在此先感谢您,我正在尝试使用python创建VM。在部署时,它将检查密钥库中是否存在证书,并将其复制到VM中。
我通过以下文章来做到这一点
https://azure.microsoft.com/zh-cn/resources/samples/key-vault-python-deploy-certificates-to-vm/
这里的问题是,以上示例是通过使用应用程序ID,密码方法登录执行的,而我正在使用设备身份验证登录。
我想使用ADAL或设备身份验证方法,在该方法中,它将要求我们登录到Azure门户,然后键入身份验证代码,然后登录。它将凭据传递给当前会话。我使用的是交互式身份验证方式,而不是使用客户端ID和机密的非交互式方式
我'KeyVaultManagementClient' object has no attribute 'get_secret'
在函数“ get_certificates”上遇到错误。是否有任何功能可以通过我的交互式登录方式获取证书/秘密?或仅适用于应用程序ID和密码方法。
from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.resource import ResourceManagementClient
from azure.mgmt.compute import ComputeManagementClient
from azure.mgmt.network import NetworkManagementClient
from azure.mgmt.compute.models import DiskCreateOption
from azure.mgmt.network.v2017_03_01.models import NetworkSecurityGroup
from azure.mgmt.network.v2017_03_01.models import SecurityRule
import azure.mgmt.network.models
from msrestazure.azure_active_directory import AADTokenCredentials
from azure.mgmt.keyvault import KeyVaultManagementClient
from azure.mgmt.datalake.analytics.job import DataLakeAnalyticsJobManagementClient
from azure.mgmt.datalake.analytics.job.models import JobInformation, JobState, USqlJobProperties
import adal, uuid, time
SUBSCRIPTION_ID = 'xxx-xxxx-xxxx-xxxx-xxxx'
GROUP_NAME = 'RAH-AQ'
Vault_Name = 'aqrahkeyvault'
LOCATION = ''
certificate_as_secret = ''
def authenticate_device_code():
"""
Authenticate the end-user using device auth.
"""
authority_host_uri = 'https://login.microsoftonline.com'
tenant = 'xxxx-xxxx-xxxx-xxxx-xxxx'
authority_uri = authority_host_uri + '/' + tenant
resource_uri = 'https://management.core.windows.net/'
client_id = '04b07795-8ddb-461a-bbee-02f9e1bf7b46'
context = adal.AuthenticationContext(authority_uri, api_version=None)
code = context.acquire_user_code(resource_uri, client_id)
print(code['message'])
mgmt_token = context.acquire_token_with_device_code(resource_uri, code, client_id)
credentials = AADTokenCredentials(mgmt_token, client_id)
return credentials
def get_keyvault(kv_client):
myvault = kv_client.vaults.get(resource_group_name=GROUP_NAME,vault_name= Vault_Name)
return myvault
def get_certificates(myvault):
global certificate_as_secret
certificate_as_secret = kv_client.get_secret(
myvault.properties.vault_uri,
staticwebsite,
"" # Latest version
)
if __name__ == "__main__":
credentials = authenticate_device_code()
resource_group_client = ResourceManagementClient(
credentials,
SUBSCRIPTION_ID
)
network_client = NetworkManagementClient(
credentials,
SUBSCRIPTION_ID
)
compute_client = ComputeManagementClient(
credentials,
SUBSCRIPTION_ID
)
kv_client = KeyVaultManagementClient(
credentials,
SUBSCRIPTION_ID
)
creation_result_keyvault = get_keyvault(kv_client)
print("------------------------------------------------------")
print(creation_result_keyvault)
creation_result_certificates = get_certificates(creation_result_keyvault)
print("------------------------------------------------------")
print(creation_result_certificates)
若要获取Azure Keyvault中的秘密,您需要使用包azure.keyvault。如下代码:
from azure.keyvault import KeyVaultClient, KeyVaultAuthentication
from azure.common.credentials import ServicePrincipalCredentials
def auth_callback(server, resource, scope):
credentials = ServicePrincipalCredentials(
client_id = '',
secret = '',
tenant = '',
resource = "https://vault.azure.net"
)
token = credentials.token
return token['token_type'], token['access_token']
client = KeyVaultClient(KeyVaultAuthentication(auth_callback))
secret_bundle = client.get_secret(VAULT_URL, SECRET_ID, SECRET_VERSION)
print(secret_bundle.value)
还有一点您应该注意。关键是您需要添加策略以允许服务主体获得机密。密钥库->访问策略->添加新内容->秘密管理。
本文收集自互联网,转载请注明来源。
如有侵权,请联系 [email protected] 删除。
我来说两句