我最近在Azure虚拟机里的Spring Boot应用中配置了托管身份，用来访问Key Vault，但遇到了两个棘手的问题，想请教大家怎么解决：

pom.xml依赖配置 #

...
<dependency>
   <groupId>com.azure.spring</groupId>
   <artifactId>spring-cloud-azure-starter-keyvault-secrets</artifactId>
   <version>5.13.0</version>
</dependency>
<dependency>
   <groupId>com.azure</groupId>
   <artifactId>azure-identity</artifactId>
   <version>1.14.2</version>
</dependency>
...

第一种配置及报错 #

我先使用了以下application.properties配置：

spring.cloud.azure.keyvault.secret.property-source-enabled=true
spring.cloud.azure.keyvault.secret.property-sources[0].endpoint=https://kvl-portal.vault.azure.net/
spring.cloud.azure.keyvault.secret.property-sources[0].profile.tenant-id=6d8b...
spring.cloud.azure.keyvault.secret.property-sources[0].credential.managed-identity-enabled=true

应用启动时抛出了403权限错误：

15:57:55.244 [main] ERROR o.s.boot.SpringApplication - Application run failed
java.lang.IllegalStateException: Failed to configure KeyVault property source...
Caused by: com.azure.security.keyvault.secrets.implementation.models.KeyVaultErrorException: Status code 403, "{"error":{"code":"Forbidden","message":"Caller is not authorized to perform action on resource.\r\nIf role assignments, deny assignments or role definitions were changed recently, please observe propagation time.\r\nCaller...
eason: null \r\nVault: kvl-portal;location=brazilsouth\r\n","innererror":{"code":"ForbiddenByRbac"}}}"

第二种配置及报错 #

后来我尝试在配置中添加了托管身份的client-id：

spring.cloud.azure.keyvault.secret.property-source-enabled=true
spring.cloud.azure.keyvault.secret.property-sources[0].endpoint=https://kvl-portal.vault.azure.net/
spring.cloud.azure.keyvault.secret.property-sources[0].profile.tenant-id=6d8b...
spring.cloud.azure.keyvault.secret.property-sources[0].credential.managed-identity-enabled=true
spring.cloud.azure.keyvault.secret.property-sources[0].credential.client-id=155619f....

这次启动时又遇到了认证不可用的错误：

Caused by: com.azure.identity.CredentialUnavailableException: Managed Identity authentication is not available.

想请教各位，有没有办法在Azure虚拟机上部署的Spring Boot应用中，通过托管身份正常获取Key Vault的密钥呢？

备注：内容来源于stack exchange，提问作者Aldo Inácio da Silva