How get Azure KeyVault secret for C# IIS application running on premise

Question

Is there any way to get a key vault secret using the IIS app pool identity to authenticate?

The typical solution for reading values from Azure KeyVault is

AzureServiceTokenProvider azureServiceTokenProvider = new AzureServiceTokenProvider();
keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
result = await keyVaultClient.GetSecretAsync(secretUrl).ConfigureAwait(false);

While this work under visual studio, and even for a Windows/console application, it doesn't work for an IIS application - even when the app pool is configured with an identity that would otherwise work.

All the solutions I've found to date require a service principle and supplying its id and secret which - and it's storing secrets locally that I'm trying to avoid.

Example: https://blog.bitscry.com/2019/02/13/using-azure-key-vault-in-a-console-application/

var keyClient = new KeyVaultClient(async (authority, resource, scope) => {
    var adCredential = new ClientCredential(clientId, clientSecret);
    var authenticationContext = new AuthenticationContext(authority, null);
    return (await authenticationContext.AcquireTokenAsync(resource, adCredential)).AccessToken;
});

Joey Cai Joey Cai · Accepted Answer · 2019-09-26T07:28:27

Is there any way to get a key vault secret using the IIS app pool identity to authenticate?

For local development authentication, AzureServiceTokenProvider fetches tokens using Visual Studio, Azure command-line interface (CLI), or Azure AD Integrated Authentication.

Using Visual Studio and Azure CLI both need to sign in to azure. And the User should be add to Access Policy of Azure keyvault.

Using Azure ad Integrated authentication, you also need to add the service principal into the Access Policy .

However, if you want to use IIS app pool identity to authenticate, you could not add Application Pool Identity Accounts to Azure keyvault. So, you could not avoid to use service principal's id and secret to authenticate.

How get Azure KeyVault secret for C# IIS application running on premise

1 Answers