我是 Azure 平台的新手。我已经按照此链接生成服务原理:https://learn.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal
当我到达步骤:将应用程序分配给角色>第 6 点(搜索您的应用程序,然后选择它。) 我在搜索结果中看不到我的应用程序。
之后我尝试使用 ruby api 创建虚拟机:
https://github.com/Azure/azure-sdk-for-ruby/tree/master/management/azure_mgmt_compute
当我实现代码来创建虚拟机时,出现以下错误:
"message": "MsRestAzure::AzureOperationError: AuthorizationFailed: The client 'xxxx' with object id 'xxxx' does not have authorization to perform action 'Microsoft.Compute/virtualMachines/write' over scope '/subscriptions/xxxx/resourceGroups/my_group/providers/Microsoft.Compute/virtualMachines/test-ubuntu3'.",
在上面的错误消息中,客户端和对象 ID 相同。我不知道为什么以及对象 id 的含义是什么。
我该如何解决这个问题?我应该在门户中查看哪里?任何帮助将不胜感激。
谢谢
最佳答案
根本原因是您使用的服务主体在该租户中没有拥有权限。
租户拥有订阅,服务主体属于租户。 Azure 资源管理器还公开给定主体的基于角色的授权,这将赋予其对 Azure 资源的权限。服务主体似乎无权读取该订阅。
请使用 Azure CLI 2.0 创建服务主体:
az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/mySubscriptionID/resourceGroups/myResourceGroupName"
这里是关于CLI 2.0的信息创建服务主体:
C:\Users>az ad sp create-for-rbac -h
Command
az ad sp create-for-rbac: Create a service principal and configure its access to Azure
resources.
Arguments
--cert : PEM or DER formatted public certificate using string or `@<file path>` to
load from a file. Do not include private key info.
--create-cert : Create and upload self-signed certificate which you can use to login.
--expanded-view : Once created, display more information like subscription and cloud
environments.
--name -n : A display name or an app id uri. Command will generate one if missing.
--password -p : The password used to login. If missing, command will generate one.
--role : Role the service principal has on the resources. Default: Contributor.
--scopes : Space separated scopes the service principal's role assignment applies to.
Defaults to the root of the current subscription.
--skip-assignment: Do not create default assignment.
--years : Years the password will be valid. Default: 1 year.
Global Arguments
--debug : Increase logging verbosity to show all debug logs.
--help -h : Show this help message and exit.
--output -o : Output format. Allowed values: json, jsonc, table, tsv. Default: json.
--query : JMESPath query string. See http://jmespath.org/ for more information and
examples.
--verbose : Increase logging verbosity. Use --debug for full debug logs.
Examples
Create with a default role assignment.
az ad sp create-for-rbac
Create using a custom name, and with a default assiggment.
az ad sp create-for-rbac -n "http://MyApp"
Create without a default assignment.
az ad sp create-for-rbac --skip-assignment
Create with customized assignments
az ad sp create-for-rbac -n "http://MyApp" --role contributor --scopes
/subscriptions/11111111-2222-3333-4444-555555555555/resourceGroups/MyResourceGroup
/subscriptions/11111111-2222-3333-4444-666666666666/resourceGroups/MyAnotherResourceGroup
Create using self-signed certificte
az ad sp create-for-rbac --create-cert
Login with a service principal.
az login --service-principal -u <name> -p <password> --tenant <tenant>
Login with self-signed certificate
az login --service-principal -u <name> -p <certificate file path> --tenant <tenant>
Reset credentials on expiration.
az ad sp reset-credentials --name <name>
Create extra role assignments in future.
az role assignment create --assignee <name> --role Contributor
Revoke the service principal when done with it.
az ad app delete --id <name>
Create using certificate from Key Vault
az keyvault certificate download --vault-name vault -n cert-name -f cert.pem
az ad sp create-for-rbac --cert @cert.pem
关于ruby-on-rails - 尝试使用 Ruby api 创建虚拟机实例时出现错误 MsRestAzure::AzureOperationError: AuthorizationFailed,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/44416561/