Acquire Azure Key Vault Secret Using Integrated Security

Question

All the examples I see about obtaining an access token with which to access the Azure Key Vault involve using a ClientId and ClientSecret to request a token for the well known https://vault.azure.net resource.

This works fine...but I want to be able to use integrated security to obtain an access token which which to access the key vault.

For example, I have

const string VaultResource = "https://vault.azure.net";
var context = new AuthenticationContext(myTenantAuthority, false);

// using integrated auth
var token1 = await context.AcquireTokenAsync(VaultResource, nativeAppClientId, new UserCredential());

// OR interactive
var token2 = context.AcquireToken(VaultResource, nativeAppClientId, new Uri("https://localhost"), 
     PromptBehavior.Auto, new UserIdentifier(UserPrincipal.Current.UserPrincipalName, UserIdentifierType.RequiredDisplayableId));

Both of these attempts fail. The first one says

Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException occurred
  ErrorCode=invalid_grant
  HResult=-2146233088
  Message=AADSTS65001: The user or administrator has not consented to use the application with ID '306d0ff4-0f32-4c38-bdb9-4ea500000000'. Send an interactive authorization request for this user and resource.
Trace ID: 2ca2fb3f-3931-4868-b176-700f29158a3a
Correlation ID: 39875bc5-cb1c-4a62-925d-7448d8716f30
Timestamp: 2016-02-23 08:51:45Z
  Source=Microsoft.IdentityModel.Clients.ActiveDirectory
  StatusCode=400
  StackTrace:
       at Microsoft.IdentityModel.Clients.ActiveDirectory.HttpHelper.<SendPostRequestAndDeserializeJsonResponseAsync>d__0`1.MoveNext()
    --- End of stack trace from previous location where exception was thrown ---
       at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
       at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
       at Microsoft.IdentityModel.Clients.ActiveDirectory.AcquireTokenHandlerBase.<SendHttpMessageAsync>d__15.MoveNext()
    --- End of stack trace from previous location where exception was thrown ---
       at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
       at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

And the second:

Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException occurred
  ErrorCode=access_denied
  HResult=-2146233088
  Message=AADSTS65005: The client application has requested access to resource 'https://vault.azure.net'. This request has failed because the client has not specified this resource in its requiredResourceAccess list.
Trace ID: 5652658c-54bf-4880-bcc8-dea822a4b10b
Correlation ID: 1f97c7c0-858f-4542-9936-4a5114a93cc0
Timestamp: 2016-02-23 08:36:17Z
  Source=Microsoft.IdentityModel.Clients.ActiveDirectory
  StatusCode=0
  StackTrace:
       at Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext.RunAsyncTask[T](Task`1 task)

How do I update the requiredResourceAccessList?

UPDATE: Here is how the application is configured

You might be interested in this: stackoverflow.com/questions/30096576/… — fernacolo

charisk charisk · Accepted Answer · 2016-02-23T11:04:19

You may need to set delegated permissions. Have a look here https://azure.microsoft.com/en-gb/documentation/articles/active-directory-integrating-applications/

Also, you might want to consider authenticating using a certificate. See A more secure way to use key vault

Acquire Azure Key Vault Secret Using Integrated Security

1 Answers