View Source ExSecrets.Providers.AzureKeyVault (ex_secrets v0.3.4)

Azure Key Vault provider provides secrets from an Azure Key Vault through a rest API.

configuration

Configuration

You can configure this provider as shown below. Either client_secret or client_cert_path is required to implement authentication. Client client_certificate_? is recommended for security. If you provide both, client_certificate_? is used. All other config options are mandatory.

    config :ex_secrets, :providers, %{
      azure_key_vault: %{
        tenant_id: "tenant-id",
        client_id: "client-id",
        client_secret: "client-secret",
        client_certificate_string: "base 64 encoded contents of cert.key",
        client_certificate_path: "/path/cert.key",
        client_certificate_x5t: "x5t",
        key_vault_name: "key-vault-name"
      }

See notes below on setting up authentication.

authentication

Authentication

The service pricipal being used must have a role that can access the secrets eg Key Vault Secrets User.

secret-authentication

Secret Authentication

This is prety straing forward. See the stps below from Being Chat Here is a step-by-step guide to generate a secret for an app on Azure AD App Registration Secrets page:

  1. Sign in to the Azure portal.
  2. Navigate to the Azure Active Directory > App registrations > Owned applications.
  3. Select your application.
  4. Click on Certificates & secrets > Client secrets > New client secret.
  5. Type a description and an expiration for the client’s secret.
  6. Click Add.

For more information on generating client secrets in Azure AD, please refer to 12

certificate-authentication

Certificate Authentication

MacOS and many Linux distributions come with pre-compiled OpenSSL packages. You can run the following command directly from a shell to confirm if OpenSSL has already been installed.

Create a Certificate Signing Request (.csr file) and generate a private key (.key file) using the following command:

openssl req -newkey rsa:4096 -nodes -keyout mycert.key -batch -out mycert.csr

This command will generate a simple CSR and download a 4096-bit private key in your current directory for self-signature.

Next, self-sign the certificate using the private key that was just generated:

openssl x509 -key mycert.key -in mycert.csr -req -days 3650 -out mycert.crt

You may replace validity period 3650 with any number of days you wish. Just be aware that once the period of validity has expired, you will need to replace the certificate with a new one.

Upload the .crt file to Azure portal using the Being Chat steps below.

Here is a step-by-step guide to upload a certificate for an app on Azure AD App Registration Secrets page:

  1. Sign in to the Azure portal.
  2. Navigate to the Azure Active Directory > App registrations > Owned applications.
  3. Select your application.
  4. Click on Certificates & secrets > Certificates > Upload certificate.
  5. Browse to the .crt certificate file saved on your local machine and select it.
  6. Type a description for the certificate.
  7. Click Add.

Finally generate the x5t JWT header required by Entra using the command below. See https://learn.microsoft.com/en-us/entra/identity-platform/certificate-credentials#assertion-format.

openssl x509 -in mycert.crt -fingerprint -noout | sed 's/SHA1 Fingerprint=//g' | sed 's/://g' | xxd -r -ps | base64

Save the value as client_certificate_x5t in the config.

Link to this section Summary

Functions

Returns a specification to start this module under a supervisor.

Callback implementation for ExSecrets.Providers.Behaviour.get/1.

Callback implementation for GenServer.init/1.

Callback implementation for ExSecrets.Providers.Behaviour.reset/0.

Link to this section Functions

Returns a specification to start this module under a supervisor.

See Supervisor.

Callback implementation for ExSecrets.Providers.Behaviour.get/1.

Callback implementation for GenServer.init/1.

Callback implementation for ExSecrets.Providers.Behaviour.reset/0.

Callback implementation for ExSecrets.Providers.Behaviour.set/2.