Azure Service Fabric和Azure Key Vault秘密错误

Question

当我试图从一个无状态服务实现Azure Key Vault Secret时，我得到了以下信息：从一个控制台应用程序实现Azure Key Vault Secret。

System.TypeLoadException
  HResult=0x80131522
  Message=Inheritance security rules violated by type: 'System.Net.Http.WebRequestHandler'. Derived types must either match the security accessibility of the base type or be less accessible.
  Source=Microsoft.Rest.ClientRuntime
  StackTrace:
   at Microsoft.Rest.ServiceClient`1.CreateRootHandler

public async Task<string> GetAccessToken(string authority, string resource, string scope)
        {
            var clientId = MyConfig.Settings.Sections["MyConfigSection"].Parameters["AuthClientId"].Value;
            var clientSecret = MyConfig.Settings.Sections["MyConfigSection"].Parameters["AuthClientSecret"].Value;
            ClientCredential clientCredential = new ClientCredential(clientId, clientSecret);

            var context = new AuthenticationContext(authority, TokenCache.DefaultShared);
            var result = await context.AcquireTokenAsync(resource, clientCredential);

            return result.AccessToken;
        }

        public string GetCRMConnectionString()
        {
            var secretvaultAddress = MyConfig.Settings.Sections["MyConfigSection"].Parameters["SecretVaultUrl"].Value;
            var client = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(GetAccessToken));
            return client.GetSecretAsync(secretvaultAddress).GetAwaiter().GetResult().Value;
        }

Answer 1

WebRequestHandler类型（在您的案例中创建了其实例）是System.Net.http.WebRequest.dll的一部分。如果您探究程序集的属性，您会发现应用于它的下一个属性-

[程序集：AllowPartiallyTrustedCallers]

此属性使程序集被视为SecurityTransparent。WebRequestHandler派生自另一个程序集-system.net.http.dll中定义的HttpClientHandler。因此，在部署代码的环境中，System.net.http.dll可能缺少AllowPartiallyTrustedCallers，这使其成为安全关键的，这意味着规则被违反--透明代码不能调用到安全关键的代码。

有关更多详细信息和选项，请参阅此链接-类型违反的继承安全规则：'System.Net.HTTP.WebRequestHandler'。