I've been working on this for several days now, and after reading many documentations on this I am absolutely out of ideas.
What I've done so far:
- Created three web apps (DEV, UAT, PROD) and switched System Assigned to ON to create a Managed Identity. This also registered the web applications into the Azure Active Directory.
- Registered an application in Azure Active Directory that includes redirect URI to UAT, DEV, Prod, and local URL.
- Created Key Vault under the same resource group as the web apps for DEV, UAT, PROD.
- Included all four applications in the Access Policy of the Key vault with GET and LIST permissions.
- App Service Authentication is set to OFF (app service -> Authentication/Authorization -> OFF). We're using another means of user authentication.
- After this setup, the key vault is accessible on localhost but not on the deployed environment. The reason why I believe so is because it's not retrieving the connectionString from the key vault.
- I've consumed all sorts of documentation on this including https://learn.microsoft.com/en-us/azure/key-vault/service-to-service-authentication.
Project is .Net Framework 4.7.2
In the code, I have which retrieves my secrets locally but not on deployed:
public static string GetSecret(string SecretName, string vaultURL) { var azureServiceTokenProvider = new AzureServiceTokenProvider(); var keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback)); return keyVaultClient.GetSecretAsync(vaultURL, SecretName).Result.Value; }
Please let me know what it is that I'm missing that's preventing my web app from accessing the key vault.