Using Azure Key Vault Secrets with .NET Core 7 Web API

Topics covered in this article are…

---

Introduction to Azure Key Vault
Creating a .NET Core Web API Project
Setup keys in Azure Portal
Configuring Azure Key Vault Secrets Integration

Introduction to Azure Key Vault:

---

What is Azure Key Vault?

Key Concepts

Keys: Azure Key Vault allows you to create and manage cryptographic keys used for encryption, decryption, and signing. These keys can be used to secure data at rest and in transit.
Secrets: Secrets are sensitive values like connection strings, passwords, API keys, and other configuration details. Azure Key Vault provides a secure location to store and manage these secrets separately from your application code.
Certificates: You can upload and manage X.509 certificates in Azure Key Vault, making it easier to secure communication between components of your applications.

Why Use Azure Key Vault?

Centralized Management: Azure Key Vault provides a single place to securely manage all your cryptographic assets and secrets, reducing the risk of exposure.
Security: Key Vault offers advanced security features like hardware security modules (HSMs) and strong access controls, ensuring that your sensitive information is well protected.
Ease of Use: Integrating Azure Key Vault with your applications is straightforward. You can access secrets and keys programmatically or integrate them into your application’s configuration.
Compliance: Azure Key Vault helps you meet regulatory and compliance requirements by providing auditable access and usage logs.

Creating a .NET Core Web API Project:

---

Setting up .NET Core 7 Web API Project

Open Visual Studio.
Click on “Create a new project.”
In the “Create a new project” window:
• Search for “ASP.NET Core Web API.”
• Select the “ASP.NET Core Web API” template.
• Choose a location and provide a name for your project.
• Click “Create.”

https://learn.microsoft.com/en-us/aspnet/core/tutorials/first-web-api?view=aspnetcore-7.0&tabs=visual-studio

Setup Keys In Azure Portal:

---

Create an Azure Key Vault:

---

Step 1: Start by going to the Azure portal and logging in with your credentials.

Step 2: Once logged in, navigate to the “All Services” section in the portal’s sidebar. search “Key Vaults” in the search bar.

Step 3: Proceed to acquire a subscription for Azure Key Vaults. (You can proceed with Azure free trial)

Add Keys In Key Vaults:

---

Step 1: Within the previously created KeyVault, navigate to the “Keys” menu located in the sidebar..

Step 2: Next, click on the “+” sign, labeled “Generate/Import,” to initiate the process of adding new Keys.

Step 3: In the “Create a Key” section, Provide the following information:

Name: Provide a unique name for the key.
Key Type: Choose a key type (RSA or EC) and specify the key size or curve.
Set activation date: Set the key’s activation date
Set expiration date: Set the key’s expiration dateand other relevant settings as needed
Click the “Create” button to create the key.

Now, You can see the message “The key MyTestKey has been successfully created” And your Key.

Register an App:

---

Step 1: Start by searching for “App registration” in the search bar.

Step 2: To complete the application registration process, provide the necessary additional information. After providing the details, click on the “Register” button to finalize the registration.

Retrieve Client ID, Client Secret, and Tenant ID:

---

Step 1: Navigate to “Certificates and Secrets” in the sidebar and click on it.

Step 2: Next, select the “+” symbol, labeled “New client secret” to add a client secret.

Step 3: On the “Add a Client Secret” page, provide a description (such as Secret name, etc.), choose an expiration duration from the dropdown menu, and then click the “Add” button to include the client secret.

Troubleshoot:

---

Step 1: Navigate to the “Access Control (IAM)” section in the sidebar of the key vault.

Step 2: Then, select the “+” symbol labeled as “add” and proceed to “add role assignment.”

Step 3: Choose “Key Vault Administrator” and then click on “Members.”

Step 4: Select the desired members by clicking on “Select the members” and searching for them.

Step 5: After selecting the members, click on the “Review + Assign” button to add the role.

If you encounter the given exception:

“Caller is not authorized to perform action on resource.
If role assignments, deny assignments or role definitions were changed recently, please observe propagation time.


• Here are the steps to address this issue:
  
  To resolve this exception, you can grant the necessary permissions to your Key Vault. There are two approaches to achieve this:
  
  • Access Policies: Open your Key Vault and navigate to the “Access policies” section. Add the required permissions for the specified action to the caller (YourAPP). Ensure that the specified Assignment is created correctly.

Access Control (IAM): Alternatively, go to the “Access control (IAM)” section in your Azure Key Vault. Add the necessary role assignment to the caller’s identity (YourAPP) for the specific action mentioned . Confirm that the Assignment is properly configured.

Configuring Azure Key Vault-Key Integration:

---

Our project structure look like this:

Installing the NuGet package

Code Implementation:

{
    "AzureKeyVault": {
        "AzureKeyVaultURL": "",
        "AzureClientId": "",
        "AzureClientSecret": "",
        "AzureClientTenantId": "",
        "KeyName": ""
    }
}

AzureKeyVaultURL: Your Azure key vault URL
AzureClientTenantId: Your Azure AD tenant ID.
AzureClientId: Your Azure AD client ID.
AzureClientSecret: Your Azure AD client secret.
KeyName: Your key name from the Azure portal.

using Azure.Identity;
using Azure.Security.KeyVault.Keys;
using Azure.Security.KeyVault.Keys.Cryptography;
using System.Text;

class Program
{
    static async Task Main(string[] args)
    {
        IConfigurationBuilder builder = new ConfigurationBuilder()
            .SetBasePath(Directory.GetCurrentDirectory())
            .AddJsonFile("appsettings.json");

        IConfiguration configuration = builder.Build();

        // Read the Azure Key Vault settings from appsettings.json
        string keyVaultUrl = configuration["AzureKeyVault:AzureKeyVaultURL"];
        string tenantId = configuration["AzureKeyVault:AzureClientTenantId"];
        string clientId = configuration["AzureKeyVault:AzureClientId"];
        string clientSecret = configuration["AzureKeyVault:AzureClientSecret"];

        // Key name you want to access
        string keyName = configuration["AzureKeyVault:KeyName"];

        // Create a KeyClient instance using client secret authentication
        var clientSecretCredential = new ClientSecretCredential(tenantId, clientId, clientSecret);
        var keyClient = new KeyClient(new Uri(keyVaultUrl), clientSecretCredential);

        // Retrieve the key from Key Vault
        KeyVaultKey key = await keyClient.GetKeyAsync(keyName);

        // Create a CryptographyClient for encryption and decryption
        var cryptoClient = new CryptographyClient(key.Id, new ClientSecretCredential(tenantId, clientId, clientSecret));

        // Message to encrypt and decrypt
        string messageToEncrypt = "Hello, Azure Key Vault!";

        // Convert the message to bytes
        byte[] messageBytes = Encoding.UTF8.GetBytes(messageToEncrypt);

        // Encrypt the message using the key
        EncryptResult encryptResult = await cryptoClient.EncryptAsync(EncryptionAlgorithm.RsaOaep, messageBytes);

        // Decrypt the encrypted message using the key
        DecryptResult decryptResult = await cryptoClient.DecryptAsync(EncryptionAlgorithm.RsaOaep, encryptResult.Ciphertext);

        // Convert the decrypted bytes back to a string
        string decryptedMessage = Encoding.UTF8.GetString(decryptResult.Plaintext);

        // Display the results
        Console.WriteLine("Original message: " + messageToEncrypt);
        Console.WriteLine("Encrypted message: " + Convert.ToBase64String(encryptResult.Ciphertext));
        Console.WriteLine("Decrypted message: " + decryptedMessage);

        Console.ReadLine();
    }
}

Run Project: After Running the project, You can clearly see the result:

Do You Need more information?

For any further information / query regarding Technology, please email us at info@varianceinfotech.in
OR call us on +1 630 534 0223 / +91-7016851729, Alternately you can request for information by filling up Contact Us