onprem计算机到Azure Active Directory，这样我们就可以访问了ActiveDirect
技术问答
242 人阅读
|
0 人回复
|
2023-09-13
|
|
我们希望将AzureSqlServer与ActiveDirectoryMSI基于令牌的身份验证和身份验证一起使用，可以从Azure创建并添加到网络中Azure
/ b9 V, g# Z* q% R* a( RAD组成员的VM成功执行。因此，我们通过点击链接创建了包含用户的链接/ D% A1 `' Z* Z5 A; K. _/ S( }$ F
https://docs.microsoft.com/zh-cn/azure/active-directory/managed-identities- f/ d1 F9 H5 V
azure-resources/tutorial-windows-vm-access-sql/ l4 s1 X8 b( J* p+ V
通过以下链接添加虚拟机AzureActiveDirectory的一部分
) B4 R9 Q7 N- t* a1 Zcom.microsoft.sqlserver.jdbc.SQLServerException：MSI令牌失败：无法从MSI终点获取令牌 K4 [& L* o; O1 v# n
而且我们可以用IMDS服务器访问SQL数据不需要提供用户名和密码，可以使用http://169.254.169.254/metadata/identity/oauth2/token?api-
: U! E% p/ x( Z( K5 v- v/ M8 j, [version=2018-02-01&resource检索令牌 =
2 O. d- u! s: X# I( ]+ X8 ohttps％3A％2F％2Fdatabase.windows.net％2F
" J; f1 d) W9 l" d" `和
. M) n1 i2 B1 z, B7 d9 BActiveDirectorMSI URIString jdbc：sqlserver：// azuresqlserverNAME：1433;
8 o6 Q! Y4 W8 [databaseName = DatabaseNAME; Authentication = ActiveDirectoryMsi; 。
1 p7 h) c/ X; u4 s" @) j+ J但是，从Onprem Windows / Linux / Mac当我们无法访问计算机时Azure SQL服务器+ [8 _* i( Y8 [8 N
有人能就当地部署向我提出建议吗？ActiveDirectoryMSI身份验证和基于令牌的身份验证来访问AzureSqlServer？/ W E0 x# m; s6 {! N
1 U. {- |& [" t! k/ d. p. y$ g
解决方案: & S3 i" y/ c* X( U
根据我的测试，如果要连接的话Azure SQL请参考以下步骤
( |( F! m6 z+ `8 q1 g2 I[ol]创建服务主体
* N8 `4 Z7 ]+ b; a M8 Q) vaz ad sp create-for-rbac -n ‘name’ –skip-assignment添加服务主体Azure SQL用户包含在数据库中。+ Q: w" Q+ |+ B
设置环境变量。请将以下变量置以下变量。% [4 o- x: e0 P" |9 v
AZURE_TENANT_ID: ID of the service principal’s tenant. Also called its ‘directory’ ID.
* G5 F5 }# i! p- f+ fAZURE_CLIENT_ID: the service principal’s client ID) C0 U4 Z# ?) Q/ l" r4 u% H. R
AZURE_CLIENT_SECRET: one of the service principal’s client secrets软件开发工具包6 f% k. K( t u
com.azure% a6 |- O7 {* `- }4 o/ Q3 B
azure-identity1 F! g7 |) }! Z7 x/ L) C% R' q
1.0.7
0 X2 O5 ?' s+ `2 x8 _' [5 L3 S8 q2 A% n
com.microsoft.sqlserver
* I- x i" T& L! |7 k/ F mssql-jdbc
' e( w) ]% \8 T* {' V* g 8.2.2.jre8代码 x1 z- Z0 V, z2 R: P6 s. F9 z; B
public static void main( String[] args )4 }8 f! p- J/ Z
{
8 t) A( j6 {, s0 b AccessToken token= GetAccessToken();, }6 `4 d; r# h" g2 {) { F3 z
SQLServerDataSource ds = new SQLServerDataSource();: _8 H- N9 U8 ?, n
ds.setServerName(".database.windows.net"); // Replace with your server name. ds.setDatabaseName("demo"); // Replace with your database name. ds.setAccessToken(token.getToken()； try (Connection connection = ds.getConnection()；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；Statement stmt = connection.createStatement()；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；ResultSet rs = stmt.executeQuery("SELECT SUSER_SNAME()")) if (rs.next()) System.out.println("You have successfully logged on as: " rs.getString(1)； public static AccessToken GetAccessToken() DefaultAzureCredential creds = new DefaultAzureCredentialBuilder() .build()； TokenRequestContext request = new TokenRequestContext()； System.out.println("444"); request.addScopes("https://database.windows.net//.default"); String token; AccessToken accesstoken=creds.getToken(request).block()； return accesstoken;}[/ol] |
|
|
|
|
|
|
|
|
|
