Azure Keyvault error: Tried the following 3 methods to get an access token, but none of them worked

user_1098555 0
Viewed 2446

I have configured my WebAPI to get Azure Storage connection string out of Azure KeyVault using Managed Identity.

For that, I have created an Azure AD dedicated user, which is given permission to get/list secrets from Azure KeyVault. I then assigned this user to my AZURE_USERNAME environment variable and I have configured Visual Studio to use this account.

It all works fine as long as I run the WebAPI in IIS Express when I debug from Visual Studio. However I want to run the WebApi from my local IIS when I debug in Visuall Studio.

What am I missing here ? I suspect it is because local IIS does not run with the configured user above, but what would be the workaround ?

The error I get is

AzureServiceTokenProviderException: Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/some_id. Exception Message: Tried the following 3 methods to get an access token, but none of them worked.

azure-keyvault azure-storage azure
3 Answers

In the end I created a dedicated service principal in azure ad which is then added to my applications's users. This service principal is referenced by the environment variable on the dev machine.

user_10985550

I have made progress on this and it is now working in local IIS but...

to make it work, I added the following environment variables:

enter image description here

as documented here

However it means this only works for ONE Service Principal at a time. What if I want all of my local WebApi running at the same time (which is the case) in the local IIS. How can I handle that with DefaultAzureCredential ?

user_10985550

Another solution is to create an AzureServiceTokenProvider instance by passing a connection string parameter that will specify the tenant and application secret.

var azureServiceTokenProvider = new AzureServiceTokenProvider("RunAs=App;AppId=2ad1fe1f-d93f-4973-a1e5-e7019638b90a;TenantId=your-tenant-here.onmicrosoft.com;AppKey=your-app-secret-here");

In such a way there is no more need to use the environment variables.

Check it here

user_5023320
Related