使用Python SDK为邮箱用户分配Azure Blob容器贡献者角色遇问题

核心问题修正说明 #

• principalId参数错误：角色分配必须使用用户的Azure AD对象ID，不能直接用邮箱地址，需先通过邮箱查询对应对象ID
• DefaultAzureCredential认证失败：确保本地环境已完成Azure身份认证，比如通过Azure CLI执行az login登录、配置AZURE_CLIENT_ID等环境变量、或在VS Code中关联Azure账户
• 权限范围错误：原代码将权限分配给整个存储账户，若仅需给特定容器分配权限，需将scope指定为容器的资源ID

修正后的完整代码 #

首先安装所需依赖：

pip install azure-mgmt-graphrbac azure-identity azure-mgmt-resource azure-mgmt-storage

然后是代码：

import os
import uuid
from azure.identity import DefaultAzureCredential
from azure.mgmt.resource import ResourceManagementClient
from azure.mgmt.storage import StorageManagementClient
from azure.mgmt.graphrbac import GraphRbacManagementClient

# 配置Azure参数
subscription_id = 'your_subscription_id'
tenant_id = 'your_tenant_id'  # 需替换为你的Azure AD租户ID
resource_group_name = 'your_resource_group_name'
storage_account_name = 'your_storage_account_name'
container_name = 'your_container_name'
email_address = 'user@example.com'  # 目标用户邮箱

# 初始化认证凭据
credential = DefaultAzureCredential()

# 创建各类客户端
resource_client = ResourceManagementClient(credential, subscription_id)
storage_client = StorageManagementClient(credential, subscription_id)
graph_client = GraphRbacManagementClient(credential, tenant_id)

# 获取存储账户ID
storage_account = storage_client.storage_accounts.get_properties(resource_group_name, storage_account_name)
storage_account_id = storage_account.id

# 构建容器的资源ID（权限范围）
container_scope = f"{storage_account_id}/blobServices/default/containers/{container_name}"

# 通过邮箱查询用户的Azure AD对象ID
users = list(graph_client.users.list(filter=f"mail eq '{email_address}'"))
if not users:
    raise ValueError(f"未找到邮箱为{email_address}的用户")
user_object_id = users[0].object_id

# 定义角色分配参数：Storage Blob Data Contributor角色ID固定为b2e1d0c4-5f1b-4b6b-a1c1-4a2d5f8f3e56
role_definition_id = f"/subscriptions/{subscription_id}/providers/Microsoft.Authorization/roleDefinitions/b2e1d0c4-5f1b-4b6b-a1c1-4a2d5f8f3e56"
role_assignment_name = str(uuid.uuid4())

role_assignment_parameters = {
    'properties': {
        'roleDefinitionId': role_definition_id,
        'principalId': user_object_id  # 使用用户对象ID而非邮箱
    }
}

# 执行角色分配
role_assignment = resource_client.role_assignments.create(
    scope=container_scope,
    role_assignment_name=role_assignment_name,
    parameters=role_assignment_parameters
)

print(f"角色分配成功，ID：{role_assignment.id}")

关键说明 #

1. 租户ID获取：可在Azure门户的「Azure Active Directory」→「概述」中找到租户ID
2. 认证方式验证：若DefaultAzureCredential仍失败，可尝试显式指定认证方式，比如用AzureCliCredential：from azure.identity import AzureCliCredential; credential = AzureCliCredential()
3. 角色ID确认：Storage Blob Data Contributor的角色ID是固定的，若需其他角色，可在Azure门户的「角色定义」中查询对应ID

内容的提问来源于stack exchange，提问作者niki