Photo by Jude Beck on Unsplash
Connecting from a Managed Service Identity (MSI) to an Azure Key Vault is pretty well documented. But how can we achieve this from a program on a laptop using user account ?
Azure Active Directory Application
First we will require an application registered to the Azure Active Directory of your subscription, with the right user_impersonation.
Write down, the application identifier, and the redirect uri if any, and the directory identifier of your subscription.
Program
In your program, you will have to:
- add the package Microsoft.Identity.Client to your application
- Get the Token from Azure using the following code
IPublicClientApplication app = PublicClientApplicationBuilder.Create(applicationId)
.WithRedirectUri(redirectUri)
.WithAuthority($"https://login.microsoftonline.com/{directoryId}")
.WithTenantId(directoryId)
.Build();
string[] scopes = new string[] { "https://vault.azure.net/user_impersonation" };
Microsoft.Identity.Client.AuthenticationResult result = null;
var accounts = await app.GetAccountsAsync();
try
{
result = await app.AcquireTokenSilent(scopes,
accounts.FirstOrDefault())
.ExecuteAsync();
}
catch (MsalUiRequiredException msalUiEx)
{
// A MsalUiRequiredException happened on AcquireTokenSilent.
// This indicates you need to call AcquireTokenInteractive to acquire a token
//System.Diagnostics.Debug.WriteLine($"MsalUiRequiredException: {msalUiEx.Message}");
try
{
result = await app.AcquireTokenInteractive(scopes)
.ExecuteAsync();
// Msal.Utils.extractIdToken
}
catch (MsalException msalex)
{
throw;
}
}
- then, we can instantiate a keyvault client using the token
HttpClient client = new HttpClient();
keyVaultClient = new KeyVaultClient(async (authority, resource, scope) =>
{
return result.AccessToken;
}, client);
Note that
- AcquireTokenInteractive will request from the user to fill its account / password using the configured parameters (using only work and school account or not) in a popup
- the token is available in result.AccessToken, which will expire at result.ExpiresOn
- the user account has to have an access policy to the key vault
- Scopes cannot be combined if it relates to different resources ( "https://vault.azure.net/user_impersonation", "User.Read" can't work for example, 2 calls has to be made)
- Github issue providing a lot of informations
Hope this helps !
Top comments (0)