c# - Getting Unathorized when trying to get a secret from Azure key Vault

Question

I'm using Microsoft.Azure.keyVault trying to get a secret from a key vault in Azure.

I've registered an application as both Native and Web API.

Logging on to the AD is successful (can confirm this by getting a valid AccessToken on AuthenticationContext.AcquireTokenAsync).

In Azure AD both applications have been given Access Control (IAM) and Access Policies in the Key Vault. I have confirmed that the Key Vault Base Url and the Secret Name are correct but when making the following call

var sec = kv.GetSecretAsync("https://xxxxxxx.vault.azure.net", "xxsecretnamexx").GetAwaiter().GetResult();

I keep getting the error

{"Operation returned an invalid status code 'Unauthorized'"}    Microsoft.Azure.KeyVault.Models.KeyVaultErrorException

One sidenote: Attempting to do this by logging in as a user. The code to get the token is as follows

.AcquireTokenAsync(resourceUri,clientId, new Uri(redirectUri), new PlatformParameters(PromptBehavior.SelectAccount))

We have working code using the id and secret of an registered Azure AD application that has rights to the key vault.

Trying to do the same thing without using the id and secret of an associated registered Azure AD application but instead have a login prompt displayed when getting the access token to Azure AD.

Answer 1

I test it with the following code, it works correctly on my side. The resourceUri is https://vault.azure.net

 static string appId = "application Id";
 static string tenantId = "tenant id";
 static string uri = "http://localhost:13526"; //redirect uri
 static void Main(string[] args)
 {
    var kv = new KeyVaultClient(GetAccessToken);
    var scret = kv.GetSecretAsync("https://xxxx.vault.azure.net", "xxxx").GetAwaiter().GetResult();
 }

 public static async Task<string> GetAccessToken(string azureTenantId,string clientId,string redirectUri)
 {
       var context = new AuthenticationContext("https://login.windows.net/" + tenantId);
       var tokenResult = await context.AcquireTokenAsync("https://vault.azure.net", appId, new Uri(uri), new PlatformParameters(PromptBehavior.SelectAccount));
       return tokenResult.AccessToken;
  }

The following is my detail steps.

1.Registry an native application

2.Add KeyVault Permission

3.Add the above code and test it on my side.

Packages.config

<?xml version="1.0" encoding="utf-8"?>
<packages>
  <package id="Hyak.Common" version="1.0.2" targetFramework="net461" />
  <package id="Microsoft.Azure.Common" version="2.0.4" targetFramework="net461" />
  <package id="Microsoft.Azure.Common.Dependencies" version="1.0.0" targetFramework="net461" />
  <package id="Microsoft.Azure.KeyVault" version="1.0.0" targetFramework="net461" />
  <package id="Microsoft.Bcl" version="1.1.9" targetFramework="net461" />
  <package id="Microsoft.Bcl.Async" version="1.0.168" targetFramework="net461" />
  <package id="Microsoft.Bcl.Build" version="1.0.14" targetFramework="net461" />
  <package id="Microsoft.IdentityModel.Clients.ActiveDirectory" version="3.17.0" targetFramework="net461" />
  <package id="Microsoft.Net.Http" version="2.2.22" targetFramework="net461" />
  <package id="Newtonsoft.Json" version="6.0.4" targetFramework="net461" />
</packages>