Asp mvc User Login using Azure

Question

I have created a sample project and have Azure server to maintain resources and security at same time. In my ASP web application i want to create Login system and i want it to protect using Azure security vault. Basically i want to store them in Azure vault. I have gone through understand of keys and secrets and Azure AD authentication using SDK in my web application but i am not getting understanding about making use of Keys/ Secret for User ID and Password that can help user to login into my application.

Should i save username or password of a user inside keyvault. If i am doing it then what is the purpose of getting these values because they are simply accessible through URL.

I tried looking for various examples but they were all using OWIN authentication using Social networking website but in my case I will be no social network login.

Looking for help to understand where how can i use of Azure key vault's Key/Secret in the context of securing user's login credentials. Any hint would be helpful.

Ref : Key Vault REST APIs https://docs.microsoft.com/en-us/rest/api/keyvault/

Answer 1

Do not store user credentials in Key Vault. That is not its purpose.

If you store passwords, you need to store them in a database after hashing them securely. Lot of emphasis on securely. There should never be a way for you to recover a user's password.

Answer 2

If you are trying to keep the user information inside azure and use it in your application, what is need is Azure Active Directory. You can have a look at the examples on how to implement AD in mvc project.

You use Azure Key Vault for the secrets that your program need or some secrets that you want to give access to a set or users. You don's use Azure key vault to store general user and password information. Hope this helps.