How to access azure keyvault through on-premise API using service principal and secret?

Question

I'm trying to figure out how to access secrets in azure keyvault using an on-premise .Net Core 3.1 API. The authentication method is to use service principal and the client secret to access key vault.

I'm following this tutorial from Microsoft:https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication-on-premises-apps?tabs=azure-portal%2Cwindows%2Ccommand-line

But I'm struggling at heading 4 "Implement DefaultAzureCredential in application".

This is my Startup.cs file:

public void ConfigureServices(IServiceCollection services)
        {
            var tenantId = Configuration["AzureAd:TenantId"];
            var clientId = Configuration["AzureAd:ClientId"];
            var clientSecret = Configuration["AzureAd:ClientSecret"];
            var kvUri = Configuration["AzureAd:KvUri"];
            services.AddAzureClients(x =>
            {
                x.AddSecretClient(new Uri(kvUri));
                x.UseCredential(new ClientSecretCredential(tenantId, clientId, clientSecret));
            });

Now I want to retrieve a secret from a vault by executing a reoute endpoint. But there are not documentations or tutorials on what code to add in my Controller. It currently looks like this. SecretsController:

public SecretsController(SecretClient client)
        {
            secretsClient = client;
        }
...


[HttpGet("GetSecrets")]
        public async Task<string> Get()
        {
            var mySecretValue = await secretsClient.GetSecretAsync("MySecret2");
            return "MySecret value is: " + mySecretValue.Value.Value;
        }

When executing the endpoint I get 401 Error, authentication failed.

I added the service principal under "Access Policies" in keyvault. Also I added access control for the resource group and assigned that to the principal, like in the mentioned microsoft docs. Under "Check access" in the keyvault I can see that the principal has "keyvault administrator acess"so that should be right too.

Answer 1

@Sabanovic, Maid

Thank you for your post!

Error Message: Azure Key Vault REST API Error Codes 401

HTTP 401: Unauthenticated Request

From your error message, can you make sure that you sent the authentication token within your GET request? I'd also make sure that you can decode your token via https://jwt.ms to ensure you have the correct tenant ID, client ID, and resource within your token.

I found some DefaultAzureCredential examples, that might help point you in the right direction. To create a new SecretClient to create, get, update, or delete secrets, you need the endpoint to an Azure Key Vault and credentials. For more info - Creating a SecretClient.

var client = new SecretClient(new Uri(keyVaultUrl), new DefaultAzureCredential());

Additional Links:

• Authenticate with DefaultAzureCredential
• Exploring the sequence of DefaultAzureCredential authentication methods
• Common error codes for Azure Key Vault

I hope this helps!