对 Azure Key Vault 进行身份验证Authenticate to Azure Key Vault

借助 Azure 密钥保管库,可以在集中的安全云存储库中存储机密并控制其分发,因而无需在应用程序中存储凭据。Azure Key Vault allows you to store secrets and control their distribution in a centralized, secure cloud repository, which eliminates the need to store credentials in applications. 应用程序只需要在运行时使用密钥保管库进行身份验证即可访问这些机密。Applications need only authenticate with Key Vault at run time to access those secrets.

应用标识和安全主体App identity and security principals

使用密钥保管库进行的身份验证可与 Azure Active Directory (Azure AD) 结合使用,后者负责对任何给定安全主体的标识进行身份验证。Authentication with Key Vault works in conjunction with Azure Active Directory (Azure AD), which is responsible for authenticating the identity of any given security principal.

安全主体是一个对象,表示请求访问 Azure 资源的用户、组、服务或应用程序。A security principal is an object that represents a user, group, service, or application that's requesting access to Azure resources. Azure 为每个安全主体分配唯一的对象 ID。Azure assigns a unique object ID to every security principal.

  • 用户安全主体标识在 Azure Active Directory 中具有配置文件的个人。A user security principal identifies an individual who has a profile in Azure Active Directory.

  • 组安全主体标识在 Azure Active Directory 中创建的一组用户。A group security principal identifies a set of users created in Azure Active Directory. 分配给组的任何角色或权限都将授予组内的所有用户。Any roles or permissions assigned to the group are granted to all of the users within the group.

  • 服务主体是一类安全主体,它标识应用程序或服务,即一段代码,而不是用户或组。A service principal is a type of security principal that identities an application or service, which is to say, a piece of code rather than a user or group. 服务主体的对象 ID 称为其客户端 ID,作用类似于其用户名。A service principal's object ID is known as its client ID and acts like its username. 服务主体的客户端密码的作用类似于其密码。The service principal's client secret acts like its password.

对于应用程序,有两种获取服务主体的方法:For applications, there are two ways to obtain a service principal:

  • 建议:为应用程序启用系统分配的托管标识。Recommended: enable a system-assigned managed identity for the application.

    借助托管标识,Azure 在内部管理应用程序的服务主体,并自动通过其他 Azure 服务对应用程序进行身份验证。With managed identity, Azure internally manages the application's service principal and automatically authenticates the application with other Azure services. 托管标识可用于部署到各种服务的应用程序。Managed identity is available for applications deployed to a variety of services.

    有关详细信息,请参阅托管标识概述For more information, see the Managed identity overview. 另请参阅支持托管标识的 Azure 服务,其链接到介绍如何为特定服务(例如应用服务、Azure Functions、虚拟机等)启用托管标识的文章。Also see Azure services that support managed identity, which links to articles that describe how to enable managed identity for specific services (such as App Service, Azure Functions, Virtual Machines, etc.).

  • 如果不能使用托管标识,请改为将应用程序注册到 Azure AD 租户,如快速入门:将应用程序注册到 Azure 标识平台中所述。If you cannot use managed identity, you instead register the application with your Azure AD tenant, as described on Quickstart: Register an application with the Azure identity platform. 注册操作还会创建第二个应用程序对象,该对象在所有租户中标识该应用。Registration also creates a second application object that identifies the app across all tenants.

授权安全主体访问 Key VaultAuthorize a security principal to access Key Vault

密钥保管库可用于两个不同的授权级别:Key Vault works with two separate levels of authorization:

  • 访问策略控制是否授权用户、组或服务主体访问现有密钥保管库资源内的机密、密钥和证书(有时称为“数据平面”操作)。Access policies control whether a user, group, or service principal is authorized to access secrets, keys, and certificates within an existing Key Vault resource (sometimes referred to "data plane" operations). 访问策略通常授予用户、组和应用程序。Access policies are typically granted to users, groups, and applications.

    若要分配访问策略,请参阅以下文章:To assign access policies, see the following articles:

  • 角色权限控制是否授权用户、组或服务主体创建、删除及以其他方式管理密钥保管库资源(有时称为“管理平面”操作)。Role permissions control whether a user, group, or service principal is authorized to create, delete, and otherwise manage a Key Vault resource (sometimes referred to as "management plane" operations). 此类角色通常仅授予管理员。Such roles are most often granted only to administrators.

    若要分配和管理角色,请参阅以下文章:To assign and manage roles, see the following articles:

    密钥保管库目前支持参与者角色,该角色允许对密钥保管库资源进行管理操作。Key Vault currently supports the Contributor role, which allows management operations on Key Vault resources. 目前还有多个其他角色以预览版提供。A number of other roles are currently in preview. 还可以按照 Azure 自定义角色中所述创建自定义角色。You can also create custom roles, as described on Azure custom roles.

    有关角色的一般信息,请参阅什么是 Azure 基于角色的访问控制 (Azure RBAC)?For general information on roles, see What is Azure role-based access control (Azure RBAC)?.

重要

为了获得最高安全性,请始终遵循最小特权原则,并仅授予所需的最具体的访问策略和角色。For greatest security, always follow the principal of least privilege and grant only the most specific access policies and roles that are necessary.

配置密钥保管库防火墙Configure the Key Vault firewall

默认情况下,密钥保管库允许通过公共 IP 地址访问资源。By default, Key Vault allows access to resources through public IP addresses. 为了提高安全性,还可以将访问限制为仅允许特定的 IP 范围、服务终结点、虚拟网络进行访问。For greater security, you can also restrict access to specific IP ranges, service endpoints, virtual networks.

有关详细信息,请参阅访问防火墙保护下的 Azure 密钥保管库For more information, see Access Azure Key Vault behind a firewall.

密钥保管库身份验证流The Key Vault authentication flow

  1. 服务主体请求使用 Azure AD 进行身份验证,例如:A service principal requests to authenticate with Azure AD, for example:

    • 用户使用用户名和密码登录到 Azure 门户。A user logs into the Azure portal using a username and password.
    • 应用程序调用 Azure REST API,提供客户端 ID 和密码或客户端证书。An application invokes an Azure REST API, presenting a client ID and secret or a client certificate.
    • Azure 资源(例如具有托管标识的虚拟机)与 Azure 实例元数据服务 (IMDS) REST 终结点联系以获取访问令牌。An Azure resource such as a virtual machine with a managed identity contacts the Azure Instance Metadata Service (IMDS) REST endpoint to get an access token.
  2. 如果使用 Azure AD 成功进行身份验证,则将向服务主体授予 OAuth 令牌。If authentication with Azure AD is successful, the service principal is granted an OAuth token.

  3. 服务主体通过密钥保管库的终结点 (URI) 调用密钥保管库 REST API。The service principal makes a call to the Key Vault REST API through the Key Vault's endpoint (URI).

  4. 密钥保管库防火墙会检查以下条件。Key Vault Firewall checks the following criteria. 如果满足任何条件,则允许调用。If any criterion is met, the call is allowed. 否则,调用将被阻止并返回禁止访问响应。Otherwise the call is blocked and a forbidden response is returned.

    • 防火墙已禁用,并且可以从公共 Internet 访问密钥保管库的公共终结点。The firewall is disabled and the public endpoint of Key Vault is reachable from the public internet.
    • 调用方是密钥保管库受信任的服务,因此允许其绕过防火墙。The caller is a Key Vault Trusted Service, allowing it to bypass the firewall.
    • 调用方按 IP 地址、虚拟网络或服务终结点在防火墙中列出。The caller is listed in the firewall by IP address, virtual network, or service endpoint.
  5. 如果防火墙允许该调用,则密钥保管库会调用 Azure AD 来验证服务主体的访问令牌。If the firewall allows the call, Key Vault calls Azure AD to validate the service principal’s access token.

  6. 密钥保管库会检查服务主体是否对请求的操作具有所需的访问策略。Key Vault checks if the service principal has the necessary access policy for the requested operation. 如果没有,则密钥保管库会返回禁止访问响应。If not, Key Vault returns a forbidden response.

  7. 密钥保管库会执行请求的操作并返回结果。Key Vault carries out the requested operation and returns the result.

下面的关系图说明应用程序调用密钥保管库“获取机密”API 的过程:The following diagram illustrates the process for an application calling a Key Vault "Get Secret" API:

Azure 密钥保管库身份验证流

代码示例Code examples

下表链接到其他文章,这些文章演示如何使用相关语言的 Azure SDK 库在应用程序代码中使用密钥保管库。The following table links to different articles that demonstrate how to work with Key Vault in application code using the Azure SDK libraries for the language in question. 为了方便起见,还包括了其他接口,例如 Azure CLI 和 Azure 门户。Other interfaces such as the Azure CLI and the Azure portal are included for convenience.

密钥保管库机密Key Vault Secrets 密钥保管库密钥Key Vault Keys Key Vault 证书Key Vault Certificates
PythonPython PythonPython PythonPython
.NET (SDK v4).NET (SDK v4) -- --
.NET (SDK v3).NET (SDK v3) -- --
JavaJava -- --
JavaScriptJavaScript -- --
Azure 门户Azure portal Azure 门户Azure portal Azure 门户Azure portal
Azure CLIAzure CLI Azure CLIAzure CLI Azure CLIAzure CLI
Azure PowerShellAzure PowerShell Azure PowerShellAzure PowerShell Azure PowerShellAzure PowerShell
ARM 模板ARM template -- --

后续步骤Next Steps