
关于
使用各种凭据类型向 Azure 服务进行身份验证。
name: azure-identity-ts description: "使用各种凭据类型对Azure服务进行身份验证。" risk: unknown source: community date_added: "2026-02-27"
Azure Identity SDK for TypeScript
使用各种凭据类型对Azure服务进行身份验证。
安装
npm install @azure/identity
环境变量
服务主体(密钥)
AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_CLIENT_SECRET=<client-secret>
服务主体(证书)
AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_CLIENT_CERTIFICATE_PATH=/path/to/cert.pem
AZURE_CLIENT_CERTIFICATE_PASSWORD=<optional-password>
工作负载标识(Kubernetes)
AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/tokens/azure-identity
DefaultAzureCredential(推荐)
import { DefaultAzureCredential } from "@azure/identity";
const credential = new DefaultAzureCredential();
// Use with any Azure SDK client
import { BlobServiceClient } from "@azure/storage-blob";
const blobClient = new BlobServiceClient(
"https://<account>.blob.core.windows.net",
credential
);
凭据链顺序:
- EnvironmentCredential
- WorkloadIdentityCredential
- ManagedIdentityCredential
- VisualStudioCodeCredential
- AzureCliCredential
- AzurePowerShellCredential
- AzureDeveloperCliCredential
托管标识
系统分配
import { ManagedIdentityCredential } from "@azure/identity";
const credential = new ManagedIdentityCredential();
用户分配(按客户端ID)
const credential = new ManagedIdentityCredential({
clientId: "<user-assigned-client-id>"
});
用户分配(按资源ID)
const credential = new ManagedIdentityCredential({
resourceId: "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<name>"
});
服务主体
客户端密钥
import { ClientSecretCredential } from "@azure/identity";
const credential = new ClientSecretCredential(
"<tenant-id>",
"<client-id>",
"<client-secret>"
);
客户端证书
import { ClientCertificateCredential } from "@azure/identity";
const credential = new ClientCertificateCredential(
"<tenant-id>",
"<client-id>",
{ certificatePath: "/path/to/cert.pem" }
);
// With password
const credentialWithPwd = new ClientCertificateCredential(
"<tenant-id>",
"<client-id>",
{
certificatePath: "/path/to/cert.pem",
certificatePassword: "<password>"
}
);
交互式认证
基于浏览器的登录
import { InteractiveBrowserCredential } from "@azure/identity";
const credential = new InteractiveBrowserCredential({
clientId: "<client-id>",
tenantId: "<tenant-id>",
loginHint: "user@example.com"
});
设备代码流
import { DeviceCodeCredential } from "@azure/identity";
const credential = new DeviceCodeCredential({
clientId: "<client-id>",
tenantId: "<tenant-id>",
userPromptCallback: (info) => {
console.log(info.message);
// "To sign in, use a web browser to open..."
}
});
自定义凭据链
import {
ChainedTokenCredential,
ManagedIdentityCredential,
AzureCliCredential
} from "@azure/identity";
// Try managed identity first, fall back to CLI
const credential = new ChainedTokenCredential(
new ManagedIdentityCredential(),
new AzureCliCredential()
);
开发者凭据
Azure CLI
import { AzureCliCredential } from "@azure/identity";
const credential = new AzureCliCredential();
// Uses: az login
Azure Developer CLI
import { AzureDeveloperCliCredential } from "@azure/identity";
const credential = new AzureDeveloperCliCredential();
// Uses: azd auth login
Azure PowerShell
import { AzurePowerShellCredential } from "@azure/identity";
const credential = new AzurePowerShellCredential();
// Uses: Connect-AzAccount
主权云
import { ClientSecretCredential, AzureAuthorityHosts } from "@azure/identity";
// Azure Government
const credential = new ClientSecretCredential(
"<tenant>", "<client>", "<secret>",
{ authorityHost: AzureAuthorityHosts.AzureGovernment }
);
// Azure China
const credentialChina = new ClientSecretCredential(
"<tenant>", "<client>", "<secret>",
{ authorityHost: AzureAuthorityHosts.AzureChina }
);
Bearer Token提供者
import { DefaultAzureCredential, getBearerTokenProvider } from "@azure/identity";
const credential = new DefaultAzureCredential();
// Create a function that returns tokens
const getAccessToken = getBearerTokenProvider(
credential,
"https://cognitiveservices.azure.com/.default"
);
// Use with APIs that need bearer tokens
const token = await getAccessToken();
最佳实践
- 生产环境使用托管标识——无需管理密钥
- 开发环境使用 DefaultAzureCredential——自动选择最佳凭据
- CI/CD使用服务主体配合环境变量
- Kubernetes使用工作负载标识实现无密钥认证
- 始终使用最小权限原则分配角色
- 定期轮换客户端密钥和证书
兼容工具
Claude CodeCursor
标签
运维部署

