将包从“Microsoft.Extensions.Configuration.AzureKeyVault”更改为“Azure.Extensions.AspNetCore.Configuration.Secrets”

Question

我正在使用 nuget Microsoft.Extensions.Configuration.AzureKeyVault，并且在 中使用下面的 asp.net core 3.1 代码Program.cs，

我正在为 azure keyVault 进行自定义证书身份验证。还使用自定义秘密管理。

   public static IHostBuilder CreateHostBuilder(string[] args) =>
        Host.CreateDefaultBuilder(args)
            .ConfigureAppConfiguration((context, config) =>
            {
                    config.AddAzureKeyVault(new AzureKeyVaultConfigurationOptions
                    {
                        Vault = "key vault url",
                        ReloadInterval = TimeSpan.FromSeconds(15),
                        //authenticate with custom certificate
                        Client = new KeyVaultClient(CustomCertificateAuthenticationCallback),
                        Manager = new CustomKeyVaultSecretManager()
                    });
                }
            })
            .ConfigureWebHostDefaults(webBuilder =>
            {
                webBuilder.UseStartup<Startup>();
            }); 

该软件包Microsoft.Extensions.Configuration.AzureKeyVault已被弃用，我已卸载该软件包并安装了更新的软件包Azure.Extensions.AspNetCore.Configuration.Secrets。切换到这个包后，我无法弄清楚如何使用custom验证以及如何通过keyvault url

Answer 1

您可以尝试一下SecretClient方法，并参考这篇关于Azure Key Vault Configuration Provider的官方文档。

using Azure.Security.KeyVault.Secrets;
using Azure.Identity;
using Azure.Extensions.AspNetCore.Configuration.Secrets;

public static IHostBuilder CreateHostBuilder(string[] args) =>
    Host.CreateDefaultBuilder(args)
        .ConfigureAppConfiguration((context, config) =>
        {
            if (context.HostingEnvironment.IsProduction())
            {
                var builtConfig = config.Build();
                var secretClient = new SecretClient(new Uri($"https://{builtConfig["KeyVaultName"]}.vault.azure.net/"),
                                                         new DefaultAzureCredential());
                config.AddAzureKeyVault(secretClient, new KeyVaultSecretManager());


            }
        })
        .ConfigureWebHostDefaults(webBuilder =>
        {
            webBuilder.UseStartup<Startup>();
        });

SecretClient 不支持AuthenticationCallback( Microsoft.Azure.KeyVault.KeyVaultClient.AuthenticationCallback )。

如果您想使用证书进行身份验证，可以使用Azure.Identity.ClientCertificateCredential新建TokenCredential。

X509Certificate2 cer = new X509Certificate2(certPath, pfxpassword, X509KeyStorageFlags.EphemeralKeySet);
var secretClient = new SecretClient(new Uri($"https://{builtConfig["KeyVaultName"]}.vault.azure.net/"),
                                            new ClientCertificateCredential(tenantID, clientID, cer);