azd auth login与DefaultAzureCredential()致Azure Blob Storage权限匹配错误

问题差异原因 #

1. Python客户端初始化错误：你传给BlobServiceClient的container_name和blob_name是无效参数，BlobServiceClient是存储账户级别的客户端，不需要这两个参数。错误的参数会导致请求构造异常，触发权限校验失败；而Azure CLI命令是正确指定了容器和Blob路径，所以能正常执行。
2. DefaultAzureCredential凭据优先级问题：DefaultAzureCredential会按优先级顺序尝试多种凭据来源（比如环境变量、Visual Studio、Azure CLI/azd等），如果本地存在其他优先级更高的凭据（比如旧的环境变量凭据），可能会跳过azd登录的身份，使用了没有Blob权限的身份发起请求。

解决步骤 #

1. 修正Python代码的客户端初始化 #

你需要使用正确的客户端层级来下载Blob，以下是两种正确的写法：

写法一：通过BlobServiceClient -> ContainerClient -> BlobClient

from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient

account_url = "https://<your_account_name>.blob.core.windows.net"
container_name = "<your_container_name>"
blob_name = "<your_blob_name>"

credential = DefaultAzureCredential()
# 初始化BlobServiceClient（不需要container和blob参数）
blob_service_client = BlobServiceClient(account_url=account_url, credential=credential)
# 获取容器客户端
container_client = blob_service_client.get_container_client(container_name)
# 获取Blob客户端并下载
blob_client = container_client.get_blob_client(blob_name)
downloaded_blob = blob_client.download_blob()
# 读取内容示例
content = downloaded_blob.readall()

写法二：直接初始化BlobClient

from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobClient

account_url = "https://<your_account_name>.blob.core.windows.net"
container_name = "<your_container_name>"
blob_name = "<your_blob_name>"

credential = DefaultAzureCredential()
# 直接构造Blob客户端
blob_client = BlobClient(account_url=account_url, container_name=container_name, blob_name=blob_name, credential=credential)
downloaded_blob = blob_client.download_blob()
content = downloaded_blob.readall()

2. 确保DefaultAzureCredential使用azd登录的凭据 #

如果修正代码后仍然报错，可以强制DefaultAzureCredential优先使用Azure CLI/azd的凭据，排除其他可能的凭据来源：

from azure.identity import DefaultAzureCredential

# 只使用Azure CLI/azd的凭据
credential = DefaultAzureCredential(
    exclude_environment_credentials=True,
    exclude_visual_studio_code_credentials=True,
    exclude_visual_studio_credentials=True,
    exclude_shared_token_cache_credentials=True,
    exclude_interactive_browser_credentials=True
)

或者直接使用AzureCliCredential替代DefaultAzureCredential，确保使用azd登录的身份：

from azure.identity import AzureCliCredential
from azure.storage.blob import BlobClient

account_url = "https://<your_account_name>.blob.core.windows.net"
container_name = "<your_container_name>"
blob_name = "<your_blob_name>"

credential = AzureCliCredential()
blob_client = BlobClient(account_url=account_url, container_name=container_name, blob_name=blob_name, credential=credential)
downloaded_blob = blob_client.download_blob()

3. 验证当前使用的身份 #

可以添加代码打印当前凭据的信息，确认是否是你通过azd登录的身份：

from azure.identity import DefaultAzureCredential
import base64
import json

credential = DefaultAzureCredential()
# 获取当前凭据的令牌
token = credential.get_token("https://storage.azure.com/.default")
# 解析JWT负载获取身份信息
payload = json.loads(base64.b64decode(token.token.split('.')[1] + "=="))
print(f"当前用户ID: {payload.get('oid')}")
print(f"当前租户ID: {payload.get('tid')}")

内容的提问来源于stack exchange，提问作者harry