小编点评

## Solution to Azure.Identity.AuthenticationFailedException in .NET Media Service Code The issue arises because the DefaultAzureCredential and ArmClient methods by default use Global Azure (east US) by default. This causes the exception because the Media Services Account resource is located in the China Azure region. Here's how to fix it: **1. Specify China Region:** * Get the subscription ID and resource group from the environment variables. * Create a `DefaultAzureCredentialOptions` object with `AuthorityHost` set to `AzureChina`. * Use the `DefaultAzureCredential` constructor with the options to create the `DefaultAzureCredential`. **2. Specify China Region for ArmClient:** * Create an `ArmClientOptions` object with `Environment` set to `ArmEnvironment.AzureChina`. * Use the `ArmClient` constructor with the credential and options to create the `ArmClient`. **3. Update Code with Specifics:** ```csharp var mediaServicesResourceId = MediaServicesAccountResource.CreateResourceIdentifier( subscriptionId: options.AZURE_SUBSCRIPTION_ID.ToString(), resourceGroupName: options.AZURE_RESOURCE_GROUP, accountName: options.AZURE_MEDIA_SERVICES_ACCOUNT_NAME); // Define options for DefaultAzureCredential var dacOptions = new DefaultAzureCredentialOptions() { AuthorityHost = AzureAuthorityHosts.AzureChina }; // Create DefaultAzureCredential with region specific options var credential = new DefaultAzureCredential(dacOptions); // Define options for ArmClient var armOptions = new ArmClientOptions() { Environment = ArmEnvironment.AzureChina }; // Create ArmClient with credential and region specific options var armClient = new ArmClient(credential, options.AZURE_SUBSCRIPTION_ID.ToString(), armOptions); // Use armClient to access Media Services Account var mediaServicesAccount = armClient.GetMediaServicesAccountResource(mediaServicesResourceId); ``` **Additional Notes:** * Remember to set the `AZURE_CLIENT_IDAZURE_TENANT_IDAZURE_CLIENT_SECRET` environment variables before running the application. * This solution assumes you have the correct subscription ID, resource group, and media services account name.

正文

问题描述

在中国区Azure上，使用Media Service服务，想要使用.NET的代码来对上传视频创建缩略图(Thumbnail) 。

通过官网文档(https://docs.azure.cn/zh-cn/media-services/latest/samples/samples-encoding-reference#create-a-thumbnail-sprite)下载.NET示例，配置 appsettings.json 中的参数，运行却出现（Azure.Identity.AuthenticationFailedException: 'ClientSecretCredential authentication failed: AADSTS90002: ）异常。

Azure.Identity.AuthenticationFailedException: 'ClientSecretCredential authentication failed: AADSTS90002: Tenant '********-****-****-****-************' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. Check with your subscription administrator, this may happen if there are no active subscriptions for the tenant.

Trace ID: 99b963f7-86a5-4cde-a890-8828eff73000

Correlation ID: 62d4fa3b-92ad-4411-850c-87f562a256b3

Timestamp: 2023-05-10 07:25:55Z'

问题解答

查看.NET项目中的源码，发现获取Credential的代码使用的是 DefaultAzureCredential()。并且 ArmClient 对象也没有指定Azure的运行环境。

默认情况下，它们都是指向Global Azure，而非China Azure。

所以，解决当前问题的方法就是在DefaultAzureCredential和ArmClient方法中指定中国区Azure为运行环境。

修改这部分代码为为:

注意：使用 DefaultAzureCredential 认证，需要设置以下的环境变量

1. AZURE_CLIENT_ID
2. AZURE_TENANT_ID
3. AZURE_CLIENT_SECRET

变量说明： https://learn.microsoft.com/en-us/dotnet/api/overview/azure/identity-readme?view=azure-dotnet#environment-variables

关于DefaultAzureCredential方法获取认证参数的顺序，如下图所示：

参考资料

DefaultAzureCredential ： https://learn.microsoft.com/en-us/dotnet/api/overview/azure/identity-readme?view=azure-dotnet#defaultazurecredential