如何在.NET 7 Web Api中使用clientId和thumbprint对Azure Key Vault请求进行身份验证？

huangapple
go评论97阅读模式
英文:

How to authenticate Azure Key Vault request using clientId and thumbprint in .NET 7 Web Api?

问题

我可以帮你修改这个方法，以便使用 ClientId 和 Thumbprint 进行 Azure Key Vault 的身份验证。请查看下面的修改后的代码：

  1. public static IConfigurationBuilder AddAzureKeyVaultConfiguration(this IConfigurationBuilder configurationBuilder, IWebHostEnvironment hostingEnvironment)
  2. {
  3.     if (!hostingEnvironment.IsEnvironment("Localhost"))
  4.     {
  5.         var builtConfig = configurationBuilder.Build();
  6.         var keyVaultEndpoint = $"https://{builtConfig["KeyVaultConfigOption:Name"]}.vault.azure.net/";
  8.         var clientId = builtConfig["KeyVaultConfigOption:ClientId"];
  9.         var thumbprint = builtConfig["KeyVaultConfigOption:Thumbprint"];
  11.         var tokenCredential = new ClientCertificateCredential(clientId, thumbprint);
  13.         configurationBuilder.AddAzureKeyVault(
  14.             new Uri(keyVaultEndpoint),
  15.             tokenCredential
  16.         );
  17.     }
  19.     return configurationBuilder;
  20. }

在这个修改后的方法中，我使用了 ClientCertificateCredential 类来创建凭据，其中包括了 ClientId 和 Thumbprint。这将用于 Azure Key Vault 的身份验证。请确保在 appsettings.json 文件中设置了正确的 ClientId 和 Thumbprint 值。

希望这可以帮助你实现所需的修改。如果你有任何其他问题，请随时提问。

英文:

I have .NET 7 Web Api application where I m using the AddAzureKeyVault method to add Azure Key Vault configurations to my IConfigurationBuilder instance. Currently, I am using the DefaultAzureCredential for authentication.

However, I want to modify this method to authenticate the Key Vault request using clientId and thumbprint. I have access to these values and want to use them for authentication instead of the default credential types.

Here is my current code:

  1. public static IConfigurationBuilder AddAzureKeyVaultConfiguration(this IConfigurationBuilder configurationBuilder, IWebHostEnvironment hostingEnvironment)
  2. {
  3.     if (!hostingEnvironment.IsEnvironment("Localhost"))
  4.     {
  5.         var builtConfig = configurationBuilder.Build();
  6.         var keyVaultEndpoint = $"https://{builtConfig["KeyVaultConfigOption:Name"]}.vault.azure.net/";
  8.         configurationBuilder.AddAzureKeyVault(
  9.             new Uri(keyVaultEndpoint),
  10.             new DefaultAzureCredential(new DefaultAzureCredentialOptions
  11.             {
  12.                 ExcludeEnvironmentCredential = true,
  13.                 ExcludeInteractiveBrowserCredential = true,
  14.                 ExcludeAzurePowerShellCredential = true,
  15.                 ExcludeSharedTokenCacheCredential = true,
  16.                 ExcludeVisualStudioCodeCredential = true,
  17.                 ExcludeVisualStudioCredential = true,
  18.                 ExcludeAzureCliCredential = false,
  19.                 ExcludeManagedIdentityCredential = false,
  20.             })
  22.             );
  23.     }
  25.     return configurationBuilder;
  26. }

}

Program.cs

  1. var builder = WebApplication.CreateBuilder(args);
  2. {
  3.     // Environment configuration
  4.     var configuration = builder.Configuration;
  5.     var env = builder.Environment;
  7.     configuration.AddAppConfiguration(env);
  9.     // Add azure key vault configuration
  10.     builder.Configuration.AddAzureKeyVaultConfiguration(env);
  12.     builder.Services.AddMediatR(cfg => cfg.RegisterServicesFromAssemblyContaining<Program>());
  13.     builder.Services.AddHttpClient();
  15.     builder.Services.AddApplication();
  16.     builder.Services.AddInfrastructure(builder.Configuration);
  18.     builder.Services.AddHelpers();
  20.     builder.Services.AddControllers()
  21.        // Configures the JSON serialization options for controllers.
  22.        .AddJsonOptions(options =>
  23.         {
  24.             options.JsonSerializerOptions.PropertyNamingPolicy = null;
  25.         });
  27.     builder.Services.Configure<ApiBehaviorOptions>(options =>
  28.     {
  29.         options.SuppressModelStateInvalidFilter = true;
  30.     });
  32. }
  34. var app = builder.Build();
  35. {
  36.     app.UseHttpsRedirection();
  38.     // Authentication & Authorization
  39.     app.UseAuthentication();
  40.     app.UseAuthorization();
  41.     app.MapControllers();
  43.     app.UseRouting();
  44.     app.UseSwaggerWithVersioning();
  45. }
  47. if (app.Environment.IsDevelopment())
  48. {
  49.     //DEV configurations
  50. }
  52. app.Run();

appsettings.json

  1.  "KeyVaultConfigOption": {
  2.     "Name": "{KeyValultName}",
  3.     "Url": "https://{KeyVaultName}.vault.azure.net",
  4.     "Thumbprint": "",
  5.     "ClientId": ""
  6.   }

How can I modify this method to authenticate the Azure Key Vault request using ClientId and Thumbprint?

答案1

得分: 1

你可以使用 ClientCertificateCredential 与 X509Certificate2 对象。

首先，使用指纹来从 X509Store 中查找所需的证书。

英文:

You can use the ClientCertificateCredential along with the X509Certificate2 object.

To first fetch the certificate required, use the thumbprint to find the certificate from the X509Store.

答案2

得分: 0

如Pramod在先前的回答中建议的，我做出了相应的更改，现在我能够使用证书对密钥保管库请求进行身份验证。

  1. public static IConfigurationBuilder AddAzureKeyVaultConfiguration(this IConfigurationBuilder configurationBuilder, IWebHostEnvironment hostingEnvironment)
  2. {
  3.     if (!hostingEnvironment.IsEnvironment("Development"))
  4.     {
  5.         var builtConfig = configurationBuilder.Build();
  6.         var keyVaultEndpoint = $"https://{builtConfig["KeyVaultConfigOption:Name"]}.vault.azure.net/";
  8.         var clientId = builtConfig["KeyVaultConfigOption:ClientId"];
  9.         var thumbprint = builtConfig["KeyVaultConfigOption:Thumbprint"];
  10.         var tenantId = builtConfig["KeyVaultConfigOption:TenantId"];
  12.         var certificate = GetCertificate(thumbprint);
  14.         var clientCertificateCredential = new ClientCertificateCredential(tenantId, clientId, certificate);
  16.         configurationBuilder.AddAzureKeyVault(new Uri(keyVaultEndpoint), clientCertificateCredential);
  18.         var keyVaultClient = new SecretClient(new Uri(keyVaultEndpoint), clientCertificateCredential);
  20.         Task.Run(() => LoadKeysFromKeyVault(configurationBuilder, keyVaultClient)).Wait();
  21.     }
  23.     return configurationBuilder;
  24. }
  28. private static X509Certificate2 GetCertificate(string thumbprint)
  29. {
  30.     var store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
  32.     store.Open(OpenFlags.ReadOnly);
  34.     var cert = store.Certificates.OfType<X509Certificate2>()
  35.         .FirstOrDefault(x => x.Thumbprint == thumbprint);
  36.     store.Close();
  38.     if (cert == null)
  39.         throw new InvalidOperationException($"Failed to find the certificate for thumbprint:{thumbprint}");
  41.     return cert;
  42. }
  44. private static async Task LoadKeysFromKeyVault(IConfigurationBuilder configurationBuilder, SecretClient keyVaultClient)
  45. {
  46.     var serviceBusConfig = configurationBuilder.Build().GetSection(ServiceBusConfigOption.SectionName).Get<ServiceBusConfigOption>();
  48.     var propertiesToLoad = new Dictionary<string, string>
  49.     {
  50.         { $"{ServiceBusConfigOption.SectionName}:{nameof(serviceBusConfig.ConnectionString)}", serviceBusConfig.ConnectionString },
  52.     };
  54.     foreach (var kvp in propertiesToLoad)
  55.     {
  56.         var configurationKey = kvp.Key;
  57.         var secretName = kvp.Value;
  59.         var secret = await keyVaultClient.GetSecretAsync(secretName);
  61.         // Modify the configuration to replace the key value
  62.         configurationBuilder.Sources.RemoveAt(configurationBuilder.Sources.Count - 1); // Remove the Key Vault source
  63.         configurationBuilder.AddInMemoryCollection(new Dictionary<string, string>
  64.         {
  65.             { configurationKey, secret.Value.Value }
  66.         });
  67.     }
  68. }
英文:

As Pramod suggested in the previous answer, I made the following changes accordingly and now I am able to authenticate key vault request with certificates.

  1. public static IConfigurationBuilder AddAzureKeyVaultConfiguration(this IConfigurationBuilder configurationBuilder, IWebHostEnvironment hostingEnvironment)
  2.         {
  3.             if (!hostingEnvironment.IsEnvironment(&quot;Development&quot;))
  4.             {
  5.                 var builtConfig = configurationBuilder.Build();
  6.                 var keyVaultEndpoint = $&quot;https://{builtConfig[&quot;KeyVaultConfigOption:Name&quot;]}.vault.azure.net/&quot;;
  8.                 var clientId = builtConfig[&quot;KeyVaultConfigOption:ClientId&quot;];
  9.                 var thumbprint = builtConfig[&quot;KeyVaultConfigOption:Thumbprint&quot;];
  10.                 var tenantId = builtConfig[&quot;KeyVaultConfigOption:TenantId&quot;];
  12.                 var certificate = GetCertificate(thumbprint);
  14.                 var clientCertificateCredential = new ClientCertificateCredential(tenantId, clientId, certificate);
  17.                 configurationBuilder.AddAzureKeyVault(new Uri(keyVaultEndpoint), clientCertificateCredential);
  19.                 var keyVaultClient = new SecretClient(new Uri(keyVaultEndpoint), clientCertificateCredential);
  21.                 Task.Run(() =&gt; LoadKeysFromKeyVault(configurationBuilder, keyVaultClient)).Wait();
  22.             }
  24.             return configurationBuilder;
  25.         }
  29.         private static X509Certificate2 GetCertificate(string thumbprint)
  30.         {
  31.             var store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
  33.             store.Open(OpenFlags.ReadOnly);
  35.             var cert = store.Certificates.OfType&lt;X509Certificate2&gt;()
  36.                 .FirstOrDefault(x =&gt; x.Thumbprint == thumbprint);
  37.             store.Close();
  39.             if (cert == null)
  40.                 throw new InvalidOperationException($&quot;Failed to find the certificate for thumbprint:{thumbprint}&quot;);
  42.             return cert;
  43.         }
  45.         private static async Task LoadKeysFromKeyVault(IConfigurationBuilder configurationBuilder, SecretClient keyVaultClient)
  46.         {
  47.             var serviceBusConfig = configurationBuilder.Build().GetSection(ServiceBusConfigOption.SectionName).Get&lt;ServiceBusConfigOption&gt;();
  49.             var propertiesToLoad = new Dictionary&lt;string, string&gt;
  50.             {
  51.                 { $&quot;{ServiceBusConfigOption.SectionName}:{nameof(serviceBusConfig.ConnectionString)}&quot;, serviceBusConfig.ConnectionString },
  53.             };
  55.             foreach (var kvp in propertiesToLoad)
  56.             {
  57.                 var configurationKey = kvp.Key;
  58.                 var secretName = kvp.Value;
  60.                 var secret = await keyVaultClient.GetSecretAsync(secretName);
  62.                 // Modify the configuration to replace the key value
  63.                 configurationBuilder.Sources.RemoveAt(configurationBuilder.Sources.Count - 1); // Remove the Key Vault source
  64.                 configurationBuilder.AddInMemoryCollection(new Dictionary&lt;string, string&gt;
  65.                 {
  66.                     { configurationKey, secret.Value.Value }
  67.                 });
  68.             }
  69.         }

huangapple
  • 本文由 发表于 2023年6月1日 14:58:28
  • 转载请务必保留本文链接：https://go.coder-hub.com/76379386.html
  • .net-7.0
  • asp.net-web-api
  • azure-keyvault
  • c#
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定