Skip to content

Commit d15542b

Browse files
skorubaskoruba
committed
Add Azure KeyVault for reading secrets
1 parent 1d3e924 commit d15542b

File tree

8 files changed

+84
-9
lines changed

8 files changed

+84
-9
lines changed

‎src/Skoruba.IdentityServer4.Admin.Api/Program.cs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,10 @@ private static IConfiguration GetConfiguration(string[] args)
5050
configurationBuilder.AddUserSecrets<Startup>();
5151
}
5252

53+
var configuration = configurationBuilder.Build();
54+
55+
configuration.AddAzureKeyVaultConfiguration(configurationBuilder);
56+
5357
configurationBuilder.AddCommandLine(args);
5458
configurationBuilder.AddEnvironmentVariables();
5559

@@ -60,6 +64,8 @@ public static IHostBuilder CreateHostBuilder(string[] args) =>
6064
Host.CreateDefaultBuilder(args)
6165
.ConfigureAppConfiguration((hostContext, configApp) =>
6266
{
67+
var configurationRoot = configApp.Build();
68+
6369
configApp.AddJsonFile("serilog.json", optional: true, reloadOnChange: true);
6470

6571
var env = hostContext.HostingEnvironment;
@@ -71,6 +77,8 @@ public static IHostBuilder CreateHostBuilder(string[] args) =>
7177
configApp.AddUserSecrets<Startup>();
7278
}
7379

80+
configurationRoot.AddAzureKeyVaultConfiguration(configApp);
81+
7482
configApp.AddEnvironmentVariables();
7583
configApp.AddCommandLine(args);
7684
})

‎src/Skoruba.IdentityServer4.Admin.Api/appsettings.json

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,5 +51,13 @@
5151
},
5252
"DataProtectionConfiguration": {
5353
"ProtectKeysWithAzureKeyVault": false
54+
},
55+
"AzureKeyVaultConfiguration": {
56+
"AzureKeyVaultEndpoint": "",
57+
"ClientId": "",
58+
"ClientSecret": "",
59+
"UseClientCredentials": true,
60+
"DataProtectionKeyIdentifier": "",
61+
"ReadConfigurationFromKeyVault": false
5462
}
5563
}

‎src/Skoruba.IdentityServer4.Admin/Program.cs

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,17 @@
33
using System.Linq;
44
using System.Threading.Tasks;
55
using Microsoft.AspNetCore.Hosting;
6+
using Microsoft.Azure.KeyVault;
7+
using Microsoft.Azure.Services.AppAuthentication;
68
using Microsoft.Extensions.Configuration;
9+
using Microsoft.Extensions.Configuration.AzureKeyVault;
710
using Microsoft.Extensions.Hosting;
811
using Serilog;
912
using Skoruba.IdentityServer4.Admin.Configuration;
1013
using Skoruba.IdentityServer4.Admin.EntityFramework.Shared.DbContexts;
1114
using Skoruba.IdentityServer4.Admin.EntityFramework.Shared.Entities.Identity;
1215
using Skoruba.IdentityServer4.Admin.Helpers;
16+
using Skoruba.IdentityServer4.Shared.Configuration.Common;
1317
using Skoruba.IdentityServer4.Shared.Helpers;
1418

1519
namespace Skoruba.IdentityServer4.Admin
@@ -49,7 +53,7 @@ public static async Task Main(string[] args)
4953
private static async Task ApplyDbMigrationsWithDataSeedAsync(string[] args, IConfiguration configuration, IHost host)
5054
{
5155
var applyDbMigrationWithDataSeedFromProgramArguments = args.Any(x => x == SeedArgs);
52-
if (applyDbMigrationWithDataSeedFromProgramArguments) args = args.Except(new[] {SeedArgs}).ToArray();
56+
if (applyDbMigrationWithDataSeedFromProgramArguments) args = args.Except(new[] { SeedArgs }).ToArray();
5357

5458
var seedConfiguration = configuration.GetSection(nameof(SeedConfiguration)).Get<SeedConfiguration>();
5559
var databaseMigrationsConfiguration = configuration.GetSection(nameof(DatabaseMigrationsConfiguration))
@@ -79,6 +83,10 @@ private static IConfiguration GetConfiguration(string[] args)
7983
configurationBuilder.AddUserSecrets<Startup>();
8084
}
8185

86+
var configuration = configurationBuilder.Build();
87+
88+
configuration.AddAzureKeyVaultConfiguration(configurationBuilder);
89+
8290
configurationBuilder.AddCommandLine(args);
8391
configurationBuilder.AddEnvironmentVariables();
8492

@@ -89,6 +97,8 @@ public static IHostBuilder CreateHostBuilder(string[] args) =>
8997
Host.CreateDefaultBuilder(args)
9098
.ConfigureAppConfiguration((hostContext, configApp) =>
9199
{
100+
var configurationRoot = configApp.Build();
101+
92102
configApp.AddJsonFile("serilog.json", optional: true, reloadOnChange: true);
93103
configApp.AddJsonFile("identitydata.json", optional: true, reloadOnChange: true);
94104
configApp.AddJsonFile("identityserverdata.json", optional: true, reloadOnChange: true);
@@ -104,6 +114,8 @@ public static IHostBuilder CreateHostBuilder(string[] args) =>
104114
configApp.AddUserSecrets<Startup>();
105115
}
106116

117+
configurationRoot.AddAzureKeyVaultConfiguration(configApp);
118+
107119
configApp.AddEnvironmentVariables();
108120
configApp.AddCommandLine(args);
109121
})

‎src/Skoruba.IdentityServer4.Admin/appsettings.json

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,5 +72,14 @@
7272
},
7373
"DataProtectionConfiguration": {
7474
"ProtectKeysWithAzureKeyVault": false
75+
},
76+
77+
"AzureKeyVaultConfiguration": {
78+
"AzureKeyVaultEndpoint": "",
79+
"ClientId": "",
80+
"ClientSecret": "",
81+
"UseClientCredentials": true,
82+
"DataProtectionKeyIdentifier": "",
83+
"ReadConfigurationFromKeyVault": false
7584
}
7685
}

‎src/Skoruba.IdentityServer4.STS.Identity/Program.cs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,10 @@ private static IConfiguration GetConfiguration(string[] args)
5050
configurationBuilder.AddUserSecrets<Startup>();
5151
}
5252

53+
var configuration = configurationBuilder.Build();
54+
55+
configuration.AddAzureKeyVaultConfiguration(configurationBuilder);
56+
5357
configurationBuilder.AddCommandLine(args);
5458
configurationBuilder.AddEnvironmentVariables();
5559

@@ -60,6 +64,8 @@ public static IHostBuilder CreateHostBuilder(string[] args) =>
6064
Host.CreateDefaultBuilder(args)
6165
.ConfigureAppConfiguration((hostContext, configApp) =>
6266
{
67+
var configurationRoot = configApp.Build();
68+
6369
configApp.AddJsonFile("serilog.json", optional: true, reloadOnChange: true);
6470

6571
var env = hostContext.HostingEnvironment;
@@ -71,6 +77,8 @@ public static IHostBuilder CreateHostBuilder(string[] args) =>
7177
configApp.AddUserSecrets<Startup>();
7278
}
7379

80+
configurationRoot.AddAzureKeyVaultConfiguration(configApp);
81+
7482
configApp.AddEnvironmentVariables();
7583
configApp.AddCommandLine(args);
7684
})

‎src/Skoruba.IdentityServer4.STS.Identity/appsettings.json

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,6 @@
3232
"UseSigningCertificateForAzureKeyVault": false,
3333
"UseValidationCertificateForAzureKeyVault": false
3434
},
35-
"AzureKeyVaultConfiguration": {
36-
"AzureKeyVaultEndpoint": "",
37-
"ClientId": "",
38-
"ClientSecret": "",
39-
"UseClientCredentials": true,
40-
"IdentityServerCertificateName": "",
41-
"DataProtectionKeyIdentifier": ""
42-
},
4335
"RegisterConfiguration": {
4436
"Enabled": true
4537
},
@@ -89,5 +81,14 @@
8981
},
9082
"DataProtectionConfiguration": {
9183
"ProtectKeysWithAzureKeyVault": false
84+
},
85+
"AzureKeyVaultConfiguration": {
86+
"AzureKeyVaultEndpoint": "",
87+
"ClientId": "",
88+
"ClientSecret": "",
89+
"UseClientCredentials": true,
90+
"IdentityServerCertificateName": "",
91+
"DataProtectionKeyIdentifier": "",
92+
"ReadConfigurationFromKeyVault": false
9293
}
9394
}

‎src/Skoruba.IdentityServer4.Shared/Configuration/Common/AzureKeyVaultConfiguration.cs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,7 @@ public class AzureKeyVaultConfiguration
1515
public string IdentityServerCertificateName { get; set; }
1616

1717
public string DataProtectionKeyIdentifier { get; set; }
18+
19+
public bool ReadConfigurationFromKeyVault { get; set; }
1820
}
1921
}

‎src/Skoruba.IdentityServer4.Shared/Helpers/StartupHelpers.cs

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
using Microsoft.Azure.Services.AppAuthentication;
66
using Microsoft.EntityFrameworkCore;
77
using Microsoft.Extensions.Configuration;
8+
using Microsoft.Extensions.Configuration.AzureKeyVault;
89
using Microsoft.Extensions.DependencyInjection;
910
using SendGrid;
1011
using Skoruba.IdentityServer4.Shared.Configuration.Common;
@@ -67,5 +68,31 @@ public static void AddDataProtection<TDbContext>(this IServiceCollection service
6768
}
6869
}
6970
}
71+
72+
public static void AddAzureKeyVaultConfiguration(this IConfiguration configuration, IConfigurationBuilder configurationBuilder)
73+
{
74+
if (configuration.GetSection(nameof(AzureKeyVaultConfiguration)).Exists())
75+
{
76+
var azureKeyVaultConfiguration = configuration.GetSection(nameof(AzureKeyVaultConfiguration)).Get<AzureKeyVaultConfiguration>();
77+
78+
if (azureKeyVaultConfiguration.ReadConfigurationFromKeyVault)
79+
{
80+
if (azureKeyVaultConfiguration.UseClientCredentials)
81+
{
82+
configurationBuilder.AddAzureKeyVault(azureKeyVaultConfiguration.AzureKeyVaultEndpoint,
83+
azureKeyVaultConfiguration.ClientId, azureKeyVaultConfiguration.ClientSecret);
84+
}
85+
else
86+
{
87+
var keyVaultClient = new KeyVaultClient(
88+
new KeyVaultClient.AuthenticationCallback(new AzureServiceTokenProvider()
89+
.KeyVaultTokenCallback));
90+
91+
configurationBuilder.AddAzureKeyVault(azureKeyVaultConfiguration.AzureKeyVaultEndpoint,
92+
keyVaultClient, new DefaultKeyVaultSecretManager());
93+
}
94+
}
95+
}
96+
}
7097
}
7198
}

0 commit comments

Comments
 (0)