使用Python部署Azure资源时遇'ServicePrincipalCredentials无get_token'错误求解决

问题根源 #

你遇到的错误确实是依赖版本不匹配导致的：旧版azure.common.credentials中的ServicePrincipalCredentials是为Azure SDK for Python v2设计的，而新版Azure管理客户端（比如ResourceManagementClient）要求使用azure-identity库中的凭据类，这类凭据才实现了get_token方法。

具体修复步骤 #

1. 更新依赖包
   卸载旧的凭据包，安装新版适配依赖：

   pip uninstall azure.common
   pip install azure-identity azure-mgmt-resource
   

2. 替换凭据与客户端初始化代码
   把构造函数里的旧凭据逻辑替换为新版实现，同时修复subscription_id被强制覆盖的问题：

   # 导入新版凭据类
   from azure.identity import ClientSecretCredential
   
   def __init__(self, subscription_id, resource_group, pub_ssh_key_path='~/id_rsa.pub'):
       mystack_cloud = get_cloud_from_metadata_endpoint(
           os.environ['ARM_ENDPOINT'])
       # 修复参数覆盖问题：优先使用传入的subscription_id，为空时再读环境变量
       if not subscription_id:
           subscription_id = os.environ['AZURE_SUBSCRIPTION_ID']
       # 用ClientSecretCredential替代旧的ServicePrincipalCredentials
       credentials = ClientSecretCredential(
           client_id=os.environ['AZURE_CLIENT_ID'],
           client_secret=os.environ['AZURE_CLIENT_SECRET'],
           tenant_id=os.environ['AZURE_TENANT_ID'],
           authority=mystack_cloud.endpoints.active_directory
       )
       self.subscription_id = subscription_id
       self.resource_group = resource_group
       self.dns_label_prefix = self.name_generator.haikunate()
       pub_ssh_key_path = os.path.expanduser(pub_ssh_key_path)
       with open(pub_ssh_key_path, 'r') as pub_ssh_file_fd:
           self.pub_ssh_key = pub_ssh_file_fd.read()
       self.credentials = credentials
       # 新版客户端参数名改为credential，保持base_url适配私有云
       self.client = ResourceManagementClient(
           credential=self.credentials,
           subscription_id=self.subscription_id,
           base_url=mystack_cloud.endpoints.resource_manager
       )
   

3. 关键注意点

   • 新版ResourceManagementClient的凭据参数名是credential而非旧版的credentials，必须对应修改
   • 私有云/混合云环境下，authority参数要指定对应云的AD端点，用mystack_cloud.endpoints.active_directory即可自动适配

内容的提问来源于stack exchange，提问作者delucaezequiel