powershell - Azure key 保管库 : Secret not found error

Question

我已创建 Key Vault 并输入了密码。当我使用 .NET 在本地运行服务时，我可以通过 key 保管库检索 key 。这就是我所做的:1)创建SSL证书2) 使用该 SSL 证书创建 AD 应用程序3)为上述应用程序创建服务原则4) 授予对此应用程序的完整 key 保管库访问权限5) 我将 VaultURI、ServicePrincipal.Application ID 和证书指纹放入 Web.config 文件中6) 我还将该证书的 *.pfx 上传到我的云服务

当我在本地运行服务时，我能够检索 secret 。我什至尝试通过 powershell 检索 secret ，并且成功了。当我将代码部署到 Azure 时，我无法检索 key 。

它说:

Type : Microsoft.Azure.KeyVault.Models.KeyVaultErrorException, Microsoft.Azure.KeyVault, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 Message : Secret not found: QSAccounts7126 Source : Microsoft.Azure.KeyVault Help link : 

我花了 3 天的时间查看并重新测试了每种可能的情况，但还没有找出问题所在。有人可以帮助确定问题或指导我正确的调试路径吗？我什至尝试在 Azure 中以 Debug模式发布云服务，但由于某种原因也不起作用。

如果您能提供任何帮助，我们将不胜感激。

private async Task<string> getSecretConnection(string connectionName)
        {
            var kvName = ConfigurationManager.AppSettings["vaultName"];
            var kvClientId = ConfigurationManager.AppSettings["clientId"];
            var kvClientThumbprint = ConfigurationManager.AppSettings["clientThumbprint"];
            using (keyVaultHelper = new AzureKeyVaultHelper(kvClientId, kvClientThumbprint, kvName))
            {
                var bundle = await keyVaultHelper.GetAzureKeyVaultSecretAsync(connectionName);
                return bundle;
            }
public async Task<string> GetAzureKeyVaultSecretAsync(string secretName)
        {
            var bundle = await this.KvClient.GetSecretAsync(KeyVaultUrl, secretName);
            return bundle.Value;
        }

这是运行身份验证的代码:

private async Task<string> getAccessTokenFromSPNAsync(string authority, string resource, string scope)
        {
            //clientID and clientSecret are obtained by registering 
            //the application in Azure AD

            var certificate = CertificateHelper.FindCertificateByThumbprint(this.ClientThumbprint);
            var assertionCert = new ClientAssertionCertificate(this.ClientId, certificate); //needed for authentication
            var clientCredential = new ClientCredential(this.ClientId, this.ClientThumbprint);

            var authContext = new AuthenticationContext(authority, TokenCache.DefaultShared);
            AuthenticationResult result = await authContext.AcquireTokenAsync(resource, assertionCert);

            if (result == null)
            {
                throw new InvalidOperationException("Failed to obtain the token from Azure AD using certificate");
            }

            return result.AccessToken;
        }

Answer 1

Can someone please help in identifying the issue or directing me in the right path for debugging?

您似乎需要在 Azure WebApp 设置中添加WEBSITE_LOAD_CERTIFICATES，以将证书加载到您的 Web 应用程序个人证书存储中。更多详情可以引用这个blog 。我们还可以remote debug the WebApp以获得更详细的错误信息。

Adding an app setting named WEBSITE_LOAD_CERTIFICATES with its value set to the thumbprint of the certificate will make it accessible to your web application. You can have multiple comma-separated thumbprint values or can set this value to “ * “ (without quotes) in which case all your certificates will be loaded to your web applications personal certificate store.