使用 rbac 服務主體進行身份驗證會導致 403 訪問群體驗證失敗。受眾不匹配我正在嘗試向應用程序授予對 Blob 存儲容器的訪問權限，但具有所需的最低權限（讀取/寫入）使用 azure cli，我已完成以下步驟來嘗試此操作：az group create -l ${LOCATION} -n ${RESOURCE_GROUP_NAME}az role definition create --role-definition rw-blob-role.jsonrw-blob-role.json:{  "assignableScopes": [    "/subscriptions/{{SUBSCRIPTION_ID}}"  ],  "description": "Custom role to allow for read and write access to Azure Storage blob containers and data",  "name": "{{APP_RW_ROLE_NAME}}",  "permissions": [    {      "actions": [        "Microsoft.Storage/storageAccounts/blobServices/containers/read",        "Microsoft.Storage/storageAccounts/blobServices/containers/write"      ],      "dataActions": [        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"      ],      "notActions": [],      "notDataActions": []    }  ],  "type": "Microsoft.Authorization/roleDefinitions"}az ad sp create-for-rbac --name ${AZ_SERVICE_PRINCIPAL_NAME} --password ${APP_CLIENT_SECRET}az role assignment delete --assignee ${AZ_SERVICE_PRINCIPAL_NAME} --role Contributoraz role assignment create --assignee ${AZ_SERVICE_PRINCIPAL_NAME} --role ${APP_RW_ROLE_NAME}az storage account create --name ${STORAGE_ACCOUNT_NAME} --resource-group ${RESOURCE_GROUP_NAME} --location ${LOCATION} --kind BlobStorage --sku ${STORAGE_ACCOUNT_SKU} --access-tier ${STORAGE_ACCOUNT_ACCESS_TIER}az storage container create --name ${BLOB_STORAGE_CONTAINER} --account-name ${STORAGE_ACCOUNT_NAME} --public-access off從這里我保存以下屬性以供我的應用程序使用：- TENANT_ID=“$（az account show --output tsv --query tenantId）”- CLIENT_ID=“$（az ad sp sp list --spn ${AZ_SERVICE_PRINCIPAL_NAME} --output tsv --query [0].appId）”- 客戶端機密： ${APP_CLIENT_SECRET}- 資源： ${AZ_SERVICE_PRINCIPAL_NAME}- 存儲帳戶名稱： ${STORAGE_ACCOUNT_NAME}- 容器名稱： ${BLOB_STORAGE_CONTAINER}我很確定問題是AZ_SERVICE_PRINCIPAL_NAME傳遞給收購Token（）上的adal4j，但我不知道正確的值是什么。我已嘗試在租戶 AD 和服務主體上使用CLIENT_ID和其他屬性。