c# - 删除 Azure Keyvault 上的 secret 不起作用

Question

我有一个 Web API 方法，可以在 azure key Vault 上创建 secret ，并且工作正常，我还有一个删除方法，可以删除实体及其关联的 secret ，但是，此方法不会删除 azure key Vault 上的 key ，但它也没有抛出异常!

这里是辅助方法:

 public async Task OnCreateSecretAsync(string name, string value)
        {
            Message = "Your application description page.";
            int retries = 0;
            bool retry = false;
            try
            {
                /* The below 4 lines of code shows you how to use AppAuthentication library to set secrets from your Key Vault*/
                AzureServiceTokenProvider azureServiceTokenProvider = new AzureServiceTokenProvider();
                KeyVaultClient keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
                var result = await keyVaultClient.SetSecretAsync(ConfigurationManager.AppSettings["VaultUrl"].ToString(), name, value)
                            .ConfigureAwait(false);
                SecretIdentifier = result.Id;


                /* The below do while logic is to handle throttling errors thrown by Azure Key Vault. It shows how to do exponential backoff which is the recommended client side throttling*/
                do
                {
                    long waitTime = Math.Min(GetWaitTime(retries), 2000000);
                    result = await keyVaultClient.SetSecretAsync(ConfigurationManager.AppSettings["VaultUrl"].ToString(), name, value)
                        .ConfigureAwait(false);
                    Message = result.Id;
                    retry = false;
                }
                while (retry && (retries++ < 10));
            }
            /// <exception cref="KeyVaultErrorException">
            /// Thrown when the operation returned an invalid status code
            /// </exception>
            catch (KeyVaultErrorException keyVaultException)
            {
                Message = keyVaultException.Message;
                if ((int)keyVaultException.Response.StatusCode == 429)
                    retry = true;
            }
        }

        /// <summary>
        /// Deletes secrets
        /// </summary>
        /// <param name="name">Secret</param>
        /// <param name="value">Value</param>
        /// <returns></returns>
        public async Task OnDeleteSecretAsync(string name)
        {
            Message = "Your application description page.";
            int retries = 0;
            bool retry = false;
            try
            {
                /* The below 4 lines of code shows you how to use AppAuthentication library to set secrets from your Key Vault*/
                AzureServiceTokenProvider azureServiceTokenProvider = new AzureServiceTokenProvider();
                KeyVaultClient keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
                var result = await keyVaultClient.DeleteSecretAsync(ConfigurationManager.AppSettings["VaultUrl"].ToString(), name)
                            .ConfigureAwait(false);
                SecretIdentifier = result.Id;


                /* The below do while logic is to handle throttling errors thrown by Azure Key Vault. It shows how to do exponential backoff which is the recommended client side throttling*/
                do
                {
                    long waitTime = Math.Min(GetWaitTime(retries), 2000000);
                    result = await keyVaultClient.DeleteSecretAsync(ConfigurationManager.AppSettings["VaultUrl"].ToString(), name)
                        .ConfigureAwait(false);
                    Message = result.Id;
                    retry = false;
                }
                while (retry && (retries++ < 10));
            }
            /// <exception cref="KeyVaultErrorException">
            /// Thrown when the operation returned an invalid status code
            /// </exception>
            catch (KeyVaultErrorException keyVaultException)
            {
                Message = keyVaultException.Message;
                if ((int)keyVaultException.Response.StatusCode == 429)
                    retry = true;
            }
        }

这是我调用它们的方法:

 public async Task<IHttpActionResult> AddGlobalDesignTenant([FromBody]GlobalDesignTenant globaldesigntenant)
        {
            var telemetry = new TelemetryClient();
            try
            {
                if (!ModelState.IsValid)
                {
                    return BadRequest(ModelState);
                }

                string domainUrl = globaldesigntenant.TestSiteCollectionUrl;
                string tenantName = domainUrl.Split('.')[0].Remove(0, 8);
                globaldesigntenant.TenantName = tenantName;

                var globalDesignTenantStore = CosmosStoreHolder.Instance.CosmosStoreGlobalDesignTenant;
                byte[] data = Convert.FromBase64String(globaldesigntenant.base64CertFile);

                var cert = new X509Certificate2(
                    data,
                    globaldesigntenant.CertificatePassword,
                    X509KeyStorageFlags.Exportable |
                    X509KeyStorageFlags.MachineKeySet |
                    X509KeyStorageFlags.PersistKeySet);

                try
                {
                    using (var cc = new AuthenticationManager().GetAzureADAppOnlyAuthenticatedContext(globaldesigntenant.TestSiteCollectionUrl, 
                        globaldesigntenant.Applicationid,
                        globaldesigntenant.TenantName + ".onmicrosoft.com", 
                        cert, AzureEnvironment.Production))
                    {
                        cc.Load(cc.Web, p => p.Title);
                        cc.ExecuteQuery();
                        Console.WriteLine(cc.Web.Title);
                    }

                }
                catch (Exception ex)
                {
                    return BadRequest("Cant authenticate with those credentials");
                }              


                KeyVaultHelper keyVaultHelperPFX = new KeyVaultHelper();
                await keyVaultHelperPFX.OnCreateSecretAsync("GlobalDesignTenantPFXFileBAse64"+ tenantName, globaldesigntenant.base64CertFile);
                globaldesigntenant.SecretIdentifierBase64PFXFile = keyVaultHelperPFX.SecretIdentifier;


                KeyVaultHelper keyVaultHelperPassword = new KeyVaultHelper();
                await keyVaultHelperPassword.OnCreateSecretAsync("GlobalDesignTenantCertPassword" + tenantName, globaldesigntenant.CertificatePassword);
                globaldesigntenant.SecretIdentifieCertificatePassword = keyVaultHelperPassword.SecretIdentifier;

                globaldesigntenant.CertificatePassword = string.Empty;
                globaldesigntenant.base64CertFile = string.Empty;


                var added = await globalDesignTenantStore.AddAsync(globaldesigntenant);
                return Ok(added);
            }
            catch (Exception ex)
            {
                string guid = Guid.NewGuid().ToString();
                var dt = new Dictionary<string, string>
                {
                    { "Error Lulo: ", guid }
                };

                telemetry.TrackException(ex, dt);
                return BadRequest("Error Lulo: " + guid);
            }             
        }



   public async Task<IHttpActionResult> DeleteGlobalDesignTenant(string id)
        {
            var telemetry = new TelemetryClient();
            try
            {
                var globalDesignTenantStore = CosmosStoreHolder.Instance.CosmosStoreGlobalDesignTenant;
                 var globalDesignTenant = await globalDesignTenantStore.FindAsync(id, "globaldesigntenants");

                KeyVaultHelper keyVaultHelperPFX = new KeyVaultHelper();
                await keyVaultHelperPFX.OnDeleteSecretAsync("GlobalDesignTenantPFXFileBAse64" + globalDesignTenant.TenantName);


                KeyVaultHelper keyVaultHelperPassword = new KeyVaultHelper();
                await keyVaultHelperPassword.OnDeleteSecretAsync("GlobalDesignTenantCertPassword" + globalDesignTenant.TenantName);

                if (!ModelState.IsValid)
                {
                    return BadRequest(ModelState);
                }

                var result = await globalDesignTenantStore.RemoveAsync(globalDesignTenant);
                return Ok(result);
            }
            catch (Exception ex)
            {
                string guid = Guid.NewGuid().ToString();
                var dt = new Dictionary<string, string>
                {
                    { "Error Lulo: ", guid }
                };

                telemetry.TrackException(ex, dt);
                return BadRequest("Error Lulo: " + guid);
            }
        }

Answer 1

根据我的测试，await keyVaultClient.DeleteSecretAsync(ConfigurationManager.AppSettings["VaultUrl"].ToString(), name) 将删除具有指定名称的 key 。

所以，请在删除调用处设置一个断点。然后运行您的应用程序以查看它是否命中，并检查参数是否为预期值。