{"componentChunkName":"component---src-pages-markdown-remark-fields-slug-js","path":"/engineering/guest-post/using-azure-key-vault-with-an-azure-web-app-in-c-sharp/","result":{"data":{"markdownRemark":{"id":"5ed0008b-aea3-5ad0-a188-c9d9ed140666","excerpt":"Introduction Azure Key Vault is a highly secure, dependable, and simple method to store your keys and secrets in the cloud. This article talks about: Azure Key…","html":"

Introduction

\n

Azure Key Vault is a highly secure, dependable, and simple method to store your keys and secrets in the cloud. This article talks about:

\n\n

Use the following steps to read a secret stored in an Azure Key Vault instance.

\n
    \n
  1. Create a Web App in the Azure Portal
    2. \n
  2. Enable Managed Service Identity for your Web App
    3. \n
  3. \n

    Create and Configure Azure Key Vault

    \n\n
    4. \n
  4. \n

    Create a new ASP.NET 5 Core application

    \n\n
    5. \n
  5. Deploy the Application to Azure
    6. \n
  6. Execute the Application
    7. \n
\n

Prerequisites

\n

To execute the code examples provided in this article, you should have each of the following:

\n
    \n
  1. Visual Studio 2019 (preferred)
    2. \n
  2. Azure Account
    3. \n
\n

If you don't have an Azure account, you can create one for free here: Azure Login

\n

What is Azure Key Vault?

\n

Azure Key Vault is a cloud service that helps you store your application's secrets securely: You can store and manage the keys, passwords, certificates, and other secrets. You can also leverage Azure Key Vault to set parameters shared among multiple applications, including applications running in App Service.

\n

It enables you to isolate the sensitive and non-sensitive data in your application. For example, you can use application settings to store default parameters or key-value pairs containing some default settings used by the application. On the contrary, you can use Azure Key Vault to store API keys, secret keys, database connection strings, or Client IDs used in your application.

\n

Understanding Managed Identity

\n

Managed identity is a concept that eliminates the need of having to store credentials once an application has been deployed in the cloud. By using managed identity, you can securely access a variety of Azure services without having to store any credentials like connection strings or passwords. Managed identity may be used to connect to Key Vault from an Azure Function App or an Azure Web App, as well as to connect to Azure Blob Storage from an Azure Web App.

\n

Managed identities are of the following two types:

\n\n

Create a Web App in the Azure Portal

\n

You'll now create an Azure Web App instance with the permissions to access Azure Key Vault. Adhere to the steps given below that would guide you to create a new Azure Web App instance while you’re within the Azure portal:

\n
    \n
  1. In the Azure Portal, click on \"Create a resource\" from the Home screen
    2. \n
  2. \n

    Select \"Web App\" from the list

    \n

    \n \n \n

    \n
    3. \n
  3. Specify the name and a region for your web app
    4. \n
  4. \n

    Mention the resource group and app service plan for your web app

    \n

    \n \n \n

    \n
    5. \n
  5. In the Publish section, there are two choices: \"Code\" and \"Docker Container\". Choose \"Code\"
    6. \n
  6. Specify \".NET 5\" as the Runtime stack
    7. \n
  7. Set the Operation system to \"Windows\"
    8. \n
  8. For the region, specify the one that is closest to you
    9. \n
  9. You can leave the other options with their default values, and then, click on \"Review + Create\"
    10. \n
  10. Verify the configuration you've specified. If all is good, click \"Create\"
    11. \n
\n

Once the Web App has been created successfully, you'll be able to see it on the Home screen of the Azure Portal.

\n

Enable Managed Service Identity for your Web App

\n

To enable the system-assigned managed identity for the Azure Web App we just created, follow the steps given below:

\n
    \n
  1. Select \"Identity\" from the left-side menu in the Azure Web App
    2. \n
  2. Change the \"Status\" toggle pertaining to the System-assigned tab to \"On\"
    3. \n
  3. Copy the \"Object ID\" that would be available after a few seconds
    4. \n
\n

\n \n \n

\n

Create and Configure Azure Key Vault

\n

In this section, you’ll examine how to create and configure an Azure Key Vault instance.

\n

Create a new Azure Key Vault Instance

\n

You'll now create an Azure Key Vault in the Azure Portal and then add a secret to it. To create a new Azure Key Vault instance, navigate to the Azure Portal and follow the steps below:

\n
    \n
  1. Select \"Create a resource\" in the Azure Portal menu or the Home page
    2. \n
  2. Specify \"Key Vault\" in the search box
    3. \n
  3. When the results are listed, choose \"Key Vault\"
    4. \n
  4. Click \"Create\"
    5. \n
\n

\n \n \n

\n
    \n
  1. In the \"Create key vault\" screen provide the name, subscription, resource group name, and location. Leave the other options to their default values.
    2. \n
\n

\n \n

    \n
  1. Select \"Secrets\" from the \"Settings\" section of the \"Key Vault configuration\" page
    2. \n
  2. Click \"Generate/Import\" to add a secret
    3. \n
  3. Select \"Manual\" from the \"Upload options\" dropdown
    4. \n
  4. Next, mention the name and value of the secret
    5. \n
  5. Optionally specify the \"Content type\"
    6. \n
  6. Optionally set the \"activation and expiration date\" options
    7. \n
  7. Click \"Create\"
    8. \n
\n

\n \n \n

\n

Create a New ASP.NET 5 Core application

\n

First of all, you'll create an ASP.NET Core 5 web application. The project type comes bundled with all the template files to create a web application, even before you add something. Follow the steps given below to create a new ASP.NET Core Web application within the Visual Studio 2019 IDE.

\n
    \n
  1. Launch Visual Studio 2019
    2. \n
  2. In the start window, choose \"Create a new project\"
    3. \n
  3. In the \"Add a new project\" window, choose \"ASP.NET Core Web API\" from the list of the project templates
    4. \n
\n

\n \n \n

\n
    \n
  1. Select \"C#\" as the programming language from the \"Language\" list
    2. \n
  2. Click \"Next\"
    3. \n
  3. In the \"Configure your new project\" screen, enter the name and location of the new project
    4. \n
  4. Then, choose \"Next\"
    5. \n
  5. In the \"Additional information\" window, ensure that .NET 5.0 (current) is selected as the framework version
    6. \n
\n

\n \n

  • Click \"Create\" to complete the process
    • \n\n

    A new ASP.NET 5 Core application will be created in Visual Studio.

    \n

    Install the NuGet Packages

    \n

    To work with AzureKeyVault, you must install Microsoft.Extensions.Azure and Azure.Security.KeyVault.Secrets packages. While you can use the former for injecting dependencies for accessing Azure services, you can use the latter to access secrets via a SecretClient instance.

    \n

    You may install these packages in one of two ways: Either via the NuGet Package Manager integrated into the Visual Studio 2019 IDE or by running the following command(s) in the Package Manager Console:

    \n

    Install-Package Microsoft.Extensions.Azure

    \n

    Install-Package Azure.Security.KeyVault.Secrets

    \n

    Read Azure Key Vault Secrets in .NET Core

    \n

    In this section, you’ll examine how to read secrets from AzureKeyVault.

    \n

    Specify the Vault Uri in AppSettings

    \n

    Create a section named \"KeyVault\" in the appsettings.json file and specify a key named \"VaultUri\" in there as shown below:

    \n

    \"KeyVault\": {

    \n

    \"VaultUri\": \"https://applicationsecretsdemo.vault.azure.net/\"

    \n

    }

    \n

    Access Secrets from AzureKeyVault

    \n

    To access the secrets stored in the AzureKeyVault, you can take advantage of SecretClient pertaining to the Azure.Security.KeyVault.Secrets namespace. Create an interface named \"IKeyVaultManager\" with the following code in there:

    \n
    public interface IKeyVaultManager\n\n{\n\npublic Task<string> GetSecret(string secretName);\n\n}
    \n

    Create a class named \"KeyVaultManager\" that extends the \"IKeyVaultManager\" interface and implements the GetSecret method as follows:

    \n
    public class KeyVaultManager:IKeyVaultManager\n\n{\n\nprivate readonly SecretClient _secretClient;\n\npublic KeyVaultManager(SecretClient secretClient)\n\n{\n\n _secretClient = secretClient;\n\n}\n\npublic async Task<string> GetSecret(string secretName)\n\n{\n\ntry\n\n{\n\nKeyVaultSecret keyValueSecret = await\n\n_secretClient.GetSecretAsync(secretName);\n\nreturn keyValueSecret.Value;\n\n}\n\ncatch\n\n{\n\nthrow;\n\n}\n\n}\n\n}
    \n

    The \"KeyVaultManager\" class leverages the \"SecretClient\" class to retrieve secrets stored inside the AzureKeyVault.

    \n

    The KeyValueController Class

    \n

    The \"KeyValueController\" takes advantages of the \"KeyValueManager\" class to read the secret value for a given secret name and returns the value stored in there.

    \n
    public class KeyVaultController : ControllerBase\n\n{\n\nprivate readonly IKeyVaultManager _secretManager;\n\npublic KeyVaultController(IKeyVaultManager secretManager)\n\n{\n\n_secretManager = secretManager;\n\n}\n\n[HttpGet]\n\npublic async Task<IActionResult> Get([FromQuery] string secretName)\n\n{\n\ntry\n\n{\n\nif (string.IsNullOrEmpty(secretName))\n\n{\n\nreturn BadRequest();\n\n}\n\nstring secretValue = await\n\n_secretManager.GetSecret(secretName);\n\nif (!string.IsNullOrEmpty(secretValue))\n\n{\n\nreturn Ok(secretValue);\n\n}\n\nelse\n\n{\n\nreturn NotFound("Secret key not found.");\n\n}\n\n}\n\ncatch\n\n{\n\nreturn BadRequest("Error: Unable to read secret");\n\n}\n\n}\n\n}
    \n

    Register the Dependencies in the ConfigureServices Method

    \n

    You should specify the necessary code for dependency injection to work in the \"ConfigureServices\" method of the \"Startup\" class as shown in the code snippet given below:

    \n
    public void ConfigureServices(IServiceCollection services)\n\n{\n\nservices.AddAzureClients(azureClientFactoryBuilder =>\n\n{\n\nazureClientFactoryBuilder.AddSecretClient(\n\nConfiguration.GetSection("KeyVault"));\n\n});\n\nservices.AddSingleton<IKeyVaultManager,KeyVaultManager>();\n\nservices.AddControllersWithViews();\n\n}
    \n

    Deploy the Application to Azure

    \n

    To deploy the application, follow the steps below:

    \n
      \n
    1. Right-click on the project in the \"Solution Explorer Window\"
      2. \n
    2. Select \"Publish\"
      3. \n
    3. Select \"Azure\" as the target from the \"Publish\" window as shown below:
      4. \n
    \n

    \n \n \n

    \n
      \n
    1. Select \"Azure App Service (Windows)\" as the specific target as shown below:
      2. \n
    \n

    \n \n \n

    \n
      \n
    1. Specify, or associate, the \"App Service instance\" with your application
      2. \n
    \n

    \n \n \n

    \n
      \n
    1. Click \"Finish\"
      2. \n
    \n

    Execute the Application

    \n

    Lastly, you can use Postman to send a Http Get request to the endpoint to retrieve the stored secret as shown below:

    \n

    \n \n \n

    \n

    Summary

    \n

    Azure key vault helps you to keep your application's secrets out of the application. You can use it to isolate secrets from your code files. These secrets include connection strings, API keys, environment variables, etc. You can take advantage of Azure Key Vault to keep secrets out of source control or out of your application in a centralized storage place. In this article, you've used managed identity to connect an Azure web app in .NET to an Azure Key Vault and retrieve secret value from there.

    \n

    The complete source code of the application discussed in this article can be found here: Source Code

    \n","headings":[{"value":"Introduction","depth":2},{"value":"Prerequisites","depth":2},{"value":"What is Azure Key Vault?","depth":2},{"value":"Understanding Managed Identity","depth":2},{"value":"Create a Web App in the Azure Portal","depth":2},{"value":"Enable Managed Service Identity for your Web App","depth":3},{"value":"Create and Configure Azure Key Vault","depth":2},{"value":"Create a new Azure Key Vault Instance","depth":3},{"value":"Create an App Secret in Azure Key Vault","depth":3},{"value":"Authorize the Web App to access Your Key Vault","depth":3},{"value":"Create a New ASP.NET 5 Core application","depth":2},{"value":"Install the NuGet Packages","depth":3},{"value":"Read Azure Key Vault Secrets in .NET Core","depth":3},{"value":"Specify the Vault Uri in AppSettings","depth":4},{"value":"Access Secrets from AzureKeyVault","depth":4},{"value":"The KeyValueController Class","depth":4},{"value":"Register the Dependencies in the ConfigureServices Method","depth":4},{"value":"Deploy the Application to Azure","depth":2},{"value":"Execute the Application","depth":2},{"value":"Summary","depth":2}],"fields":{"slug":"/engineering/guest-post/using-azure-key-vault-with-an-azure-web-app-in-c-sharp/"},"frontmatter":{"metatitle":null,"metadescription":null,"description":"In this tutorial, you'll learn how to work with Azure Key Vault in C#.","title":"How to Use Azure Key Vault With an Azure Web App in C#","canonical":null,"date":"August 09, 2021","updated_date":null,"tags":["Azure","Key Vault","C#"],"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/bed799b83db7c1ce0146aeab64f8703a/03979/image.png","srcSet":"/static/bed799b83db7c1ce0146aeab64f8703a/f5f11/image.png 200w,\n/static/bed799b83db7c1ce0146aeab64f8703a/6d133/image.png 400w,\n/static/bed799b83db7c1ce0146aeab64f8703a/03979/image.png 800w,\n/static/bed799b83db7c1ce0146aeab64f8703a/aca38/image.png 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Joydip Kanjilal","github":"joydipkanjilal","bio":"Microsoft MVP (2007 - 2012), Author and Speaker with more than 25 years experience. Familiar with C#, .NET Core, SQL Server, Microsoervices, Design Patterns, REST, GraphQL and Software Architecture","avatar":null}}}},"pageContext":{"id":"5ed0008b-aea3-5ad0-a188-c9d9ed140666","fields__slug":"/engineering/guest-post/using-azure-key-vault-with-an-azure-web-app-in-c-sharp/","__params":{"fields__slug":"engineering"}}},"staticQueryHashes":["1171199041","1384082988","1711371485","1753898100","2100481360","229320306","23180105","528864852"]}