无法使用python从Azure Key Vault获取机密/证书| “ KeyVaultManagementClient”对象没有属性“ get_secret”

水源

在此先感谢您,我正在尝试使用python创建VM。在部署时,它将检查密钥库中是否存在证书,并将其复制到VM中。

我通过以下文章来做到这一点

https://azure.microsoft.com/zh-cn/resources/samples/key-vault-python-deploy-certificates-to-vm/

这里的问题是,以上示例是通过使用应用程序ID,密码方法登录执行的,而我正在使用设备身份验证登录。

我想使用ADAL或设备身份验证方法,在该方法中,它将要求我们登录到Azure门户,然后键入身份验证代码,然后登录。它将凭据传递给当前会话。我使用的是交互式身份验证方式,而不是使用客户端ID和机密的非交互式方式

'KeyVaultManagementClient' object has no attribute 'get_secret'在函数“ get_certificates”上遇到错误是否有任何功能可以通过我的交互式登录方式获取证书/秘密?或仅适用于应用程序ID和密码方法。

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.resource import ResourceManagementClient
from azure.mgmt.compute import ComputeManagementClient
from azure.mgmt.network import NetworkManagementClient
from azure.mgmt.compute.models import DiskCreateOption
from azure.mgmt.network.v2017_03_01.models import NetworkSecurityGroup
from azure.mgmt.network.v2017_03_01.models import SecurityRule
import azure.mgmt.network.models
from msrestazure.azure_active_directory import AADTokenCredentials
from azure.mgmt.keyvault import KeyVaultManagementClient
from azure.mgmt.datalake.analytics.job import DataLakeAnalyticsJobManagementClient
from azure.mgmt.datalake.analytics.job.models import JobInformation, JobState, USqlJobProperties
import adal, uuid, time


SUBSCRIPTION_ID = 'xxx-xxxx-xxxx-xxxx-xxxx'
GROUP_NAME = 'RAH-AQ'
Vault_Name = 'aqrahkeyvault'
LOCATION = ''
certificate_as_secret = ''

def authenticate_device_code():
    """
    Authenticate the end-user using device auth.
    """

    authority_host_uri = 'https://login.microsoftonline.com'
    tenant = 'xxxx-xxxx-xxxx-xxxx-xxxx'
    authority_uri = authority_host_uri + '/' + tenant
    resource_uri = 'https://management.core.windows.net/'
    client_id = '04b07795-8ddb-461a-bbee-02f9e1bf7b46'

    context = adal.AuthenticationContext(authority_uri, api_version=None)
    code = context.acquire_user_code(resource_uri, client_id)
    print(code['message'])
    mgmt_token = context.acquire_token_with_device_code(resource_uri, code, client_id)
    credentials = AADTokenCredentials(mgmt_token, client_id)

    return credentials



def get_keyvault(kv_client):
  myvault = kv_client.vaults.get(resource_group_name=GROUP_NAME,vault_name= Vault_Name)

  return myvault


def get_certificates(myvault):
    global certificate_as_secret
    certificate_as_secret = kv_client.get_secret(
        myvault.properties.vault_uri,
        staticwebsite,
        "" # Latest version
    )


if __name__ == "__main__":
    credentials = authenticate_device_code()

resource_group_client = ResourceManagementClient(
    credentials, 
    SUBSCRIPTION_ID
)
network_client = NetworkManagementClient(
    credentials, 
    SUBSCRIPTION_ID
)
compute_client = ComputeManagementClient(
    credentials, 
    SUBSCRIPTION_ID
)

kv_client = KeyVaultManagementClient(
    credentials,
    SUBSCRIPTION_ID
)



creation_result_keyvault = get_keyvault(kv_client)
print("------------------------------------------------------")
print(creation_result_keyvault)

creation_result_certificates = get_certificates(creation_result_keyvault)
print("------------------------------------------------------")
print(creation_result_certificates)
Charles Xu

若要获取Azure Keyvault中的秘密,您需要使用包azure.keyvault。如下代码:

from azure.keyvault import KeyVaultClient, KeyVaultAuthentication
from azure.common.credentials import ServicePrincipalCredentials

def auth_callback(server, resource, scope):
    credentials = ServicePrincipalCredentials(
        client_id = '',
        secret = '',
        tenant = '',
        resource = "https://vault.azure.net"
    )
    token = credentials.token
    return token['token_type'], token['access_token']

client = KeyVaultClient(KeyVaultAuthentication(auth_callback))

secret_bundle = client.get_secret(VAULT_URL, SECRET_ID, SECRET_VERSION)

print(secret_bundle.value)

还有一点您应该注意。关键是您需要添加策略以允许服务主体获得机密。密钥库->访问策略->添加新内容->秘密管理。

本文收集自互联网,转载请注明来源。

如有侵权,请联系 [email protected] 删除。

编辑于
0

我来说两句

0 条评论
登录 后参与评论

相关文章