Keyvault MSI with Spring boot : How to config keyvault to use Azure cli credentials instead of managed identity while running on local?

user_14554634 0
Viewed 612

I created a simple spring boot app to retrieve secrets from keyvault. I added the following dependency to work around with,

<dependency>
   <groupId>com.azure.spring</groupId>
   <artifactId>azure-spring-boot-starter-keyvault-secrets</artifactId>
   <version>3.5.0</version>
</dependency>

and added the following in application.properties

azure.keyvault.enabled=true
azure.keyvault.uri=<URL>

#keys
mySecretProperty=secret

and my main application,

@SpringBootApplication
public class KeyVaultSample implements CommandLineRunner {

    @Value("${mySecretProperty}")
    private String mySecretProperty;

    public static void main(String[] args) {
        SpringApplication.run(KeyVaultSample.class, args);
    }

    @Override
    public void run(String... args) {
        System.out.println("property your-property-name value is: " + mySecretProperty);
    }
}

But every time I tried to run the above app on local, it tries to use ManagedIdentityCredential to connect. So I added a configuration class for creating a bean for SecretClient with AzureCliCredential, but then too, the results are the same.

My Configuration class,

@Configuration
public class AppConfiguration {

@Bean
public SecretClient secretClient() {
  AzureCliCredential az = new AzureCliCredentialBuilder().build();
  SecretClient sec = new SecretClientBuilder().vaultUrl("<url>")
  .credential(az).buildClient();
  return sec;
 }
}​

I'm looking for ways I could use/test this keyvault on my local. Is there any configuration I could put in the properties file which would make it use AzureCliCredential instead of ManagedIdentityCredential?

azure-managed-identity azure-keyvault spring-boot azure java
2 Answers

azure-spring-boot-starter-keyvault-secrets uses MSI / Managed identities.

If you would like to authenticate with Azure CLI, just use azure-identity and azure-security-keyvault-secrets.

public void getSecretWithAzureCliCredential() {
    AzureCliCredential cliCredential = new AzureCliCredentialBuilder().build();

    // Azure SDK client builders accept the credential as a parameter
    SecretClient client = new SecretClientBuilder()
        .vaultUrl("https://{YOUR_VAULT_NAME}.vault.azure.net")
        .credential(cliCredential)
        .buildClient();

    KeyVaultSecret secret = secretClient.getSecret("<secret-name>");
    System.out.printf("Retrieved secret with name \"%s\" and value \"%s\"%n", secret.getName(), secret.getValue());

}
user_133083810
user_171741220
Related