Accessing the Azure Key Vault from a .Net Application - getting DefaultAzureCredential authentication failed

user_166556 0
Viewed 2825

I'm trying to connect my .Net Core 3.1 app up to an Azure Key Vault. I've followed the quickstart tutorial, and am getting the following error:

Microsoft.Extensions.Configuration.AzureAppConfiguration.KeyVaultReferenceException: 'DefaultAzureCredential authentication failed.. ErrorCode:, Key:Authentication:Twitter:ConsumerAPIKey

The inner exception is:

MsalServiceException: AADSTS70002: The client does not exist or is not enabled for consumers

The CreateHostBuilder method looks like this:

public static IHostBuilder CreateHostBuilder(string[] args) =>
        Host.CreateDefaultBuilder(args)
            .ConfigureWebHostDefaults(webBuilder =>
            {
                webBuilder
                    .ConfigureAppConfiguration((hostingContext, config) =>
                    {
                        var settings = config.Build();

                        config.AddAzureAppConfiguration(options =>
                        {
                            options.Connect(settings["ConnectionStrings:AppConfig"])
                                .ConfigureKeyVault(kv =>
                                {
                                    kv.SetCredential(new DefaultAzureCredential());
                                });
                        });
                    })
                    .UseStartup<Startup>();
            });

I've found very little reference to this online, except one post relating to using multiple credentials (which I am not).

Can anyone give me a way forward on this: some clue as to what might be causing it?

EDIT

The following seems to work:

var defaultAzureCredentialsOptions = new DefaultAzureCredentialOptions()
{                                
    SharedTokenCacheTenantId = <tenant id>,
    SharedTokenCacheUsername = <my azure username>,
    ExcludeInteractiveBrowserCredential = false,
    ExcludeEnvironmentCredential = false,
    InteractiveBrowserTenantId = <tenant id>
};

config.AddAzureAppConfiguration(options =>
{                                
    options.Connect(settings["ConnectionStrings:AppConfig"])
        .ConfigureKeyVault(kv =>
        {
            kv.SetCredential(new DefaultAzureCredential(defaultAzureCredentialsOptions));
        });
});

Whilst this does work (as far as it goes), I now have the Tenant ID and my username hard-coded; along with a pop-up when I launch the site asking me to log-in.

azure-keyvault asp.net-core azure
1 Answers

The DefaultAzureCredential goes through a number of credentials, such as Managed Identity which is recommended for Azure services as being more secure (no shared access tokens).

You can, however, use environment variables set for your application or even during local development, namely:

  • AZURE_TENANT_ID : tenant ID
  • AZURE_CLIENT_ID : the service principal ID, which must have been granted necessary permissions like list and get for how you're using them in your example
  • AZURE_CLIENT_SECRET : the service principal secret (password), which was shown to you only after it was created

If you use the new preview version of Azure.Identity, it also supports Azure CLI, Visual Studio, and other credentials for development environments. For exampe, if you use the Azure CLI, once you az login, DefaultAzureCredential will just work.

user_4623760
Related