PROD中的asp.net秘密

Question

I have been using the new .net 4.7.1 functionality to manage secrets locally in DEV but now I want to publish my web app and of course that doesn't work in PROD.

I am using a service principal to access Azure key vault in my app and was storing the App Id and Password in the local secrets file. I can of course store all of my secrets in Key vault but I still need to supply it the service principal details to connect to that in the first place.

What's the best option here?

Answer 1

You need to store the values you use to open the key vault in the App settings of your application. If your production environment is Azure, you can access the App settings of your application and set them there.

Read this article to get an idea of the full picture. But the jist is that you can use application secrets in a Azure key valut and then use app settings to store the credentials to access that key vault later on.

Answer 2

You can use Managed Identities so you don't have to store any secret in your app:

How to use managed identities for App Service and Azure Functions

Once configured, add a reference to these nuget packages: Microsoft.Azure.Services.AppAuthentication and Microsoft.Azure.KeyVault

In you application, you can access key vault secrets like that:

using Microsoft.Azure.KeyVault;
using Microsoft.Azure.Services.AppAuthentication;

...

var azureServiceTokenProvider = new AzureServiceTokenProvider();
var keyVaultClient = new KeyVaultClient(
     new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
var secret = await keyVaultClient.GetSecretAsync(
    "https://{{my-vault-name}}.vault.azure.net/", "{{my-secret}}");