c# - 如何在不将客户端 key 存储在 appsettings.json 中的情况下获取 Azure Key Vault key ？

Question

如何在不将 ClientSecret 存储在 appsettings.json 中的情况下获取 AzureKeyVault Secret？我们在 .NET 5 中有一个使用依赖注入(inject)的 WinForms 应用程序，我们希望向 ServiceProvider 添加两项服务，同时只需要一个 SSO 登录提示并从 appsettings.json 文件中删除 KeyVault secret 字符串。

使用 Visual Studio 登录 Azure 时，对 builder.AddAzureKeyVault(SecretClient, new KeyVaultSecretManager()) 的调用有效。当我们为未登录 Visual Studio 的虚拟机部署应用程序时，这种情况就会中断。我们可以通过传入 secret 值来使其工作，但我们不想将其存储在任何一个中代码或应用程序设置。我们如何将 secret 存储在KeyVault中，然后检索它以便我们可以添加AddAzureKeyVault服务？

当我们注销 Visual Studio 时(即 ExcludeVisualStudioCredential = true)，我们会收到以下错误:

Azure.Identity.CredentialUnavailableException: 'DefaultAzureCredentialfailed to retrieve a token from the included credentials.

• EnvironmentCredential authentication unavailable. Environment variables are not fully configured.
• ManagedIdentityCredential authentication unavailable. No Managed Identity endpoint found.
• Process "C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\IDE\Extensions\gwrwzu2y.rwb\TokenService\Microsoft.Asal.TokenService.exe"has failed with unexpected error: TS003: Error, TS005: No accountsfound. Please go to Tools->Options->Azure Services Authentication,and add an account to be to authenticate to Azure services duringdevelopment..
• Stored credentials not found. Need to authenticate user in VSCode Azure Account.
• Azure CLI not installed
• Please run 'Connect-AzAccount' to set up account.'

注释 1:我们正在使用 SSO，并且可以检索 AccessToken。因此，我们可以访问 AccessToken。

注 2:我们使用 SlowCheetah 进行多个环境配置，因此我们没有 ENVIRONMENT_VARIABLES 设置。

来自 Program.cs

Static Void Main()
{
...
Host = Microsoft.Extensions.Hosting.Host.CreateDefaultBuilder()
    .ConfigureAppConfiguration((context, builder) =>
    {
        builder.SetBasePath(AppDomain.CurrentDomain.BaseDirectory)
            ;

        builder.AddJsonFile("appsettings.json", optional: false, reloadOnChange: true)
            ;

        // Set the Configuration. We need to build the Configuration here so that we can get access to the Appsettings in order to
        // set the SecretClient and add the Azure Key Vault. We will then need to set the Configuration again in order to capture this
        // new service.
        Configuration = builder.Build();

        SetSecretClient(Configuration);

        // Add the Azure Key Vault. This only works when signed into Azure via Visual Studio
        builder.AddAzureKeyVault(SecretClient, new KeyVaultSecretManager());
    })
    .ConfigureServices((context, services) =>
    {
        Configuration = context.Configuration;

        SignInUserSSO();

        ConfigureServices(Configuration, services);
    })
    .Build();
...
}

private static void SetSecretClient(IConfiguration objConfiguration)
{
    DefaultAzureCredentialOptions objDefaultAzureCredentialOptions;
    SecretClientOptions objSecretClientOptions;

    string strAzureKeyVaultResourceIdentifier = objConfiguration.GetValue<string>("Azure:FirmId:ResourceIdentifiers:KeyVault");
    string strAzureKeyVaultName = objConfiguration.GetValue<string>("Azure:FirmId:KeyVaults:NameOfKeyVault");
    string strAzureKeyVaultUri = strAzureKeyVaultResourceIdentifier.Replace("{KeyVaultName}", strAzureKeyVaultName);

    // Set the options on the SecretClient. These are default values recommended by Microsoft.
    objSecretClientOptions = new SecretClientOptions()
    {
        Retry =
        {
            Delay= TimeSpan.FromSeconds(2),
            MaxDelay = TimeSpan.FromSeconds(16),
            MaxRetries = 5,
            Mode = RetryMode.Exponential
            }
    };

    objDefaultAzureCredentialOptions = new DefaultAzureCredentialOptions
    {
        ExcludeEnvironmentCredential = true,
        ExcludeManagedIdentityCredential = false,
        ExcludeSharedTokenCacheCredential = true,
        ExcludeVisualStudioCredential = true,
        ExcludeVisualStudioCodeCredential = true,
        ExcludeAzureCliCredential = true,
        ExcludeInteractiveBrowserCredential = true
    };

    SecretClient = new SecretClient(
        vaultUri: new Uri(strAzureKeyVaultUri),
        credential: new DefaultAzureCredential(objDefaultAzureCredentialOptions),
        objSecretClientOptions
        );
}

Answer 1

DefaultAzureCredential使用多种身份验证方法来支持生产和开发环境，而无需更改代码。因此，虽然你可以在开发过程中使用 Visual Studio、Azure CLI 或其他凭据，但你可以在生产中将环境变量与服务主体或托管标识一起使用。对于虚拟机，托管身份可能是最容易配置的，对于不支持托管身份的服务，您可以使用在您的服务上配置的环境变量，这些变量被授权访问您的 Key Vault。

FWIW，如果您想简化代码，建议的默认重试设置已经是默认值，无需指定 SecretClientOptions 实例。