0

I've been working on this for several days now, and after reading many documentations on this I am absolutely out of ideas.

What I've done so far:

  • Created three web apps (DEV, UAT, PROD) and switched System Assigned to ON to create a Managed Identity. This also registered the web applications into the Azure Active Directory.
  • Registered an application in Azure Active Directory that includes redirect URI to UAT, DEV, Prod, and local URL.
  • Created Key Vault under the same resource group as the web apps for DEV, UAT, PROD.
  • Included all four applications in the Access Policy of the Key vault with GET and LIST permissions.
  • App Service Authentication is set to OFF (app service -> Authentication/Authorization -> OFF). We're using another means of user authentication.
  • After this setup, the key vault is accessible on localhost but not on the deployed environment. The reason why I believe so is because it's not retrieving the connectionString from the key vault.
  • I've consumed all sorts of documentation on this including https://learn.microsoft.com/en-us/azure/key-vault/service-to-service-authentication.
  • Project is .Net Framework 4.7.2

  • In the code, I have which retrieves my secrets locally but not on deployed:

     public static string GetSecret(string SecretName, string vaultURL)
    {
        var azureServiceTokenProvider = new AzureServiceTokenProvider();
        var keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
        return keyVaultClient.GetSecretAsync(vaultURL, SecretName).Result.Value;
    }
    

Please let me know what it is that I'm missing that's preventing my web app from accessing the key vault.

1
  • 2
    whats the error when its running in a web app?
    – 4c74356b41
    Dec 7, 2019 at 8:29

2 Answers 2

0

Make sure that you have updated any information that is specifically related to the local application. For example, if it was working locally and is not working when published, it's possible that there's a reference in the code or in the portal to the localhost environment, and this needs to be updated to the published environment. Sometimes in the app registration people will leave in a reference to the localhost URL and not add the published web page URL both there and in the code.

Also, please share the error that you are receiving.

0

After some careful debugging, I found out that my issue was actually a relatively simple one. The Key vault granted my web app using the identities, but it was this particular call that had caused my issues: ConfigurationManager.ConnectionStrings[1].Name. The purpose was to get the name of the connectionStrings to feed into my DBContext. Turns out that this didn't return the value I had expected in the production. After some changes the code, the problem is solved!

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.