Open Rookian opened 4 years ago
@Rookian
I think the cause is here. https://github.com/Azure/azure-libraries-for-net/blob/master/src/ResourceManagement/ResourceManager/Authentication/AzureCredentials.cs#L129-L154
KeyVault data-plane client actually need a different adSettings.TokenAudience
from management/graphrbac. If credential of service principal is provided, it will use it to obtain a token for KeyVault data-plane client. But if in the code, managementToken
and graphToken
is provided instead, code here cannot auth correctly.
One way to solve is e.g. using Microsoft.Azure.KeyVault
lib directly, when handling key/secret, after vault is created via Fluent SDK.
I created an Azure Key Vault and defined Access Policies for a group of which I am a member of. In the Azure Portal I can see that the Access Policies are defined correctly (All Access to Keys, Secrets and Certificates). The whole authentication is using
AzureServiceTokenProvider
withRunAs=Developer; DeveloperTool=AzureCli
(I also tried it with a Service Principal).Code to connect to Azure:
After I created Azure Key Vault successfully, I wanted to add a Key.
This fails with
I tried to create a separate instance of
KeyVaultManager
, but I am not allowed to use https://vault.azure.net/ as a resource.I have been able to create a
Key
by hand using the Azure Portal and by using the Azure CLI directly without any problems.az keyvault key create --name xyz123 --vault-name $keyVaultName -o none
Exception or Stack Trace
Setup (please complete the following information):
Any help is appreciated :)
Update: I could find out that when I use a Service Principal together with
SdkContext.AzureCredentialsFactory.FromServicePrincipal
, I can create Azure Key Vault Keys successfully. Whereas manually getting an instance ofAzureCredentials
by usingAzureServiceTokenProvider
is not working wether it using Azure CLI or Service Principal.