Read secret stored in Key Vault from an App Service running a container

0
votes

I've created an App Service that is running a container running Identity Server. This container needs a certificate that I'm loading from Key Vault. To get the content of the certificate what I've done is:

In my first attempt, I was storing just the URI of the secret in the App Settings and try to get the value using the following code:

var azureServiceTokenProvider = new AzureServiceTokenProvider();
var keyVaultClient = new KeyVaultClient(
                    new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));

var cert = keyVaultClient
    .GetSecretAsync(
        Env.GetString("CERTIFICATE_KEY_VAULT_KEY"))
    .ConfigureAwait(false).GetAwaiter().GetResult();

identityServerBuilder.AddSigningCredential(new X509Certificate2(Convert.FromBase64String(cert.Value)));

This works if I deploy the code into a VM. But it doesn't if I deploy the code into an App Service running a container. So I decided to try another option which is to use the Key Vault reference thing. So, I've created a new App Settings like this:

CERTIFICATE_CONTENT = @Microsoft.KeyVault(SecretUri=https://mykeyvault.vault.azure.net/secrets/IdentityCert/5221036c6b734d5fa69cba29976a8592)

And then just use this value inside my code:

var certificateContent = Env.GetString("CERTIFICATE_CONTENT");

identityServerBuilder.AddSigningCredential(new X509Certificate2(Convert.FromBase64String(certificateContent)));

But this doesn't work either.

I've enabled the managed identity in the App Service and added it to the Access Policies in the Key Vault.

How can I get the value from Key Vault? Is there anything I'm missing?

1
azureazure-web-app-serviceazure-keyvault
What does "it doesn't work" mean? Are you getting an error? – Jason P
It means that the App Service doesn't go to Key Vault to get the value of the secret and it just returns the value of the App Settings (which is the reference to the Key Vault secret ). Anyway, it was my fault, I wasn't setting the access policy correctly. – vgaltes

1 Answers

0
votes

So, the error was the way I was adding the new access policy. I was selecting the principal Id and the Authorized application. It turns out that I only need to select the principal, leaving the Authorized application as "None selected".