如何通过PHP和Postman调用Azure App Roles并解决认证问题？

一、Bearer Token 说明与获取方式 #

调用Azure管理API所需的Bearer Token是Azure AD颁发的访问令牌，核心要求：

• 需在Azure AD注册应用，添加应用权限：选择Azure Service Management的对应权限（服务端调用推荐应用权限，需管理员授予同意）
• 获取令牌的端点：https://login.microsoftonline.com/{租户ID}/oauth2/v2.0/token
• 请求参数：
  • grant_type: client_credentials
  • client_id: 你的Azure AD应用ID
  • client_secret: 应用注册时生成的密钥
  • scope: https://management.azure.com/.default

二、Postman 配置步骤 #

1. 新建GET请求，填入目标API URL：

   https://management.azure.com/subscriptions/SUBSCRIPTIONID/resourceGroups/myresourcegroup1/providers/Microsoft.Authorization/roleAssignments?api-version=2022-04-01&$filter=atScope()
   

2. 配置认证：
   • 选择Authorization标签，类型选OAuth 2.0
   • 授权类型选Client Credentials
   • 令牌URL填https://login.microsoftonline.com/{租户ID}/oauth2/v2.0/token
   • 填入客户端ID、客户端密钥，范围填https://management.azure.com/.default
   • 点击Get New Access Token，获取成功后选择Use Token
3. 发送请求，验证是否返回角色分配数据

三、PHP cURL 示例代码 #

<?php
// 核心配置参数
$tenantId = "你的租户ID";
$clientId = "你的Azure AD应用ID";
$clientSecret = "你的应用密钥";
$subscriptionId = "你的订阅ID";
$resourceGroup = "myresourcegroup1";

// 1. 获取Bearer Token
$tokenUrl = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token";
$tokenParams = [
    'grant_type' => 'client_credentials',
    'client_id' => $clientId,
    'client_secret' => $clientSecret,
    'scope' => 'https://management.azure.com/.default'
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $tokenUrl);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($tokenParams));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/x-www-form-urlencoded']);

$tokenResponse = curl_exec($ch);
curl_close($ch);
$tokenData = json_decode($tokenResponse, true);

if (!isset($tokenData['access_token'])) {
    die("令牌获取失败: " . $tokenResponse);
}
$accessToken = $tokenData['access_token'];

// 2. 调用角色分配API
$apiUrl = "https://management.azure.com/subscriptions/$subscriptionId/resourceGroups/$resourceGroup/providers/Microsoft.Authorization/roleAssignments?api-version=2022-04-01&$filter=atScope()";

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $apiUrl);
curl_setopt($ch, CURLOPT_HTTPGET, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer $accessToken",
    'Content-Type: application/json'
]);

$apiResponse = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// 输出结果
echo "HTTP状态码: $httpCode\n";
echo "API响应:\n";
print_r(json_decode($apiResponse, true));
?>

注意事项 #

• 确保Azure AD应用已被分配足够权限（如Reader或Role Based Access Control Administrator）到订阅/资源组级别，否则会返回403错误
• 客户端密钥需妥善保管，建议通过环境变量注入，避免硬编码

内容的提问来源于stack exchange，提问作者ShorePatrol