Angular - Azure Key Vault Managing Vault Access secrets

user_13521854 0
Viewed 4703

Is it possible to use Azure Key Vault to get a vault access secret in an Angular app?

I am working with Azure Active Directory using implicit flow, which means that I am implementing everything without a back-end. In my Angular project, I am using Microsoft Authentication Library (Angular MSAL) to acquire tokens from Microsoft Identity Platform endpoint to access secure web APIs. Now, I want to use Azure Key Vault as a tool to safely store and access secrets. I plan to use it to protect client-id, b2c-policy-name, b2c-scope.

I have not found any information on the possibility of implementing logic on the frontend side to manage Azure Key Vault. At the same time, I created a Node JS server project using ENV to manage Azure Key Vault and it works successfully, but I want to get the same in my Angular app.

export const msalConfig: Configuration = {
    auth: {
        clientId: MY_CLIENT_ID, // I want to use Key Vault here
        authority: b2cPolicies.authorities.signUpSignIn.authority,
        redirectUri: 'http://localhost:6420/',
        postLogoutRedirectUri: 'http://localhost:6420/',
        navigateToLoginRequestUrl: true,
        validateAuthority: false,
      },
    cache: {
        cacheLocation: 'localStorage',
        storeAuthStateInCookie: isIE,
    },
};
azure-keyvault msal azure-active-directory angular
2 Answers

this is not possible. also, is not recommended even if it were possible. if you could connect to key vault to retrieve secrets in javascript on client side, it's a huge security risk, as anyone could be able to access your secrets. it does not provide any security.

as best practice you should never access secured resources directly from client code.

Hope that helps, Regards,

user_134708940

You can write an Azure function to encapsulate the key vault. An azure function can be a managed identity and can access the key vault. The function itself can be secured by Azure Active Directory so that only your registered users can trigger the function. Your Angular app can then call the Azure function to get the secret.

Regards

Access key vault from Azure function

Secure Azure function with AAD

user_94460240
Related