如何使用AzureKeyVault调试ProtectKeys？

Question

在尝试使用AzureKeyVault保护密钥时，我遇到以下错误：

00:01:41错误]读取钥匙圈时出错。微软蔚蓝色的钥匙库。模型。KeyVaultErrorException:操作在Microsoft返回了无效的状态代码“禁止”。蔚蓝色的钥匙库。KeyVault客户端。WrapkeyWithTtpMessageAsync（String Vault BaseUrl、String keyName、String keyVersion、String算法、Byte[]值、Dictionary`2 customHeaders、CancellationToken CancellationToken）位于Microsoft。蔚蓝色的钥匙库。KeyVaultClientExtensions。微软的WrapKeyAsync（IKeyVaultClient操作、字符串键标识符、字符串算法、字节[]键、CancellationToken CancellationToken）。AspNetCore。数据保护。AzureKeyVault。AzureKeyVault加密机。微软的EncryptAsync（XElement plaintextElement）。AspNetCore。数据保护。AzureKeyVault。AzureKeyVault加密机。在微软加密（XElement plaintextElement）。AspNetCore。数据保护。XmlEncryption。XmlEncryptionExtensions。微软公司的EncryptIfEssential（IXmlEncryptor encryptor，XElement element）。AspNetCore。数据保护。钥匙管理。XmlKeyManager。微软AspNetCore。数据保护。钥匙管理。内部的IInternalXmlKeyManager。在Microsoft上创建新密钥（Guid keyId、DateTimeOffset creationDate、DateTimeOffset activationDate、DateTimeOffset expirationDate）。AspNetCore。数据保护。钥匙管理。XmlKeyManager。在Microsoft创建新密钥（DateTimeOffset activationDate、DateTimeOffset expirationDate）。AspNetCore。数据保护。钥匙管理。KeyRingProvider。微软的CreateCacheableKeyRingCore（现在是DateTimeOffset，IKey keyJustAdded）。AspNetCore。数据保护。钥匙管理。KeyRingProvider。微软AspNetCore。数据保护。钥匙管理。内部的iCachableKeyringProvider。微软的GetCacheableKeyRing（现在是DateTimeOffset）。AspNetCore。数据保护。钥匙管理。KeyRingProvider。GetCurrentKeyRingCore（日期时间utcNow）

我试着使用这样的方法：

            services.AddDataProtection()
            .SetApplicationName("APPLICATIONNAME")
            .PersistKeysToAzureBlobStorage(container, "keys.xml")
            .ProtectKeysWithAzureKeyVault(KeyVaultClientFactory.Create(), "https://KEYVAULTNAME.vault.azure.net/keys/DATAPROTECTIONKEY/");

我检查过的东西：

1. KeyVault中的应用程序具有“包裹/展开”权限（我启用了所有权限只是为了让它正常工作）

我现在不知道如何进一步调试它。我想我遗漏了一些明显的东西，欢迎提供任何建议！

Answer 1

我建议您像下面这样更改实现：

{
  "DataProtection": {
    "KeyVaultKeyId": "https://mykeyvaultname.vault.azure.net/keys/DataProtectionKey/bfc1bda979bc4081b89ab6f43bad12b8"
  }
}

var kvClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(_tokenProvider.KeyVaultTokenCallback));

services.AddDataProtection()
    .ProtectKeysWithAzureKeyVault(kvClient, settings.KeyVaultKeyId);

请确保为应用程序提供密钥库的“展开密钥”和“包裹密钥”权限。请注意，t在授予许可后需要时间来反映更改。

您可以在此处查看参考代码：

https://github.com/aspnet/AspNetCore/blob/6f197a9e5d08477b598826e0d028019c9d62ad82/src/DataProtection/AzureKeyVault/src/AzureDataProtectionBuilderExtensions.cs

其他参考资料：

https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview?view=aspnetcore-2.2

https://joonasw.net/view/using-azure-key-vault-and-azure-storage-for-asp-net-core-data-protection-keys

这就是我创业的方式。cs看起来像：

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Identity.UI;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.HttpsPolicy;
using Microsoft.AspNetCore.Mvc;
using Microsoft.EntityFrameworkCore;
using KeyVaultSample.Data;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Azure.KeyVault;
using Microsoft.Azure.Services.AppAuthentication;
using Microsoft.AspNetCore.DataProtection;
using Microsoft.AspNetCore.DataProtection.KeyManagement;
using Microsoft.AspNetCore.DataProtection.AzureStorage;


using Microsoft.WindowsAzure.Storage.Blob;
using Microsoft.Rest;
using Microsoft.WindowsAzure.Storage.Auth;

namespace KeyVaultSample
{
    public class DataProtectionSettings
    {
        public string KeyVaultKeyId { get; set; }
        public string AadTenantId { get; set; }
        public string StorageAccountName { get; set; }
        public string StorageKeyContainerName { get; set; }
        public string StorageKeyBlobName { get; set; }
    }
    public class Startup
    {
        private readonly AzureServiceTokenProvider _tokenProvider;

        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
            _tokenProvider = new AzureServiceTokenProvider();
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            services.Configure<CookiePolicyOptions>(options =>
            {
                // This lambda determines whether user consent for non-essential cookies is needed for a given request.
                options.CheckConsentNeeded = context => true;
                options.MinimumSameSitePolicy = SameSiteMode.None;
            });

            var settings = Configuration.GetSection("DataProtection").Get<DataProtectionSettings>();

            var kvClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(_tokenProvider.KeyVaultTokenCallback));

            services.AddDataProtection()
                .ProtectKeysWithAzureKeyVault(kvClient, settings.KeyVaultKeyId);
            // Replicates PersistKeysToAzureBlobStorage
            // There is no overload to give it the func it ultimately uses
            // We need to do that so that we can get refreshed tokens when needed
            services.Configure<KeyManagementOptions>(options =>
            {
                options.XmlRepository = new AzureBlobXmlRepository(() =>
                {
                    // This func is called every time before getting the blob and before modifying the blob
                    // Get access token for Storage
                    // User / managed identity needs Blob Data Contributor on the Storage Account (container was not enough)
                    string accessToken = _tokenProvider.GetAccessTokenAsync("https://storage.azure.com/", tenantId: settings.AadTenantId)
                 .GetAwaiter()
                 .GetResult();
                    // Create blob reference with token
                    var tokenCredential = new TokenCredential(accessToken);
                    var storageCredentials = new StorageCredentials(tokenCredential);
                    var uri = new Uri($"https://{settings.StorageAccountName}.blob.core.windows.net/{settings.StorageKeyContainerName}/{settings.StorageKeyBlobName}");
                    // Note this func is expected to return a new instance on each call
                    var blob = new CloudBlockBlob(uri, storageCredentials);
                    return blob;
                });
            });
            services.AddDbContext<ApplicationDbContext>(options =>
                options.UseSqlServer(
                    Configuration.GetConnectionString("DefaultConnection")));
            services.AddDefaultIdentity<IdentityUser>()
                .AddDefaultUI(UIFramework.Bootstrap4)
                .AddEntityFrameworkStores<ApplicationDbContext>();


            services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
                app.UseDatabaseErrorPage();
            }
            else
            {
                app.UseExceptionHandler("/Error");
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }

            app.UseHttpsRedirection();
            app.UseStaticFiles();
            app.UseCookiePolicy();

            app.UseAuthentication();

            app.UseMvc();
        }
    }
}

希望有帮助。