node.js - 使用 Azure AD 承载令牌时身份验证失败，返回容器列表 [Azure Blob] [Azure AD OAuth 2.0] [REST API]

Question

我已成功尝试使用Shared key然后 make REST callsto执行身份验证Azure Blob。现在我正在尝试使用AzureAD OAuth 2.0, 进行身份验证以接收 Bearer 令牌并将其传递Authentication给 make REST calls。我成功获得Bearer token但无法执行身份验证。

这是代码：

const request = require("request");
require("dotenv").config();

const account = process.env.ACCOUNT_NAME || "";
const key = process.env.ACCOUNT_KEY || "";
const tenantId = process.env.AZURE_TENANT_ID || "";
const clientId = process.env.AZURE_CLIENT_ID || "";
const clientSecret = process.env.AZURE_CLIENT_SECRET || "";

const options = {
  url: `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`,
  formData: {
    grant_type: "client_credentials",
    client_id: clientId,
    scope: "https://graph.microsoft.com/.default",
    // scope:"http://storage.azure.com/.default",
    client_secret: clientSecret,
  },
  headers: {
    "Content-Type": `application/x-www-form-urlencoded`,
  },
};

var strTime = new Date().toUTCString();

function callback(error, response, body) {
  const options = {
    url: `https://${account}.blob.core.windows.net/?comp=list`,

    headers: {
      Authorization: `Bearer ${JSON.parse(response.body).access_token}`,
      "x-ms-date": strTime,
      "x-ms-version": "2019-02-02",
    },
  };

  request(options, function (error, response, body) {
    console.log("Response is: ", response.statusCode, response.statusMessage);
  });
}

request(options, callback);

当我尝试运行它时，它显示 Auth 失败。

 403 Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.

以下是一些参考链接： Service-Service calls using client credentials , OAuth 2.0 client credentials flow

编辑：对两个链接都尝试了范围，选项 url 更新https://login.microsoftonline.com/${tenantId}/oauth2/token为https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token

访问控制的屏幕截图。

但是，同样的错误仍然存​​在。

标签： node.jsazureazure-active-directoryazure-blob-storagerest

Answer 1

尝试更改scopewithhttps://${account}.blob.core.windows.net/.default或https://storage.azure.com/.default。

笔记：

1. “v2.0”支持范围。如果你使用 v1.0，scope需要替换为resource，代码看起来像resource: "https://${account}.blob.core.windows.net/".

2. 使用 formData 时，必须设置“multipart/form-data”。

3. 导航到 Azure 存储 -> 访问控制 (IAM) ->添加角色分配以将服务主体添加到您的存储帐户

代码：

const request = require("request");
require("dotenv").config();
const axios = require('axios');
const qs = require('qs');

const account = "";
const key = "";
const tenantId = "";
const clientId = "";
const clientSecret = "";

const postData = {
  client_id: clientId,
  scope: `https://${account}.blob.core.windows.net/.default`,
  client_secret: clientSecret,
  grant_type: 'client_credentials'
};

axios.defaults.headers.post['Content-Type'] =
  'application/x-www-form-urlencoded';

let token = '';

axios.post(`https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`, qs.stringify(postData))
  .then(response => {
    console.log(response.data);
    token = response.data.access_token;
  })
  .catch(error => {
    console.log(error);
  });