Accessing Azure Key Vault from ASP.NET Core application hosted in Azure Service Fabric

Question

In my current ASP.NET Core project I'm using Azure Active Directory authentication with X509Certificate to access Key Vault. Certificate needs to be installed on a machine to allow application to access it and finally read values from Key Vault. Right now I'm working on migrating this application to Azure Service Fabric. I've uploaded the certificate to Key Vault, modified ARM template by adding:

"osProfile": {
    "secrets": [
        {
          "sourceVault": {
            "id": "{KeyVaultIdHere}"
          },
          "vaultCertificates": [
            {
              "certificateUrl": "{CertificateUrlHere}",
              "certificateStore": "My"
            }
          ]
        }
      ]
},

But when I deploy my application to Azure Service Fabric it seems like it doesn't have access to the certificate. Do I understand correctly that when I create cluster with such ARM template, certificate is being installed in LocalMachine\My Store? If yes, is it possible, that os user under which application is running doesn't have access to the private key of the ceritficate? When I was running cluster on my local computer I had to give special permission to ASF local cluster user to read private key. Maybe the same needs to be done for ASF on Azure? How can do it? Thanks in advance.

I've remoted to virtual machine from ASF cluster and it turned out that there are missing private key permissions on this certificate. But I can't manually set it, as "Administrators" have only "read" permission on this certificate. For this reason I will try to modify ARM template so it "unblocks" private key for NETWORK_SERVICE under which ASF cluster is running. — Adam Sobaniec
ACLing for NETWORK_SERVICE should already be done automatically when provisioning certs. What's your code like for accessing KeyVault? Perhaps your methods are defaulting to look in cert:\currentuser\my, which of course is not correct for SF! — Mardoxx
My methods are looking at localmachine/my store for sure. It works fine when I run ASF local cluster. Interesting is, what you mentioned, that NETWORK_SERVICE should have access to private key for such certificate installed using ARM template. Apparently, it doesn't. Only System has full access to it. There is also Administrators group mentioned, but only Read permission is there. — Adam Sobaniec

Adam Sobaniec Adam Sobaniec · Accepted Answer · 2017-04-27T15:23:58

Ok, so the solution was to modify ARM template in such way that it gives access to certificate private key for NETWORK SERVICE user. To do this, one need to write proper powershell (like here: https://social.technet.microsoft.com/Forums/windowsserver/en-US/1557e379-26a8-46d0-bf26-d32176395085/how-to-grant-permission-to-private-key-from-powershell?forum=winserverpowershell) and attach CustomScriptExtension in ARM template (virtualMachineProfile/extensionProfile/extensions). It can be done only during ARM deployment, because for some reason Administrators have only Read access on a certificate installed via ARM template.

Accessing Azure Key Vault from ASP.NET Core application hosted in Azure Service Fabric

2 Answers