微软通过备份认证提高Azure AD 可靠性，但效果有限

{"type":"doc","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":"近期，微软希望通过将Azure Active Directory (Azure AD)的“中断模式”扩展到 Web 和桌面应用程序来提高其云服务的弹性。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/advancing-service-resilience-in-azure-active-directory-with-its-backup-authentication-service","title":null,"type":null},"content":[{"type":"text","text":"据悉"}],"marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":"，备份服务在正常运行的情况下保存必要的认证数据。对于从Azure AD到应用的成功认证过程的数据，备份服务可以安全地存储这些数据三天。当Azure AD主服务出现故障时，备份身份验证服务自动启动，保证用户的应用程序继续运行。当主服务恢复时，身份验证请求将被重新切换到主Azure AD服务。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"image","attrs":{"src":"https:\/\/static001.infoq.cn\/resource\/image\/30\/a4\/30dee2aea48dfa736f066078d54711a4.png","alt":null,"title":"","style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":"","fromPaste":false,"pastePass":false}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":"center","origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":"Azure AD 备份工作原理"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":"Azure AD 是 Microsoft 推出的基于云的标识和访问管理服务，可帮助员工登录及访问以下位置的资源："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":"外部资源，例如 Microsoft Office 365、Azure 门户以及成千上万的其他 SaaS 应用程序。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":"内部资源，例如公司网络和 Intranet 上的应用，以及由自己的组织开发的任何云应用。"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":"使用 AzureActive Directory 组管理应用和资源访问。"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":"据悉，微软 Azure AD 月活跃用户（MAU）超过 4 亿，每天要处理的认证达百亿次。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":"微软称，自 2019 年以来，Outlook Web Access 和 SharePoint Online 一直在运行，但在去年 9 月发生的Azure AD中断期间，Outlook 和 SharePoint 都受到了影响。当时给出的原因是“最近的配置更改影响了后端存储层”。这种情况下，备份服务似乎是不够的。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":"微软一直在忙于提高Azure AD的可靠性。在过去的几个月里，微软通过认证服务转移到 “蜂窝化架构”、备份认证服务、与区域认证端点透明集成、持续投资服务可扩展性和弹性、正在推出认证系统创新等，提高 Azure AD 的可靠性。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":"今年 3 月，微软由于误删了一个支持Azure AD使用OpenID或其它加密签章标准协定的密钥，导致Azure AD服务中断。微软当时引用了备份服务，但表示该服务并没有提供帮助。“它提供了令牌发布的覆盖范围，但没有提供令牌验证的覆盖范围，而故障来源于受影响的元数据端点。”"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":"因此，备份服务的扩展显然不会解决所有可能影响 Azure AD 的问题，即使它是有益的。今年 8 月，Gartner 分析师"},{"type":"link","attrs":{"href":"https:\/\/www.theregister.com\/2021\/08\/03\/gartner_verdict_on_public_cloud\/","title":null,"type":null},"content":[{"type":"text","text":"报告称"}],"marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":"，尽管 Azure 的性能从绝对意义上讲并不差，但客户“仍然担心 Azure 可靠性对现实世界的影响”。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#494949","name":"user"}}],"text":" "}]}]}