如何使本地 IIS 使用不同的 Azure Active Directory 来访问资源

Question

Here's the situation: I have an account in the azure active directory of my company with several subscriptions. I am building an ASP.NET Framework application for a client. This application is going to be hosted in their own azure environment, so to set this up, they added my email address to their azure active directory. Now in the azure portal I can use the button "change active directory" to either view my company's resources or my client's.

I set up a keyvault in my client's azure environment and I added keyvault as connected service to my application using these instructions . My application is running locally in local IIS, so I set up the application pool to use my user account so it has access to my azure subscriptions.

The issue here is that I still get an error when I try to run the application. The ysod says that azure gives a 401 response when trying to access the keyvault. I see that it's trying to use the guid that is associated with my company's azure active directory (I don't know what the name of this guid is). Obviously, I can't access resources from my client's azure environment with my company's azure active directory. As an attempt to get more information, I built a small console application and used the same procedure to add keyvault as a connected service, since the internet says that the console application gives more details than the ASP.NET application. However, when I run my console application, I don't get any errors at all and I can access my client's keyvault just fine.

This makes me believe that there is some setting in my user account or IIS that I need to change to make this work, but I can't find what it is.

How can I make my ASP.NET Framework application, running locally in IIS, access a keyvault as connected service in my client's azure environment?

Answer 1

This should work, try to follow this to re-login your user account in VS and make sure you have modified your ASP.NET Framework project .

If it still not work, you could ask your client to create a work account for you in their Azure AD tenant and add it to the keyvault access policy, then use the account to login VS and test.