azure - 从 AAD 获取 AppPrincipalId 的 OAuth 令牌时出错

Question

我正在通过模板部署（shell 脚本）使用服务主体使用 Data Lake Store 创建 HDInsight。

在我运行部署脚本时，在 Spark HDInsight 集群的初始集群创建后出现以下错误。

错误是：

At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-debug for usage details. {
  "status": "Failed",
  "error": {
    "code": "ResourceDeploymentFailure",
    "message": "The resource operation completed with terminal provisioning state 'Failed'.",
    "details": [
      {
        "code": "InvalidDocumentErrorCode",
        "message": "DeploymentDocument 'AmbariConfiguration_x_x' failed the validation. Error: 'Error while getting access to the datalake storage account hdiclusterdls: Error while getting the OAuth token from AAD for AppPrincipalId xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx, ResourceUri https://management.core.windows.net/, AADTenantId https://login.windows.net/xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx, ClientCertificateThumbprint xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx.'"
      }
    ]
  }
}  Correlation ID: xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx

我的猜测是 HDInsight 和使用服务主体身份验证的 Data Lake 存储集成之间存在一些问题。

任何帮助深表感谢。