问题描述
为Azure App Service添加访问限制，需要Python Azure SDK来实现的示例代码。
问题解答
查阅Azure App Service的官方资料，使用Python SDK有 azure-mgmt-web 包中的 WebSiteManagementClient 类可以对Azure App Service资源进行管理。
Access Restrictions属于App Service的配置项，所以可以通过 client类中的 web_apps.get_configuration 获取，及通过 web_apps.create_or_update_configuration 进行创建或修改。
get_configuration 方法的返回数据类型为 SiteConfig，其中包含了 ip_security_restrictions 属性值。而且它是一个List类型，其数据结构类型为 IpSecurityRestriction。
综上所述，通过Python SDK获取App Service的Access Restrictions的示例代码如下：
import os
from azure.identity import ClientSecretCredential, AzureAuthorityHosts
from msrestazure.azure_cloud import AZURE_CHINA_CLOUD
from azure.mgmt.web import WebSiteManagementClient
subscription_id = os.environ['AZURE_SUBSCRIPTION_ID']
myapp_base_url = "https://management.chinacloudapi.cn"
credentials = ClientSecretCredential(
client_id=os.environ['AZURE_CLIENT_ID'],
client_secret=os.environ['AZURE_CLIENT_SECRET'],
tenant_id=os.environ['AZURE_TENANT_ID'],
authority=AzureAuthorityHosts.AZURE_CHINA
)
def print_item(group):
"""Print some properties of an Azure model."""
print("\tName: {}".format(group.name))
print("\tId: {}".format(group.id))
print("\tLocation: {}".format(group.location))
print("\tTags: {}".format(group.tags))
if hasattr(group, 'status'):
print("\tStatus: {}".format(group.status))
if hasattr(group, 'state'): # Site
print("\tStatus: {}".format(group.state))
if hasattr(group, 'properties'):
print_properties(group.properties)
print("\n\n")
def print_properties(props):
"""Print some properties of a Site."""
if props and props.provisioning_state:
print("\tProperties:")
print("\t\tProvisioning State: {}".format(props.provisioning_state))
def print_ipsecurityrestrictions(iprestrictions):
"""Print ip security restrictions of a Site."""
for restrits in iprestrictions:
print("\t for rule : {}".format(restrits.name))
print("\t\t name : {}".format(restrits.name))
print("\t\t ip_address : {}".format(restrits.ip_address))
print("\t\t subnet_mask : {}".format(restrits.subnet_mask))
print("\t\t action : {}".format(restrits.action))
print("\t\t vnet_subnet_resource_id : {}".format(restrits.vnet_subnet_resource_id))
print("\t\t vnet_traffic_tag : {}".format(restrits.vnet_traffic_tag))
print("\t\t subnet_traffic_tag : {}".format(restrits.subnet_traffic_tag))
print("\t\t tag : {}".format(restrits.tag))
print("\t\t priority : {}".format(restrits.priority))
print("\t\t description : {}".format(restrits.description))
print("\n\n")
web_client = WebSiteManagementClient(credentials, subscription_id, base_url=myapp_base_url, credential_scopes=[
AZURE_CHINA_CLOUD.endpoints.management + "/.default"])
resource_group_name = "app-rg"
for site in web_client.web_apps.list_by_resource_group(resource_group_name):
print_item(site)
print("\n\n")
print("\nStart to get web app configs")
site_name = "testwebapp04"
configs = web_client.web_apps.get_configuration(resource_group_name, site_name)
print_ipsecurityrestrictions(configs.ip_security_restrictions)
#web_client.web_apps.create_or_update_configuration()
执行结果为：
附录一： 调试Ptyhon代码时，遇上了奇怪的AAD错误 azure.core.exceptions.ClientAuthenticationError: Authentication failed: AADSTS70011: The provided request must include a 'scope' input parameter. The provided value for the input parameter 'scope' is not valid. The scope . . . / / / : a a a a a c c c d d e e e f g h h i i l l m m n n n n o p p s t t t t u u is not valid.
最后通过换一台执行代码的虚拟机后，同样的代码没有报错。所以最终定位到是本机环境中，给中azure identity 的包不一致导致。通过 pip -m list出两个环境不一样的module版本后，再本地重新安装azure identity 和 azure core 两个包后，问题消失！
azure-identity == 1.11.0
azure-core == 1.24.2 #1.25.1
参考资料
Manage Azure websites with Python : https://github.com/Azure-Samples/app-service-web-python-manage
当在复杂的环境中面临问题，格物之道需：浊而静之徐清，安以动之徐生。 云中，恰是如此!
分类: 【Azure 应用服务】, 【Azure Developer】
标签: Authentication failed: AADSTS70011, must include a 'scope' input parameter, the input parameter 'scope' is not valid, . . . / / / : a a a a a c c c d d e e e f g h h, i i l l m m n n n n o p p s t t t t u u
