Azure Blob Storage认证失败：Issuer验证不匹配问题求助

问题场景 #

按照官方快速入门文档，使用DefaultAzureCredential编写Python代码访问Azure Blob Storage，代码如下：

import os
import uuid
from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient, ContainerClient, BlobClient

try:
    account_url = 'https://kindglacierblob.blob.core.windows.net'
    default_credential = DefaultAzureCredential()
    blob_service_client = BlobServiceClient(account_url, credential=default_credential)
    container_name = str(uuid.uuid4())
    container_client = blob_service_client.create_container(container_name)

except Exception as e:
    print(e) # See error details below

错误信息 #

执行代码后出现认证失败错误：

<Error>
<Code>InvalidAuthenticationInfo</Code>
<Message>
    Server failed to authenticate the request. 
    Please refer to the information in the www-authenticate header.
    RequestId:23153837-001e-0019-6585-855a4a000000
    Time:2023-05-13T10:28:57.2758247Z
</Message>
<AuthenticationErrorDetail>
    Issuer validation failed. Issuer did not match.
</AuthenticationErrorDetail>
</Error>

请求与响应详情 #

请求URL #

'https://kindglacierblob.blob.core.windows.net/40803991-619c-4cc6-8931-cfdbae302438?restype=container'

请求头 #

{   'Accept': 'application/xml',
    'Authorization': 'Bearer '
                     'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ii1LSTNROW5OUjdiUm9meG1lWm9YcWJIWkdldyIsImtpZCI6Ii1LSTNROW5OUjdiUm9meG1lWm9YcWJIWkdldyJ9.eyJhdWQiOiJodHRwczovL3N0b3JhZ2UuYXp1cmUuY29tIiwiaXNzIjoiaHR0cHM6Ly9zdHMud2luZG93cy5uZXQvY2M5ZjFhMTgtMDk4Yy00YWE0LWE1MmUtZjA3YTk3N2ZhMTIwLyIsImlhdCI6MTY4Mzk3MjQ0OSwibmJmIjoxNjgzOTcyNDQ5LCJleHAiOjE2ODM5Nzc3MTIsImFjciI6IjEiLCJhaW8iOiJBVlFBcS84VEFBQUFBT0FkU1RPZnNHMTNtdmV6M1VrVzlzakVpK0lRckxVanU4SGxZSG9EM3JHbkFJOExJQUdLclYwbGtEMmp2SFBLWk5Oa2h1YU1GdGFMRzd2aVA1SEUxZ1hDcVo1dmVyaEFnL0xTbG9PdUpIQT0iLCJhbHRzZWNpZCI6IjE6bGl2ZS5jb206MDAwMzAwMDBBQzU4MkZCNSIsImFtciI6WyJwd2QiXSwiYXBwaWQiOiIwNGIwNzc5NS04ZGRiLTQ2MWEtYmJlZS0wMmY5ZTFiZjdiNDYiLCJhcHBpZGFjciI6IjAiLCJlbWFpbCI6InRoZXJlZHBlYUBnbWFpbC5jb20iLCJmYW1pbHlfbmFtZSI6IkFuZGVyc29uIiwiZ2l2ZW5fbmFtZSI6Ik5hdGUiLCJncm91cHMiOlsiNGI2MDEyNTQtMGJmMi00ZDZiLWI3NzEtMmUyNWIxOGZjMDE2Il0sImlkcCI6ImxpdmUuY29tIiwiaXBhZGRyIjoiNzEuMjExLjE4NS4yMzQiLCJuYW1lIjoiTmF0ZSBBbmRlcnNvbiIsIm9pZCI6ImQ2ZTg0ODcxLTBkZWQtNDJlYS04YTNhLTY2NjYxMTMwMzZjMyIsInB1aWQiOiIxMDAzM0ZGRjk0OTI3QzFCIiwicmgiOiIwLkFSZ0FHQnFmekl3SnBFcWxMdkI2bDMtaElJR21CdVRVODZoQ2tMYkNzQ2xKZXZFWUFPSS4iLCJzY3AiOiJ1c2VyX2ltcGVyc29uYXRpb24iLCJzdWIiOiJJX3BUeUJRNDZLdDNBUkJ6eEpQYnYyQklUbWlTbjdYbzFiNTN3ZDZITlBjIiwidGlkIjoiY2M5ZjFhMTgtMDk4Yy00YWE0LWE1MmUtZjA3YTk3N2ZhMTIwIiwidW5pcXVlX25hbWUiOiJsaXZlLmNvbSN0aGVyZWRwZWFAZ21haWwuY29tIiwidXRpIjoidUtGbnU3eHpqVVM1QnFpMWVGMFFBQSIsInZlciI6IjEuMCJ9.qM56mzD09cB1oLW2sa-aZiPsgCCr7cnZ8mlYv5cTHK8pZLlEyXf5404EVrIas7N5tPhiBFL6qq_7znD-4NPFBFK0qWdGIi4BN66T1c5U81wJQl1VgDK4KoHxh2LmUtfYiDHne8LKQ7dLO_WSd-LWb_eTVSEg_0rEOxWjRpcgwRSrvYw98sWdIoIp0doPAmqXeI_IQcDdvWEu6rSMsTd74CjMRaTwFAFpclDazzCWz_kFOMRfaro4s03Ki-7CYRZj-JI49mKvCThXrphLBfOU2B_VrEg4HJNwOb55nFc2WS5l9r0WBh1AlhQa9i7NvmP-OoEZi8gox4HMJeKz6h-pDg',
    'User-Agent': 'azsdk-python-storage-blob/12.16.0 Python/3.11.2 '
                  '(Windows-10-10.0.19044-SP0)',
    'x-ms-client-request-id': 'f69db4e3-f178-11ed-b2a7-f89e94c65957',
    'x-ms-date': 'Sat, 13 May 2023 10:28:55 GMT',
    'x-ms-version': '2022-11-02'}

响应头 #

{   'Content-Length': '402',
    'Content-Type': 'application/xml',
    'Date': 'Sat, 13 May 2023 10:28:56 GMT',
    'Server': 'Microsoft-HTTPAPI/2.0',
    'WWW-Authenticate': 'Bearer '
                        'authorization_uri=https://login.microsoftonline.com/0091f901-8eb9-49ad-a413-3bd58cb1aff0/oauth2/authorize '
                        'resource_id=https://storage.azure.com',
    'x-ms-error-code': 'InvalidAuthenticationInfo',
    'x-ms-request-id': '23153837-001e-0019-6585-855a4a000000'}

已尝试的操作 #

• 同步本地电脑时间至GMT；
• 为自己分配kindglacierblob存储账户的“Storage Blob Data Contributor”角色；
• 通过VS Code的Azure Account Extension登录账号；

尝试通过VS Code终端打开Azure CLI时遇到无关错误：

Error: Cannot find module 'vscode'
Require stack:
- c:\Users\nateanderson\.vscode\extensions\ms-vscode.azure-account-0.11.4\dist\cloudConsoleLauncher.js

弹出提示：

The terminal process "node.exe '-e', 'require('c:\Users\nateanderson\.vscode\extensions\ms-vscode.azure-account-0.11.4\dist\cloudConsoleLauncher').main()'" terminated with exit code: 1.

解决方案 #

1. 显式指定租户ID初始化凭据 #

DefaultAzureCredential可能默认获取了错误租户的令牌，导致颁发者不匹配。从响应头WWW-Authenticate的authorization_uri中提取租户ID（0091f901-8eb9-49ad-a413-3bd58cb1aff0），修改代码显式指定：

default_credential = DefaultAzureCredential(tenant_id="0091f901-8eb9-49ad-a413-3bd58cb1aff0")

2. 清理本地凭据缓存 #

本地可能缓存了旧的租户凭据，导致认证异常：

• 关闭所有VS Code实例；
• 删除%USERPROFILE%\.azure目录下的所有缓存文件；
• 使用Azure CLI重新登录指定租户：

az login --tenant 0091f901-8eb9-49ad-a413-3bd58cb1aff0

3. 验证角色分配生效 #

角色分配需要几分钟时间才能在Azure系统中生效，若刚分配完Storage Blob Data Contributor角色，等待10-15分钟后重试代码。

4. 修复VS Code Azure CLI错误 #

该错误属于VS Code扩展问题，可尝试：

• 将VS Code和Azure Account扩展更新到最新版本；
• 卸载并重新安装Azure Account扩展；
• 使用独立的Azure CLI客户端登录，而非通过VS Code终端启动。

内容的提问来源于stack exchange，提问作者Nate Anderson