0

目前，我有两个订阅：S01 和 S02。我有一个在 S02 中运行的运行手册，需要访问 S01 中的资源。

当我运行命令Get-AzureRmSubscription -SubscriptionName S01时，它甚至找不到订阅。以下是代码和输出示例：

$connectionName = "AzureRunAsConnection"
try
{
    # Get the connection "AzureRunAsConnection "
    $servicePrincipalConnection = Get-AutomationConnection -Name $connectionName         

    Write-Output "Logging in to Azure..."
    $Account = Add-AzureRmAccount `
        -ServicePrincipal `
        -TenantId $servicePrincipalConnection.TenantId `
        -ApplicationId $servicePrincipalConnection.ApplicationId `
        -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint `
        -Verbose `
        -ErrorAction Stop

    Write-Output "***** LOGGED IN ($((Get-AzureRmContext).Subscription.SubscriptionName)). *******"
}
catch {
    if (!$servicePrincipalConnection)
    {
        $ErrorMessage = "Connection $connectionName not found."
        throw $ErrorMessage
    } 
    else
    {
        Write-Error -Message $_.Exception
        throw $_.Exception
    }
}

 Write-Output "Current subscription using Get-AzureRmSubscription:"
 Get-AzureRmSubscription
 Write-Output "==============================================================="

 Write-Output "Switch subscription using Select-AzureRmSubscription:"
 Get-AzureRmSubscription -SubscriptionName "S01" | Select-AzureRmSubscription
 Write-Output "==============================================================="

 Write-Output "Switch subscription using Set-AzureRmContext:"
 Set-AzureRmContext -SubscriptionName "S01"
 Write-Output "==============================================================="

输出：

Logging in to Azure...

VERBOSE: Performing the operation "log in" on target "ServicePrincipal account in environment 'AzureCloud'".

***** LOGGED IN (S02). *******

Current subscription using Get-AzureRmSubscription:

WARNING: Unable to acquire token for tenant 'Common'

SubscriptionId            : 2f301a20-22a3-b321-2a3c-829ac3d4e39a
SubscriptionName          : S02
State                     : Enabled
TenantId                  : e2g374a3-8732-3466-9876-a7cd32b208de
CurrentStorageAccountName : 

===============================================================

Switch subscription using Select-AzureRmSubscription:

WARNING: Unable to acquire token for tenant 'Common'

ERROR: Get-AzureRmSubscription : Subscription S01 was not found in tenant . Please verify that the subscription 
exists in this tenant.
At line:37 char:2
+  Get-AzureRmSubscription -SubscriptionName "S01" | Sele ...
+  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Get-AzureRmSubscription], PSArgumentException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.GetAzureRMSubscriptionCommand


===============================================================

Switch subscription using Set-AzureRmContext:

ERROR: Set-AzureRmContext : Provided subscription S01 does not exist
At line:41 char:2
+  Set-AzureRmContext -SubscriptionName "S01"
+  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Set-AzureRmContext], ArgumentException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.SetAzureRMContextCommand


===============================================================

我猜这一切都围绕着 AzureRunAsConnection 和 AzureRunAsCertificate 并使用 ServicePrincipal。我的猜测是我需要使用 S01 的 AzureRunAsConnect 登录，我认为这意味着我需要从 S01 中获取证书并进入 S02，但是我没有太多运气将 RunAsCertificate 从 S01 导出和导入到 S02。

我已经尝试创建自己的 AD 应用程序，但我似乎也无法让它工作。

我敢肯定它必须是可能的，但如何？我接近了吗，正确的方法是什么？

PS 两个订阅“共享”同一个 Azure AD。

TIA

4

1 回答 1

1

You can't export once assigned certificate to Service Principal. So you have two options:

  1. Create a new service principal with a certificate and use the same certificate for both subscriptions
  2. If you have a copy of existing service principal's certificate then use it to authenticate to your second Azure subscription.

No matter which approach you choose, you should take a look here for step by step description of creating service principal, certificate, etc.: https://docs.microsoft.com/en-us/azure/automation/automation-sec-configure-azure-runas-account#update-an-automation-account-using-powershell

于 2017-02-23T15:39:05.970 回答