来自KeyVaultKeyResolver的Azure rsaKey始终为空

问题描述：

我通过我的MVC/Durandal网络应用程序将身份证明文件保存到Azure blob存储。我正在关注this示例，以使用Azure密钥保管库来加密Azure存储中的Blob以存储加密密钥。来自KeyVaultKeyResolver的Azure rsaKey始终为空

这里是我的代码：

 

    public async Task UploadIdentityDocumentForClient(string fileName, ParsedClientModel parsedClientModel) 
    { 
     BlobRequestOptions options = await GetBlobRequestOptions(); 
     await 
      _storageRepository.CreateEncryptedBlobFromByteArray(_storageManager, _containerName, fileName, parsedClientModel.IdentityDocumentFile, parsedClientModel.IdentityDocumentContentType, options); 
     return fileName; 
    } 


    private static async Task GetBlobRequestOptions() 
    { 
     string secretUri = WebConfigurationManager.AppSettings["SecretUri"]; 
     string secretName = WebConfigurationManager.AppSettings["SecretEncryptionName"]; 
    *1 KeyVaultKeyResolver keyVaultKeyResolver = new KeyVaultKeyResolver(GetAccessToken); 

    *2 IKey rsaKey = keyVaultKeyResolver.ResolveKeyAsync($"{secretUri}/secrets/{secretName}", CancellationToken.None).GetAwaiter().GetResult(); 
     BlobEncryptionPolicy policy = new BlobEncryptionPolicy(rsaKey, null); 
     BlobRequestOptions options = new BlobRequestOptions 
     { 
      EncryptionPolicy = policy 
     }; 
     return options; 
    } 


    public static async Task GetAccessToken(string authority, string resource, string scope) 
    { 
     string clientId = WebConfigurationManager.AppSettings["ClientId"]; 
     string clientSecret = WebConfigurationManager.AppSettings["ClientSecret"]; 
     ClientCredential clientCredential = new ClientCredential(clientId, clientSecret); 
     AuthenticationContext authenticationContext = new AuthenticationContext(authority, TokenCache.DefaultShared); 
     AuthenticationResult result = await authenticationContext.AcquireTokenAsync(resource, clientCredential); 
     if (result == null) 
     { 
      throw new InvalidOperationException(
       "GetAccessToken - Failed to obtain the Active Directory token for application."); 
     } 
    *3 return result.AccessToken; 
    } 


    public async Task CreateEncryptedBlobFromByteArray(IStorageManager storageManager, string containerName, string fileName, 
     byte[] byteArray, string contentType, BlobRequestOptions options) 
    { 
     CloudBlobContainer container = await CreateStorageContainerIfNotExists(storageManager, containerName); 
     CloudBlockBlob blob = container.GetBlockBlobReference(fileName); 
     blob.Properties.ContentType = contentType; 
     await blob.UploadFromByteArrayAsync(byteArray, 0, byteArray.Length, AccessCondition.GenerateEmptyCondition(), options, new OperationContext()); 
    }

这条线......

 

    IKey rsaKey = keyVaultKeyResolver.ResolveKeyAsync($"{secretUri}/secrets/{secretName}", CancellationToken.None).GetAwaiter().GetResult();

总是返回null。

我在上面的代码中添加了断点（* 1到* 3），并且注意到* 2总是在* 3之前被命中。这意味着KeyVaultKeyResolver（GetAccessToken）调用不会等待GetAccessToken调用返回值。

任何想法，我在做什么错？

答

我想出了我做错了什么。

凡断点2我应该用这个代码：

SymmetricKey sec = (SymmetricKey) cloudResolver 
      .ResolveKeyAsync("https://yourkeyvault.vault.azure.net/secrets/MiplanAdminLocalEncryption", 
       CancellationToken.None) 
      .GetAwaiter() 
      .GetResult();

我也有使用PowerShell中的秘密添加到我的Azure的关键库。通过管理用户界面创建密码不起作用。下面是我使用的命令：

对不起，图像，但是当作为代码样品粘贴SO不会接受上述文本甚至。

请参阅this网站的原始示例。

我找到了一种方法通过在Azure门户添加的秘密：

//If entering via Azure UI: 
    //Your secret string must be 16 characters (28 bits) long or end up being 28, 192, 256, 384, or 512 bits. 
    // Base64 encode using https://www.base64encode.org/ 
    //Take this encoded value and enter it as the secret value in the UI.

来自KeyVaultKeyResolver的Azure rsaKey始终为空

相关推荐