如何在 Azure Function 中使用 Azure Managed Identity 通过触发器访问 Service Bus? [英] How to use Azure Managed Identity in Azure Function to access Service Bus with a trigger?

问题描述

我在 Azure 中创建了一个 ServiceBus 命名空间，以及一个主题和一个订阅.我还有一个简单的 Azure 版本 1 函数，它在 ServiceBus 中触发接收到的主题，如下所示:

I have created a ServiceBus namespace in Azure, along with a topic and a subscription. I also have a simple Azure version 1 function that triggers on a received topic in the ServiceBus, like this:

[FunctionName("MyServiceBusTriggerFunction")]
public static void Run([ServiceBusTrigger("myTopic", "mySubscription", Connection = "MyConnection")]string mySbMsg, TraceWriter log)
{
    log.Info($"C# ServiceBus topic trigger function processed message: {mySbMsg}");
}

当我使用主题的共享访问策略在函数应用程序设置中定义连接字符串时，该函数很好地触发了 ServiceBus 中的主题，如下所示:

The function triggers nicely for the topics in the ServiceBus when I define the connection string in functions Application Settings by using Shared Access Policy for topic, like this:

Endpoint=sb://MyNamespace.servicebus.windows.net/;SharedAccessKeyName=mypolicy;SharedAccessKey=UZ...E0=

现在，我想使用托管服务标识 (MSI) 而不是共享访问密钥来访问 ServiceBus.据此(https:///docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/services-support-msi)它应该是可能的，除非我误解了什么.不过，我还没有设法让它工作.

Now, instead of Shared Access Keys, I would like to use Managed Service Identity (MSI) for accessing the ServiceBus. According to this (https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/services-support-msi) it should be possible, unless I have misunderstood something. I haven't managed to get it working though.

我尝试过的是

• 在 Azure 门户中为我的函数设置开启"托管服务标识
• 为 Azure 门户的 ServiceBus 访问控制部分中的函数授予所有者角色
• 像这样为 MyFunction 设置连接字符串:Endpoint=sb://MyNamespace.servicebus.windows.net/

此设置中未触发该功能，所以我错过了什么或我做错了什么?我将不胜感激任何可以帮助我进一步发展的建议.谢谢.

The function is not triggering in this set-up, so what am I missing or what am I doing wrong? I'd be grateful for any advice to help me get further. Thanks.

推荐答案

我错过了什么或我做错了什么?

what am I missing or what am I doing wrong?

您可能会混淆 MSI 和共享访问策略.它们使用不同的提供商来访问 Azure 服务总线.您可以只使用连接字符串或只使用 MSI 进行身份验证.

You may mix up with MSI and Shared Access Policy.They are using different provider to access to Azure servicebus. You could just use connectionstring or just use MSI to authenticate.

当您使用Managed Service Identity(MSI)进行身份验证时，您需要使用以下代码为托管服务身份创建令牌提供者.

When you use Managed Service Identity(MSI) to authenticate, you need to create a token provider for the managed service identity with the following code.

TokenProvider.CreateManagedServiceIdentityTokenProvider(ServiceAudience.ServiceBusAudience).

这个 TokenProvider 的实现使用 Microsoft.Azure.Services.AppAuthentication 库中的 AzureServiceTokenProvider.AzureServiceTokenProvider 将遵循一组不同的方法，具体取决于环境，以获取访问令牌.然后初始化客户端来操作服务总线.有关更多详细信息，您可以参考此 文章.

This TokenProvider's implementation uses the AzureServiceTokenProvider found in the Microsoft.Azure.Services.AppAuthentication library. AzureServiceTokenProvider will follow a set number of different methods, depending on the environment, to get an access token. And then initialize client to operate the servicebus. For more details, you could refer to this article.

当你使用servicebus connectionstring访问时，使用共享访问令牌(SAS)令牌提供者，所以你可以直接操作.

When you use servicebus connectionstring to access which using the Shared Access Token (SAS) token provider, so you can operate directly.

这篇关于如何在 Azure Function 中使用 Azure Managed Identity 通过触发器访问 Service Bus?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！