Skip to content
This repository was archived by the owner on Aug 3, 2024. It is now read-only.

Commit e382ab8

Browse files
agrerdembayar
agr
authored and
erdembayar
committed
Attempt at keyvault library upgrade.
1 parent e5c602b commit e382ab8

6 files changed

Lines changed: 48 additions & 35 deletions

File tree

‎src/NuGet.Services.Configuration/ConfigurationRootSecretReaderFactory.cs‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ public class ConfigurationRootSecretReaderFactory : ISecretReaderFactory
1212
{
1313
private string _vaultName;
1414
private bool _useManagedIdentity;
15+
private string _tenantId;
1516
private string _clientId;
1617
private string _certificateThumbprint;
1718
private string _storeName;
@@ -34,6 +35,7 @@ public ConfigurationRootSecretReaderFactory(IConfigurationRoot config)
3435
_useManagedIdentity = bool.Parse(useManagedIdentity);
3536
}
3637

38+
_tenantId = config[Constants.KeyVaultTenanIdKey];
3739
_clientId = config[Constants.KeyVaultClientIdKey];
3840
_certificateThumbprint = config[Constants.KeyVaultCertificateThumbprintKey];
3941
if (_useManagedIdentity && IsCertificateConfigurationProvided())
@@ -83,7 +85,8 @@ public ISecretReader CreateSecretReader()
8385
_validateCertificate);
8486

8587
keyVaultConfiguration = new KeyVaultConfiguration(
86-
_vaultName,
88+
_vaultName,
89+
_tenantId,
8790
_clientId,
8891
certificate,
8992
_sendX5c);
@@ -100,7 +103,8 @@ public ISecretInjector CreateSecretInjector(ISecretReader secretReader)
100103
private bool IsCertificateConfigurationProvided()
101104
{
102105
return !string.IsNullOrEmpty(_clientId)
103-
|| !string.IsNullOrEmpty(_certificateThumbprint);
106+
|| !string.IsNullOrEmpty(_certificateThumbprint)
107+
|| !string.IsNullOrEmpty(_tenantId);
104108
}
105109
}
106110
}

‎src/NuGet.Services.Configuration/Constants.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ public static class Constants
77
{
88
public static string KeyVaultVaultNameKey = "KeyVault_VaultName";
99
public static string KeyVaultUseManagedIdentity = "KeyVault_UseManagedIdentity";
10+
public static string KeyVaultTenanIdKey = "KeyVault_TenantId";
1011
public static string KeyVaultClientIdKey = "KeyVault_ClientId";
1112
public static string KeyVaultCertificateThumbprintKey = "KeyVault_CertificateThumbprint";
1213
public static string KeyVaultValidateCertificateKey = "KeyVault_ValidateCertificate";

‎src/NuGet.Services.KeyVault/KeyVaultConfiguration.cs‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ public class KeyVaultConfiguration
1010
{
1111
public string VaultName { get; }
1212
public bool UseManagedIdentity { get; }
13+
public string TenantId { get; }
1314
public string ClientId { get; }
1415
public X509Certificate2 Certificate { get; }
1516
public bool SendX5c { get; }
@@ -32,10 +33,11 @@ public KeyVaultConfiguration(string vaultName)
3233
/// The constructor for keyvault configuration when using the certificate
3334
/// </summary>
3435
/// <param name="vaultName">The name of the keyvault</param>
36+
/// <param name="tenantId">AAD tenant ID where respective client app is registered.</param>
3537
/// <param name="clientId">Keyvault client id</param>
3638
/// <param name="certificate">Certificate required to access the keyvault</param>
3739
/// <param name="sendX5c">SendX5c property</param>
38-
public KeyVaultConfiguration(string vaultName, string clientId, X509Certificate2 certificate, bool sendX5c = false)
40+
public KeyVaultConfiguration(string vaultName, string tenantId, string clientId, X509Certificate2 certificate, bool sendX5c = false)
3941
{
4042
if (string.IsNullOrWhiteSpace(vaultName))
4143
{
@@ -48,6 +50,7 @@ public KeyVaultConfiguration(string vaultName, string clientId, X509Certificate2
4850
}
4951

5052
UseManagedIdentity = false;
53+
TenantId = tenantId;
5154
VaultName = vaultName;
5255
ClientId = clientId;
5356
Certificate = certificate ?? throw new ArgumentNullException(nameof(certificate));

‎src/NuGet.Services.KeyVault/KeyVaultConfigurationExtensions.cs‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
// Copyright (c) .NET Foundation. All rights reserved.
2+
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
3+
4+
using System;
5+
using System.Collections.Generic;
6+
using System.Linq;
7+
using System.Text;
8+
using System.Threading.Tasks;
9+
10+
namespace NuGet.Services.KeyVault
11+
{
12+
public static class KeyVaultConfigurationExtensions
13+
{
14+
public static Uri GetKeyVaultUri(this KeyVaultConfiguration self)
15+
{
16+
var uriString = $"https://{self.VaultName}.vault.azure.net/";
17+
return new Uri(uriString);
18+
}
19+
}
20+
}

‎src/NuGet.Services.KeyVault/KeyVaultReader.cs‎

Lines changed: 15 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@
33

44
using System;
55
using System.Threading.Tasks;
6-
using Microsoft.Azure.KeyVault;
7-
using Microsoft.Azure.Services.AppAuthentication;
6+
using Azure.Core;
7+
using Azure.Identity;
8+
using Azure.Security.KeyVault.Secrets;
89
using Microsoft.Extensions.Logging;
9-
using Microsoft.IdentityModel.Clients.ActiveDirectory;
1010

1111
namespace NuGet.Services.KeyVault
1212
{
@@ -17,9 +17,7 @@ namespace NuGet.Services.KeyVault
1717
public class KeyVaultReader : ISecretReader
1818
{
1919
private readonly KeyVaultConfiguration _configuration;
20-
private readonly string _vault;
21-
private readonly Lazy<KeyVaultClient> _keyVaultClient;
22-
private ClientAssertionCertificate _clientAssertionCertificate;
20+
private readonly Lazy<SecretClient> _keyVaultClient;
2321

2422
protected string VaultBaseUrl => _vault;
2523
protected KeyVaultClient KeyVaultClient => _keyVaultClient.Value;
@@ -32,8 +30,7 @@ public KeyVaultReader(KeyVaultConfiguration configuration)
3230
}
3331

3432
_configuration = configuration;
35-
_vault = $"https://{_configuration.VaultName}.vault.azure.net/";
36-
_keyVaultClient = new Lazy<KeyVaultClient>(InitializeClient);
33+
_keyVaultClient = new Lazy<SecretClient>(InitializeClient);
3734
}
3835

3936
public async Task<string> GetSecretAsync(string secretName)
@@ -43,7 +40,8 @@ public async Task<string> GetSecretAsync(string secretName)
4340

4441
public async Task<string> GetSecretAsync(string secretName, ILogger logger)
4542
{
46-
var secret = await _keyVaultClient.Value.GetSecretAsync(_vault, secretName);
43+
var response = await _keyVaultClient.Value.GetSecretAsync(secretName);
44+
var secret = response.Value;
4745
return secret.Value;
4846
}
4947

@@ -54,35 +52,23 @@ public async Task<ISecret> GetSecretObjectAsync(string secretName)
5452

5553
public async Task<ISecret> GetSecretObjectAsync(string secretName, ILogger logger)
5654
{
57-
var secret = await _keyVaultClient.Value.GetSecretAsync(_vault, secretName);
58-
return new KeyVaultSecret(secretName, secret.Value, secret.Attributes.Expires);
55+
var response = await _keyVaultClient.Value.GetSecretAsync(secretName);
56+
var secret = response.Value;
57+
return new KeyVaultSecret(secretName, secret.Value, secret.Properties.ExpiresOn);
5958
}
6059

61-
private KeyVaultClient InitializeClient()
60+
private SecretClient InitializeClient()
6261
{
62+
TokenCredential credential = null;
6363
if (_configuration.UseManagedIdentity)
6464
{
65-
var azureServiceTokenProvider = new AzureServiceTokenProvider();
66-
return new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
65+
credential = new DefaultAzureCredential();
6766
}
6867
else
6968
{
70-
_clientAssertionCertificate = new ClientAssertionCertificate(_configuration.ClientId, _configuration.Certificate);
71-
return new KeyVaultClient(GetTokenAsync);
69+
credential = new ClientCertificateCredential(_configuration.TenantId, _configuration.ClientId, _configuration.Certificate);
7270
}
73-
}
74-
75-
private async Task<string> GetTokenAsync(string authority, string resource, string scope)
76-
{
77-
var authContext = new AuthenticationContext(authority);
78-
var result = await authContext.AcquireTokenAsync(resource, _clientAssertionCertificate, _configuration.SendX5c);
79-
80-
if (result == null)
81-
{
82-
throw new InvalidOperationException("Bearer token acquisition needed to call the KeyVault service failed");
83-
}
84-
85-
return result.AccessToken;
71+
return new SecretClient(_configuration.GetKeyVaultUri(), credential);
8672
}
8773
}
8874

‎src/NuGet.Services.KeyVault/NuGet.Services.KeyVault.csproj‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,8 @@
66
</PropertyGroup>
77

88
<ItemGroup>
9-
<PackageReference Include="Microsoft.Azure.KeyVault">
10-
<Version>3.0.5</Version>
11-
</PackageReference>
9+
<PackageReference Include="Azure.Identity" Version="1.8.0" />
10+
<PackageReference Include="Azure.Security.KeyVault.Secrets" Version="4.4.0" />
1211
<PackageReference Include="Microsoft.Azure.Services.AppAuthentication">
1312
<Version>1.4.0</Version>
1413
</PackageReference>

0 commit comments

Comments
 (0)