c# - 如何从 IIS 上托管的 .net 代码访问 key 保管库 secret

Question

我有一个场景:

1. 在 Azure 中创建包含 key 的 key 保管库。

2. 在代码中访问此 secret 。

3. 代码正在本地运行(使用 Azure CLI 进行测试)
4. 托管在 Azure 应用服务(启用 MSI)中的应用程序工作正常。
5. 我们需要在 Azure VM(启用 MSI)IIS 服务器上托管相同的应用程序 - 不工作

我想要上述点(最后一点)的解决方案和建议

访问 key 保管库 secret 值的代码

     var azureServiceTokenProvider = new AzureServiceTokenProvider();
            var keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
            ConfigurationApp.ClientId = keyVaultClient.GetSecretAsync("https://test.vault.azure.net/", "testid").Result.Value;

关注这篇文章 - https://kasunkodagoda.com/2018/04/28/allow-application-running-on-an-azure-virtual-machine-to-access-azure-key-vault-using-managed-service-identity/

https://azure.microsoft.com/en-us/resources/samples/app-service-msi-keyvault-dotnet/

Answer 1

我已经解决了我的问题:从 Azure VM IIS 上托管的 .net 代码访问 key 保管库 secret

  public async Task getAppconfiguration2()
    {
        string URI = "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fvault.azure.net";
        Uri uri = new Uri(String.Format(URI));
        HttpClient _client = new HttpClient();
        _client.DefaultRequestHeaders.Add("Metadata", "true");
        HttpRequestMessage request = new HttpRequestMessage
        {
            // Content = new StringContent(body, Encoding.UTF8, "application/json"),
            Method = HttpMethod.Get,
            RequestUri = new Uri(URI)
        };


        var res = await _client.SendAsync(request);
        var content = res.Content.ReadAsStringAsync();
        JObject token = JsonConvert.DeserializeObject<JObject>(content.Result.ToString());
        string token1 = token["access_token"].ToString();
        ConfigurationApp.Encyptionkey = token1.ToString();

        HttpClient _client1 = new HttpClient();
        _client1.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token1);
        HttpRequestMessage request1 = new HttpRequestMessage
        {

            Method = HttpMethod.Get,
            RequestUri = new Uri("https://test.vault.azure.net/secrets/clientid?api-version=2016-10-01")
        };


        var rs = _client1.SendAsync(request1);
        var rk = rs.Result.Content.ReadAsStringAsync();
        JObject clientjson = JsonConvert.DeserializeObject<JObject>(rk.Result.ToString());
        ConfigurationApp.ClientId = clientjson["value"].ToString();

    }