使用托管服务身份对Azure功能进行授权以从Azure存储容器中获取Blob [英] Authorization for Azure Function using Managed Service Identity to fetch blob from Azure Storage container

问题描述

当我尝试使用系统分配的托管身份在Azure Function应用程序中调用Azure Function从Azure Storage容器中获取Blob时，遇到:

When I attempt to invoke an Azure Function in an Azure Function App using a system assigned managed identity to fetch a blob from an Azure Storage container, I’m encountering:

System.Private.CoreLib: Exception while executing function:<FunctionName>. Microsoft.WindowsAzure.Storage: Unauthorized.

我正在调整这里.

这是代码:

[FunctionName("TestFetchTileViaSvcPrinId")]
public static async Task<HttpResponseMessage> RunAsync(
    [HttpTrigger(AuthorizationLevel.Anonymous, "get", "post", Route = null)] HttpRequest req,
    ILogger log) {
    log.LogInformation("C# HTTP trigger function processed a request.");

    const string blobName = "https://<storageaccount>.blob.core.windows.net/...path.../<file>.jpg";

    // Get the initial access token and the interval at which to refresh it.
    var azureServiceTokenProvider = new AzureServiceTokenProvider();
    NewTokenAndFrequency tokenAndFrequency = TokenRenewerAsync(azureServiceTokenProvider, CancellationToken.None).GetAwaiter().GetResult();

    // Create storage credentials using the initial token, and connect the callback function to renew the token just before it expires
    var tokenCredential = new TokenCredential(tokenAndFrequency.Token, TokenRenewerAsync, azureServiceTokenProvider, tokenAndFrequency.Frequency.Value);

    var storageCredentials = new StorageCredentials(tokenCredential);

    var cloudBlockBlob = new CloudBlockBlob(new Uri(blobName), storageCredentials);

    using (var memoryStream = new MemoryStream()) {
        await cloudBlockBlob.DownloadToStreamAsync(memoryStream);  // Unauthorized exception is thrown here
        var httpResponseMessage = new HttpResponseMessage(HttpStatusCode.OK) {
            Content = new ByteArrayContent(memoryStream.ToArray())
        };
        httpResponseMessage.Headers.Add("Cache-Control", "max-age=31536000"); //31536000 seconds ~ 1 year
        httpResponseMessage.Content.Headers.ContentType = new MediaTypeHeaderValue("image/jpeg");
        return httpResponseMessage;
    }

}

Azure功能应用程序具有系统分配的托管身份，该身份对于目标Blob的整个存储帐户具有存储Blob数据贡献者角色.

The Azure Function App has a system assigned managed identity which has Storage Blob Data Contributor role for the target blob’s entire storage account.

推荐答案

我已经开始工作了.正如Rohit所注意到的那样，删除的Blob完整路径(如最初发布的那样)错误地指定了Azure函数路径而不是存储帐户路径.我随后解决了这个问题.不过，在实施过程中我确实有错别字.更正路径可以解决问题.

I got this working. As Rohit noticed, the redacted full-path to the blob (as originally posted) incorrectly specified the Azure function path rather than the storage account path. I've subsequently fixed up the question. Nevertheless, I did have a typo in the path as implemented. Correcting the path resolved the issue.

这篇关于使用托管服务身份对Azure功能进行授权以从Azure存储容器中获取Blob的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！