可以在本地使用“用户分配的托管身份”吗？

我正在尝试使用User Assigned Managed Identity https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal在我们的一个应用程序中。我还读到了之间的差异System Assigned Managed Identity and User Assigned Managed Identity https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview#managed-identity-types.

我很清楚System Assigned Managed Identity无法在本地使用，因为您要将身份分配给 Azure 资源。

但是我不清楚是否User Assigned Managed Identity可以在本地使用。我唯一能找到的是以下内容：

在我的场景中，我想从 Azure Key Vault 读取一些机密。我创建了一个用户分配的托管身份，并在 Key Vault 上配置了访问策略，以向该身份授予必要的权限。考虑到我使用此身份来访问 Azure Key Vault（这是一种 Azure 资源），我的期望是，无论我的代码在何处运行（使用 JetBrains Rider 作为我的 IDE），它都应该可以工作。

但是，当我尝试做类似的事情时：

var managedIdentityCredential = new ManagedIdentityCredential("managed-identity-id");
SecretClient secretClient = new(new Uri("https://mykeyvault.vault.azure.net/"), managedIdentityCredential);
KeyVaultSecret secret = await secretClient.GetSecretAsync(key);

我得到了Azure.Identity.CredentialUnavailableException with ManagedIdentityCredential authentication unavailable. No Managed Identity endpoint found当我在本地运行代码时出现错误消息：

Azure.Identity.CredentialUnavailableException: ManagedIdentityCredential authentication unavailable. No Managed Identity endpoint found.
   at Azure.Identity.ManagedIdentityClient.AuthenticateAsync(Boolean async, TokenRequestContext context, CancellationToken cancellationToken)
   at Azure.Identity.ManagedIdentityCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex)
   at Azure.Identity.ManagedIdentityCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Identity.ManagedIdentityCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.AuthenticateRequestAsync(HttpMessage message, Boolean async, AuthenticationChallenge challenge)
   at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.ProcessCoreAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
   at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
   at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
   at Azure.Core.Pipeline.HttpPipeline.SendRequestAsync(Request request, CancellationToken cancellationToken)
   at Azure.Security.KeyVault.KeyVaultPipeline.SendRequestAsync(Request request, CancellationToken cancellationToken)
   at Azure.Security.KeyVault.KeyVaultPipeline.SendRequestAsync[TResult](RequestMethod method, Func`1 resultFactory, CancellationToken cancellationToken, String[] path)
   at Azure.Security.KeyVault.Certificates.CertificateClient.GetCertificateAsync(String certificateName, CancellationToken cancellationToken)

对此的任何见解都将受到高度赞赏。

不。用户管理的身份也不支持ManagedIdentityCredential在当地环境中。

你应该使用默认Azure凭据 https://learn.microsoft.com/en-us/dotnet/api/azure.identity.defaultazurecredential?view=azure-dotnet使代码在本地环境中运行。

See the Note tip here https://learn.microsoft.com/en-us/azure/azure-app-configuration/howto-integrate-azure-managed-service-identity?tabs=core2x#use-a-managed-identity.

Note

The ManagedIdentityCredential仅适用于以下 Azure 环境 支持托管身份验证的服务。这不起作用 在当地环境中。使用默认Azure凭据对于代码 在本地和 Azure 环境中工作，因为它将回退到 很少有身份验证选项，包括托管身份。

如果您想使用用户分配的托管身份与DefaultAzureCredential当部署到 Azure 时，指定 客户端ID.