Azure Key Vault入门

Azure Key Vault是一个用来存储及访问密码和证书等秘密信息的服务，本文将介绍如何利用.NET分别从Azure及本地访问Azure Key Vault，以及一些简单的密码管理操作。

 

目录

Azure App Service如何获取Azure Key Vault的访问权限

部署在本地的应用程序如何获取Azure Key Vault的访问权限

代码示例

---

Azure App Service如何获取Azure Key Vault的访问权限

1. 通过Azure网站进入所创建的Azure Web App的管理界面之后进入Identity管理界面

2. 选择System assigned选项卡，将状态设置为on并点击保存按钮

3. 在Azure网站最上方的搜索栏里搜索Key Vault关键字并进入Key Vault管理总界面

4. 点击进入创建好的Azure Key Vault实例之后进入Access Policies管理界面

5. 点击添加访问策略按钮，为需要授权的principal（本小节中此处为步骤1中的Azure App Service）添加权限后点击保存按钮

 

部署在本地的应用程序如何获取Azure Key Vault的访问权限

1. 通过Azure网站创建App registration

2. 利用powershell创建并安装自签名证书

3. 将证书由App registration的Manifest管理界面上传至App registration并保存

4. 效仿上一小节步骤3至5为该App registration授权

 

代码示例

// Microsoft.Azure.KeyVault 3.0.1 is needed
public class KeyVaultClient
{
    private readonly KeyVaultClient _client;
    private readonly string _keyValutDns;

    public KeyVaultClient(bool isOnPremise, string appRegistrationId=null, string subject=null)
    {
        _keyValutDns = "https://xxxx.vault.azure.net/";
        if (isOnPremise) { // Local application
            _client = new KeyVaultClient(async (authority, resource, scope) => {
                var context = new AuthenticationContext(authority, null);
                X509Certificate2 cert = getCertificate(subject);
                var assertion = new ClientAssertionCertificate(appRegistrationId);
                var result = await context.AcquireTokensAsync(resource, assertion);
                return result.AccessToken;
            });
        }
        else
        { // Application deployed on Azure
            var provider = new AzureServiceTokenProvider();
            _client = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(provider.KeyVaultTokenCallback));
        }
    }


    private X509Certificate2 getCertificate(string subject)
    {
        using(var store = new X509Store(StoreName.Root, StoreLocation.LocalMachine))
        {
            store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);
            var certs = store.Certificates.Find(X509FindType.FindBySubjectName, subject, false);
            if (certs.Count != 1)
                throw new Exception("Failed to get certificate.");
            return certs[0];
        }
    }


    public async Task AddSecretAsync(string name, string secret)
    {
        await _client.SetSecretAsync(_keyValutDns, name, secret);
    }


    public async Task<string> GetSecretAsync(string name)
    {
        var response = await _client.GetSecretAsync($"{_keyValutDns}secrets/{name}").ConfigureAwait(false);
        return response.Value;
    }
}

完整代码可访问https://github.com/lxf310/Azure_Key_Vault_Demo