登录和注销
az cli az account clear- 正在清除浏览器缓存。
- 正在重新启动 PC 和 VSCode。
- 正在清除 VSCode 缓存
C:\Users\<user>\AppData\Roaming\Code\CacheC:\Users\<user>\AppData\Roaming\Code\CacheData
我正在使用 Azure Extension 'Attach to Python Functions' 来 运行 调试器。我不确定 DefaultAzureCredential 是如何获得我的凭据的。我相信它存储在本地，因为当 运行 在未登录 Azure 扩展的情况下调试调试器时，我遇到了同样的错误。我以为 DefaultAzureCredential 会使用我的 Azure 扩展登录作为我进行身份验证，但我不确定。
如有任何帮助，我们将不胜感激！
在 az account clear 之后，您需要 az login 使用您最新的密码，您可以登录 Azure 门户。
DefaultAzureCredential is based on Azure Identity 客户端库。您可以使用
跳过共享缓存default_credential = DefaultAzureCredential(exclude_shared_token_cache_credential=True)
并尝试通过 Azure CLI 进行身份验证。
问题已通过使用@Charles Lowell 的解决方案得到解决。由于使用 fzf.exe（模糊查找工具），我在查找文件时遇到了问题，默认情况下它不在隐藏文件夹中查找。删除 C:\Users\<user>\AppData\Local\.IdentityService\msal.cache 有效。
我发现的替代方法是使用 VisualStudioCodeCredential() 而不是 DefaultAzureCredential()。这使用 vscode 扩展名进行身份验证。我更喜欢这种方法，但并非所有开发人员都使用 VSCode。我很高兴 DefaultAzureCredential 开始工作。
def get_client():
MSI_credential = ManagedIdentityCredential()
vscode_credential = VisualStudioCodeCredential()
credential_chain = ChainedTokenCredential(MSI_credential, vscode_credential)
有关 DefaultAzureCredential() 的更多信息，请参见 here。
感谢大家！