changing package from "Microsoft.Extensions.Configuration.AzureKeyVault" To "Azure.Extensions.AspNetCore.Configuration.Secrets"

Question

I am using nuget Microsoft.Extensions.Configuration.AzureKeyVault and I am using below code for asp.net core 3.1 in Program.cs,

I am doing custom certificate authentication for azure keyVault. Also using custom secret management.

   public static IHostBuilder CreateHostBuilder(string[] args) =>
        Host.CreateDefaultBuilder(args)
            .ConfigureAppConfiguration((context, config) =>
            {
                    config.AddAzureKeyVault(new AzureKeyVaultConfigurationOptions
                    {
                        Vault = "key vault url",
                        ReloadInterval = TimeSpan.FromSeconds(15),
                        //authenticate with custom certificate
                        Client = new KeyVaultClient(CustomCertificateAuthenticationCallback),
                        Manager = new CustomKeyVaultSecretManager()
                    });
                }
            })
            .ConfigureWebHostDefaults(webBuilder =>
            {
                webBuilder.UseStartup<Startup>();
            });

The package Microsoft.Extensions.Configuration.AzureKeyVault is deprecated and I have uninstalled this package and installed the updated one Azure.Extensions.AspNetCore.Configuration.Secrets. After switching to this package I am NOT able to figure our how to use custom validation and how to pass keyvault url

unknown · Accepted Answer · 2021-01-26T02:16:16.173

You could try SecretClient method, and refer to this official document about Azure Key Vault Configuration Provider.

using Azure.Security.KeyVault.Secrets;
using Azure.Identity;
using Azure.Extensions.AspNetCore.Configuration.Secrets;

public static IHostBuilder CreateHostBuilder(string[] args) =>
    Host.CreateDefaultBuilder(args)
        .ConfigureAppConfiguration((context, config) =>
        {
            if (context.HostingEnvironment.IsProduction())
            {
                var builtConfig = config.Build();
                var secretClient = new SecretClient(new Uri($"https://{builtConfig["KeyVaultName"]}.vault.azure.net/"),
                                                         new DefaultAzureCredential());
                config.AddAzureKeyVault(secretClient, new KeyVaultSecretManager());


            }
        })
        .ConfigureWebHostDefaults(webBuilder =>
        {
            webBuilder.UseStartup<Startup>();
        });

SecretClient doesn't support AuthenticationCallback(Microsoft.Azure.KeyVault.KeyVaultClient.AuthenticationCallback).

If you would like to authenticate with certificate, you could new TokenCredential with Azure.Identity.ClientCertificateCredential.

X509Certificate2 cer = new X509Certificate2(certPath, pfxpassword, X509KeyStorageFlags.EphemeralKeySet);
var secretClient = new SecretClient(new Uri($"https://{builtConfig["KeyVaultName"]}.vault.azure.net/"),
                                            new ClientCertificateCredential(tenantID, clientID, cer);

I edit my reply about authenticating with certificate. Try the code with ClientCertificateCredential(). — unknown, Jan 26 '21 at 02:17
If my reply is helpful, please accept it as answer, thank you. — unknown, Jan 28 '21 at 14:01
Is there a way to also keep the "ReloadInterval = TimeSpan.FromSeconds(15)," ? — KVN, Sep 29 '22 at 00:03

score 2 · Answer 2 · answered Sep 29 '22 at 16:50

As the suggestion in the Accepted Answer does not have the ReloadInterval property, here is the suggestion to keep all properties as in the original code, while using the new package:

using Azure.Security.KeyVault.Secrets;
using Azure.Identity;
using Azure.Extensions.AspNetCore.Configuration.Secrets;

public static IHostBuilder CreateHostBuilder(string[] args) =>
    Host.CreateDefaultBuilder(args)
        .ConfigureAppConfiguration((context, config) =>
        {
            if (context.HostingEnvironment.IsProduction())
            {
                var builtConfig = config.Build();
                config.AddAzureKeyVault(
                    new Uri($"https://{builtConfig["KeyVaultName"]}.vault.azure.net/"),
                    new DefaultAzureCredential(),
                    new AzureKeyVaultConfigurationOptions()
                    {
                        Manager = new KeyVaultSecretManager(),
                        ReloadInterval = TimeSpan.FromSeconds(15)
                    }
                 );
            }
        })
        .ConfigureWebHostDefaults(webBuilder =>
        {
            webBuilder.UseStartup<Startup>();
        });

changing package from "Microsoft.Extensions.Configuration.AzureKeyVault" To "Azure.Extensions.AspNetCore.Configuration.Secrets"

2 Answers2