如何使用自定义注册的AAD应用证书实现事件中心触发函数身份验证？

前置条件 #

• 已完成Azure AD应用注册，并为该应用分配Event Hub对应权限（如Azure Event Hubs Data Receiver用于消息消费、Azure Event Hubs Data Sender用于消息发送）
• 已将证书公钥上传至Azure AD，且私钥妥善存储在运行环境中

配置与实现步骤 #

1. 添加应用配置项 #

在函数应用的配置中心添加以下参数：

• EventHubConnectionSetting__fullyQualifiedNamespace: Event Hub命名空间URI（示例：your-namespace.servicebus.windows.net）
• AadClientId: 你的AAD应用客户端ID
• AadCertificateThumbprint: 证书的指纹值
• AadTenantId: Azure租户ID

2. 实现自定义令牌凭据类 #

创建基于证书获取AAD令牌的自定义TokenCredential，代码示例：

using Azure.Core;
using Azure.Identity;
using System.Security.Cryptography.X509Certificates;

public class CertificateBasedTokenCredential : TokenCredential
{
    private readonly ClientCertificateCredential _innerCredential;

    public CertificateBasedTokenCredential(string tenantId, string clientId, string certThumbprint)
    {
        using var certStore = new X509Store(StoreName.My, StoreLocation.CurrentUser);
        certStore.Open(OpenFlags.ReadOnly);
        var certCollection = certStore.Certificates.Find(
            X509FindType.FindByThumbprint, 
            certThumbprint, 
            validOnly: true);
        certStore.Close();

        if (certCollection.Count == 0)
            throw new InvalidOperationException("未找到指定指纹的有效证书");

        _innerCredential = new ClientCertificateCredential(tenantId, clientId, certCollection[0]);
    }

    public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
    {
        return _innerCredential.GetToken(requestContext, cancellationToken);
    }

    public override ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
    {
        return _innerCredential.GetTokenAsync(requestContext, cancellationToken);
    }
}

3. 配置函数服务的Event Hub选项 #

在函数启动代码中，将自定义令牌凭据绑定到Event Hub配置：

using Microsoft.Azure.Functions.Worker;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;

var host = new HostBuilder()
    .ConfigureFunctionsWorkerDefaults()
    .ConfigureServices(services =>
    {
        var config = services.BuildServiceProvider().GetRequiredService<IConfiguration>();
        var tenantId = config["AadTenantId"];
        var clientId = config["AadClientId"];
        var certThumbprint = config["AadCertificateThumbprint"];

        services.Configure<EventHubOptions>(options =>
        {
            options.Credential = new CertificateBasedTokenCredential(tenantId, clientId, certThumbprint);
        });
    })
    .Build();

host.Run();

4. 保持原触发器定义不变 #

无需修改已有的Event Hub触发器代码，继续使用原配置：

public static async Task RunAsync(
       [EventHubTrigger(
          "%EventHubName%",
           Connection = "EventHubConnectionSetting",
           ConsumerGroup = "%ConsumerGroupName%")] EventData[] messages)
{
    // 消息处理逻辑
}

注意事项 #

• 确保AAD应用通过Azure IAM获得Event Hub实例的对应权限，权限需在Azure门户中完成角色分配
• 运行环境需能访问证书私钥：Azure托管函数可通过密钥库挂载证书；本地运行需将证书安装在当前用户或本地计算机的证书存储中
• 证书需处于有效期内，且私钥未被篡改或删除

内容的提问来源于stack exchange，提问作者Youxu