“HTTP错误502.5-进程失败”使用ASP.NET Core 2.1 WebAPI访问Azure PaaS中的Azure密钥库

Question

尝试使用托管服务标识访问Azure密钥库时，收到错误“HTTP错误502.5-进程失败”/“操作返回无效状态代码‘禁止’”。它在Visual Studio中调试时可以工作，但当发布到Azure web应用程序时，它返回502.5错误。

az keyvault secret set --vault-name 'mytestkeyvault' --name 'Secret1' --value 'Hello'
az keyvault secret set --vault-name 'mytestkeyvault' --name 'Secret2' --value 'Goodbye'

在Azure中创建一个web应用程序。启用托管服务标识。

添加NuGet包：

• aspnetcore.keyvault
• Microsoft.Azure.Services.AppAuthentication

{
  "Logging": {
    "LogLevel": {
      "Default": "Warning"
    }
  },
  "AllowedHosts": "*",
  "AppSettings": {
    "KeyVaultURL": "https://mytestkeyvault.vault.azure.net/"
  }
}

using Microsoft.AspNetCore;
using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.Logging;

namespace MyKeyVaultTest.Service
{
    public class Program
    {
        public static void Main(string[] args)
        {
            CreateWebHostBuilder(args).Build().Run();
        }

        public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
            WebHost.CreateDefaultBuilder(args)
                .ConfigureAppConfiguration((context, config) =>
                {
                    IConfigurationRoot builtConfig = config.Build();
                    ConfigurationBuilder keyVaultConfigBuilder = new ConfigurationBuilder();
                    keyVaultConfigBuilder.AddAzureKeyVault(builtConfig["AppSettings:KeyVaultURL"]);
                    IConfigurationRoot keyVaultConfig = keyVaultConfigBuilder.Build();
                    config.AddConfiguration(keyVaultConfig);
                })
                .UseStartup<Startup>();
    }
}

using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Configuration;
using System.Collections.Generic;

namespace MyKeyVaultTest.Service.Controllers
{
    [Route("api/[controller]")]
    [ApiController]
    public class ValuesController : ControllerBase
    {
        private readonly IConfiguration _configuration;

        public ValuesController(IConfiguration configuration)
        {
            _configuration = configuration;
        }

        // GET api/values
        [HttpGet]
        public ActionResult<IEnumerable<string>> Get()
        {
            string secret1 = _configuration["Secret1"];
            string secret2 = _configuration["Secret2"];

            return new string[] { secret1, secret2 };
        }        
    }
}

["Hello","Goodbye"]

HTTP错误502.5-进程失败

错误的完整堆栈：

Description: The process was terminated due to an unhandled exception.
Exception Info: Microsoft.Azure.KeyVault.Models.KeyVaultErrorException: Operation returned an invalid status code 'Forbidden'
   at Microsoft.Azure.KeyVault.KeyVaultClient.GetSecretsWithHttpMessagesAsync(String vaultBaseUrl, Nullable`1 maxresults, Dictionary`2 customHeaders, CancellationToken cancellationToken)
   at Microsoft.Azure.KeyVault.KeyVaultClientExtensions.GetSecretsAsync(IKeyVaultClient operations, String vaultBaseUrl, Nullable`1 maxresults, CancellationToken cancellationToken)
   at Microsoft.Extensions.Configuration.AzureKeyVault.AzureKeyVaultConfigurationProvider.LoadAsync()
   at Microsoft.Extensions.Configuration.AzureKeyVault.AzureKeyVaultConfigurationProvider.Load()
   at Microsoft.Extensions.Configuration.ConfigurationRoot..ctor(IList`1 providers)
   at Microsoft.Extensions.Configuration.ConfigurationBuilder.Build()
   at MyKeyVaultTest.Service.Program.<>c.<CreateWebHostBuilder>b__1_0(WebHostBuilderContext context, IConfigurationBuilder config) in D:\a\1\s\MyKeyVaultTest\MyKeyVaultTest.Service\Program.cs:line 27
   at Microsoft.AspNetCore.Hosting.WebHostBuilder.BuildCommonServices(AggregateException& hostingStartupErrors)
   at Microsoft.AspNetCore.Hosting.WebHostBuilder.Build()
   at MyKeyVaultTest.Service.Program.Main(String[] args) in D:\a\1\s\MyKeyVaultTest\MyKeyVaultTest.Service\Program.cs:line 17

Answer 1

在Web应用程序中启用托管服务标识将创建一个在Azure中使用的标识。您仍然需要授予该身份对密钥库的必要权限。

在Web应用程序中启用MSI后，它将显示为可以在密钥库的权限配置中分配权限的用户。