什么是 Azure Identity Python？

Azure Identity SDK for Python 为开发人员提供了一种简化的方法来处理 Microsoft Entra ID（原 Azure AD）的身份验证。通过在 Openclaw Skills 中利用此库，开发人员可以消除硬编码凭据，并实现安全的、基于令牌的身份架构。它旨在通过其复杂的凭据链系统自动发现最佳可用身份验证方法，从而在本地开发、CI/CD 环境和生产云托管中无缝工作。

无论您是在构建自动化脚本还是复杂的云应用程序，此技能都能确保您的 Python 代码保持可移植性且安全。它处理令牌获取、缓存和生命周期管理的复杂性，让您能够专注于构建功能而不是管理安全协议。

下载入口:https://github.com/openclaw/skills/tree/main/skills/thegovind/azure-identity-py

安装与下载

1. ClawHub CLI

从源直接安装技能的最快方式。

2. 手动安装

将技能文件夹复制到以下位置之一

优先级：工作区 > 本地 > 内置

3. 提示词安装

将此提示词复制到 OpenClaw 即可自动安装。

Azure Identity Python 应用场景

• 使用 DefaultAzureCredential 实现无缝的从本地到云端的转换，自动从 CLI 登录切换到托管标识。
• 使用服务主体和基于环境的机密来保护自动化工作流和 CI/CD 流水线。
• 通过系统分配或用户分配的托管标识，为 Azure Functions、虚拟机和应用服务启用无密码身份验证。
• 将 Openclaw Skills 与 Azure Key Vault 或存储账户集成，以执行安全的数据处理任务。
• 使用设备代码或客户端机密流管理 SSH 或容器化环境的无头身份验证。

1. 开发人员实例化一个凭据类，最常用的是 DefaultAzureCredential，它充当主要的身份提供者。
2. 该库尝试通过遍历优先级链方法进行身份验证，从环境变量开始，依次经过托管标识、VS Code 和 Azure CLI。
3. 在找到有效身份后，该库会为特定的资源范围（如存储、管理或数据库）请求 OAuth2 访问令牌。
4. 获取的令牌会在内部缓存，并在过期前自动刷新，以保持服务访问不中断。
5. 凭据对象被传递到其他 Azure SDK 客户端构造函数中，这些构造函数随后使用托管令牌对发往 Azure 服务的每个 API 请求进行授权。

Azure Identity Python 配置指南

要开始使用此库，请通过 pip 安装包：

pip install azure-identity

对于本地开发或服务主体身份验证，请按如下方式配置环境变量：

# 标准服务主体配置
export AZURE_TENANT_ID=""
export AZURE_CLIENT_ID=""
export AZURE_CLIENT_SECRET=""

# 可选：用户分配的托管标识客户端 ID
export AZURE_CLIENT_ID=""

Azure Identity Python 数据架构与分类体系

该库通过凭据类型和元数据参数的层次结构来组织身份验证：

所有利用此库的 Openclaw Skills 都遵循标准的 Azure SDK for Python 元数据分类，以确保跨不同云服务的兼容性。

name: azure-identity-py
description: |
  Azure Identity SDK for Python authentication. Use for DefaultAzureCredential, managed identity, service principals, and token caching.
  Triggers: "azure-identity", "DefaultAzureCredential", "authentication", "managed identity", "service principal", "credential".
package: azure-identity

Azure Identity SDK for Python

Authentication library for Azure SDK clients using Microsoft Entra ID (formerly Azure AD).

Installation

pip install azure-identity

Environment Variables

# Service Principal (for production/CI)
AZURE_TENANT_ID=
AZURE_CLIENT_ID=
AZURE_CLIENT_SECRET=

# User-assigned Managed Identity (optional)
AZURE_CLIENT_ID=

DefaultAzureCredential

The recommended credential for most scenarios. Tries multiple authentication methods in order:

from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient

# Works in local dev AND production without code changes
credential = DefaultAzureCredential()

client = BlobServiceClient(
    account_url="https://.blob.core.windows.net",
    credential=credential
)

Credential Chain Order

Customizing DefaultAzureCredential

# Exclude credentials you don't need
credential = DefaultAzureCredential(
    exclude_environment_credential=True,
    exclude_shared_token_cache_credential=True,
    managed_identity_client_id=""  # For user-assigned MI
)

# Enable interactive browser (disabled by default)
credential = DefaultAzureCredential(
    exclude_interactive_browser_credential=False
)

Specific Credential Types

ManagedIdentityCredential

For Azure-hosted resources (VMs, App Service, Functions, AKS):

from azure.identity import ManagedIdentityCredential

# System-assigned managed identity
credential = ManagedIdentityCredential()

# User-assigned managed identity
credential = ManagedIdentityCredential(
    client_id=""
)

ClientSecretCredential

For service principal with secret:

from azure.identity import ClientSecretCredential

credential = ClientSecretCredential(
    tenant_id=os.environ["AZURE_TENANT_ID"],
    client_id=os.environ["AZURE_CLIENT_ID"],
    client_secret=os.environ["AZURE_CLIENT_SECRET"]
)

AzureCliCredential

Uses the account from az login:

from azure.identity import AzureCliCredential

credential = AzureCliCredential()

ChainedTokenCredential

Custom credential chain:

from azure.identity import (
    ChainedTokenCredential,
    ManagedIdentityCredential,
    AzureCliCredential
)

# Try managed identity first, fall back to CLI
credential = ChainedTokenCredential(
    ManagedIdentityCredential(client_id=""),
    AzureCliCredential()
)

Credential Types Table

Getting Tokens Directly

from azure.identity import DefaultAzureCredential

credential = DefaultAzureCredential()

# Get token for a specific scope
token = credential.get_token("https://management.azure.com/.default")
print(f"Token expires: {token.expires_on}")

# For Azure Database for PostgreSQL
token = credential.get_token("https://ossrdbms-aad.database.windows.net/.default")

Async Client

from azure.identity.aio import DefaultAzureCredential
from azure.storage.blob.aio import BlobServiceClient

async def main():
    credential = DefaultAzureCredential()
    
    async with BlobServiceClient(
        account_url="https://.blob.core.windows.net",
        credential=credential
    ) as client:
        # ... async operations
        pass
    
    await credential.close()

Best Practices

1. Use DefaultAzureCredential for code that runs locally and in Azure
2. Never hardcode credentials — use environment variables or managed identity
3. Prefer managed identity in production Azure deployments
4. Use ChainedTokenCredential when you need a custom credential order
5. Close async credentials explicitly or use context managers
6. Set AZURE_CLIENT_ID for user-assigned managed identities
7. Exclude unused credentials to speed up authentication