从Azure keyvault AzureJavaservlet获取秘密

Question

我想从天蓝色密钥库获取秘密。当我独立于主方法运行类时，它返回秘密，但当我在代码行future.get（）处集成了这个相同的代码在servlet应用程序中；在这里它得到块，它不会像死锁一样继续前进，它一直在等待，有时会得到java.util.concurrent.执行异常：java.lang.ClassCastExctive：java.lang.字符串不能被强制转换为java.util.列表和com.microsoft.azure.keyvault.models.KeyVaultError异常：状态代码401，{"错误"：{"代码"："未授权"，"消息"："AKV10001：无法解析JWT令牌：预期3个紧凑型JSON元素，找到1."}}在sun.reflect.NativeConstrtorAccessorImpl.newInstance0（本机方法）。请帮我做这件事。

public class KeyVaultTest {

private static AuthenticationResult getAccessToken(String authorization, String resource) throws InterruptedException, ExecutionException, MalformedURLException {

    String clientId = "XXX"; // Client ID
    String clientSecret = "XXX";  //Client Secret

    AuthenticationResult result = null;

    //Starts a service to fetch access token.
    ExecutorService service = null;
    try {
        service = Executors.newFixedThreadPool(1);
        AuthenticationContext context = new AuthenticationContext(authorization, false, service);

        Future<AuthenticationResult> future = null;

        //Acquires token based on client ID and client secret.
        if (clientSecret != null && clientSecret != null) {
            ClientCredential credentials = new ClientCredential(clientId, clientSecret);
            future = context.acquireToken(resource, credentials, null);
        }

        result = future.get();
    } finally {
        service.shutdown();
    }

    if (result == null) {
        throw new RuntimeException("Authentication results were null.");
    }
    return result;
}

public static void main(String[] args) {
    String vaultBase = "https://myapp-keyvault.vault.azure.net/";
    
    

    KeyVaultClient keyVaultClient = new KeyVaultClient(new KeyVaultCredentials(){
        @Override
        public String doAuthenticate(String authorization, String resource, String scope) {
            String token = null;
            try {
                AuthenticationResult authResult = getAccessToken(authorization, resource);
                token = authResult.getAccessToken();
            } catch (Exception e) {
                e.printStackTrace();
            }
            System.out.println(token);
            return token;
        }
    });

    SecretBundle secretBundle = keyVaultClient.getSecret(vaultBase, "abc");
    System.out.println(secretBundle.value());
           
     
   
}

Answer 1

您的keyvault很可能有IPv4/CIDR限制。检查你的IP，确保它在列表中，或者确保你的流量通过一个经批准的IP（VPN）路由

Answer 2

如果要在servlet应用程序中访问Azure key vault，请参考以下步骤

1. 配置Azure密钥保管库

#create service pricipal
az ad sp create-for-rbac -n "MyApp" --password "hVFkk965BuUv" --skip-assignment --sdk-auth
#set access policy
az keyvault set-policy -n <your-unique-keyvault-name> --spn <clientId-of-your-service-principal> --secret-permissions list get set delete purge

应用

a、 SDK

 <dependency>
  <groupId>com.microsoft.azure</groupId>
  <artifactId>adal4j</artifactId>
  <version>1.6.5</version>
</dependency>


<dependency>
  <groupId>com.microsoft.azure</groupId>
  <artifactId>azure-keyvault</artifactId>
  <version>1.2.4</version>
</dependency>

b、 Servlet类

        @WebServlet("/HelloServlet")
        public class HelloServlet extends HttpServlet {
        private static final long serialVersionUID = 1L;
    
        public HelloServlet() {
            super();
        }

        protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
            String appId="42e0d080-b1f3-40cf-8db6-c4c522d988c4";
            String appSecret="Gbx2eK64iqq_g_3NCA.ClJDfQpIjoae:";
            KeyVaultClient keyVaultClient = new KeyVaultClient(new AzureKeyVaultCredential(appId,appSecret));
            String vaultBaseUrl="https://testsql08.vault.azure.net/";
            String secretName="sql";
            SecretBundle secret =keyVaultClient.getSecret(vaultBaseUrl, secretName);
            System.out.println(secret.value());
            PrintWriter writer = response.getWriter();
            writer.println("<h1>Hello " + secret.value() + "</h1>");
            writer.close();
        }
    }
    
    class AzureKeyVaultCredential extends KeyVaultCredentials {
        private String appId;
        private String appSecret;
    
        public AzureKeyVaultCredential(String appId, String appSecret) {
            this.appId = appId;
            this.appSecret = appSecret;
        }
    
        @Override
        public String doAuthenticate(String authorization, String resource, String scope) {
            AuthenticationContext context = null;
            AuthenticationResult result = null;
            String token = "";
    
            try {
                context = new AuthenticationContext(authorization, false, Executors.newSingleThreadExecutor());
    
                ClientCredential credential = new ClientCredential(this.appId, this.appSecret);
    
                Future<AuthenticationResult> future = context.acquireToken(resource, credential, null);
                result = future.get(3, TimeUnit.MINUTES);
                token = result.getAccessToken();
    
            } catch (Exception e) {
                e.printStackTrace();
            }
            return token;
        }
    }