Skip to content

Commit ba9ba4a

Browse files
ShannonLeavittShannonLeavitt
authored
Merge pull request #257080 from wchigit/how-to-kv
Sample code for integration with Azure Key Vault
2 parents 254b13b + 89e353c commit ba9ba4a

File tree

3 files changed

+224
-40
lines changed

3 files changed

+224
-40
lines changed

‎articles/service-connector/how-to-integrate-key-vault.md

Lines changed: 58 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,16 @@ author: maud-lv
55
ms.author: malev
66
ms.service: service-connector
77
ms.topic: how-to
8-
ms.date: 08/11/2022
8+
ms.date: 11/02/2023
99
ms.custom: event-tier1-build-2022
1010
---
1111

1212
# Integrate Azure Key Vault with Service Connector
1313

1414
> [!NOTE]
15-
> When you use Service Connector to connect your key vault or manage key vault connections, Service Connector use your token to perform the corresponding operations.
15+
> When you use Service Connector to connect your key vault or manage key vault connections, Service Connector uses your token to perform the corresponding operations.
1616
17-
This page shows the supported authentication types and client types of Azure Key Vault using Service Connector. You might still be able to connect to Azure Key Vault in other programming languages without using Service Connector. This page also shows default environment variable names and values (or Spring Boot configuration) you get when you create the service connection. You can learn more about [Service Connector environment variable naming convention](concept-service-connector-internals.md).
17+
This page shows supported authentication methods and clients, and shows sample code you can use to connect Azure Key Vault to other cloud services using Service Connector. You might still be able to connect to Azure Key Vault in other programming languages without using Service Connector. This page also shows default environment variable names and values (or Spring Boot configuration) you get when you create the service connection, as well as sample code.
1818

1919
## Supported compute service
2020

@@ -26,62 +26,88 @@ This page shows the supported authentication types and client types of Azure Key
2626

2727
Supported authentication and clients for App Service, Container Apps and Azure Spring Apps:
2828

29-
### [Azure App Service](#tab/app-service)
30-
3129
| Client type | System-assigned managed identity | User-assigned managed identity | Secret / connection string | Service principal |
3230
|--------------------|--------------------------------------|--------------------------------------|----------------------------|--------------------------------------|
3331
| .NET | ![yes icon](./media/green-check.png) | ![yes icon](./media/green-check.png) | | ![yes icon](./media/green-check.png) |
3432
| Java | ![yes icon](./media/green-check.png) | ![yes icon](./media/green-check.png) | | ![yes icon](./media/green-check.png) |
35-
| Java - Spring Boot | | ![yes icon](./media/green-check.png) | | ![yes icon](./media/green-check.png) |
33+
| Java - Spring Boot | ![yes icon](./media/green-check.png) | ![yes icon](./media/green-check.png) | | ![yes icon](./media/green-check.png) |
3634
| Node.js | ![yes icon](./media/green-check.png) | ![yes icon](./media/green-check.png) | | ![yes icon](./media/green-check.png) |
3735
| Python | ![yes icon](./media/green-check.png) | ![yes icon](./media/green-check.png) | | ![yes icon](./media/green-check.png) |
3836
| None | ![yes icon](./media/green-check.png) | ![yes icon](./media/green-check.png) | | ![yes icon](./media/green-check.png) |
3937

40-
### [Azure Container Apps](#tab/container-apps)
41-
42-
| Client type | System-assigned managed identity | User-assigned managed identity | Secret / connection string | Service principal |
43-
|--------------------|--------------------------------------|--------------------------------------|----------------------------|--------------------------------------|
44-
| .NET | ![yes icon](./media/green-check.png) | ![yes icon](./media/green-check.png) | | ![yes icon](./media/green-check.png) |
45-
| Java | ![yes icon](./media/green-check.png) | ![yes icon](./media/green-check.png) | | ![yes icon](./media/green-check.png) |
46-
| Java - Spring Boot | | ![yes icon](./media/green-check.png) | | ![yes icon](./media/green-check.png) |
47-
| Node.js | ![yes icon](./media/green-check.png) | ![yes icon](./media/green-check.png) | | ![yes icon](./media/green-check.png) |
48-
| Python | ![yes icon](./media/green-check.png) | ![yes icon](./media/green-check.png) | | ![yes icon](./media/green-check.png) |
49-
| None | ![yes icon](./media/green-check.png) | ![yes icon](./media/green-check.png) | | ![yes icon](./media/green-check.png) |
38+
---
5039

51-
### [Azure Spring Apps](#tab/spring-apps)
40+
## Default environment variable names or application properties and sample code
5241

53-
| Client type | System-assigned managed identity | User-assigned managed identity | Secret / connection string | Service principal |
54-
|--------------------|--------------------------------------|--------------------------------------|----------------------------|--------------------------------------|
55-
| .NET | ![yes icon](./media/green-check.png) | | | ![yes icon](./media/green-check.png) |
56-
| Java | ![yes icon](./media/green-check.png) | | | ![yes icon](./media/green-check.png) |
57-
| Java - Spring Boot | ![yes icon](./media/green-check.png) | | | ![yes icon](./media/green-check.png) |
58-
| Node.js | ![yes icon](./media/green-check.png) | | | ![yes icon](./media/green-check.png) |
59-
| Python | ![yes icon](./media/green-check.png) | | | ![yes icon](./media/green-check.png) |
60-
| None | ![yes icon](./media/green-check.png) | | | ![yes icon](./media/green-check.png) |
42+
Use the connection details below to connect compute services to Azure Key Vault. For each example below, replace the placeholder texts `<vault-name>`, `<client-ID>`, `<client-secret>`, and `<tenant-id>` with your key vault name, client-ID, client secret and tenant ID. For more information about naming conventions, check the [Service Connector internals](concept-service-connector-internals.md#configuration-naming-convention) article.
6143

62-
---
44+
### System-assigned managed identity
6345

64-
## Default environment variable names or application properties
46+
#### SpringBoot client type
6547

66-
Use the connection details below to connect compute services to Azure Key Vault. For each example below, replace the placeholder texts `<vault-name>`, `<client-ID>`, `<client-secret>`, and `<tenant-id>` with your key vault name, client-ID, client secret and tenant ID.
48+
| Default environment variable name | Description | Example value |
49+
|-----------------------------------|-----------------------------|-------------------------------------------|
50+
| azure.keyvault.uri | Your Key Vault endpoint URL | `"https://<vault-name>.vault.azure.net/"` |
51+
| azure.keyvault.scope | Your Azure RBAC scope | `https://management.azure.com/.default` |
52+
| spring.cloud.azure.keyvault.secret.credential.managed-identity-enabled | Whether to enable managed identity for Spring Cloud Azure version 4.0 and above | `true` |
53+
| spring.cloud.azure.keyvault.secret.endpoint | Your Key Vault endpoint URL for Spring Cloud Azure version 4.0 and above | `"https://<vault-name>.vault.azure.net/"` |
6754

68-
### System-assigned managed identity
55+
#### Other client types
6956

7057
| Default environment variable name | Description | Example value |
7158
|-----------------------------------|-------------------------|-----------------------------------------|
7259
| AZURE_KEYVAULT_SCOPE | Your Azure RBAC scope | `https://management.azure.com/.default` |
7360
| AZURE_KEYVAULT_RESOURCEENDPOINT | Your Key Vault endpoint | `https://<vault-name>.vault.azure.net/` |
7461

62+
#### Sample code
63+
64+
Refer to the steps and code below to connect to Azure Key Vault using a system-assigned managed identity.
65+
[!INCLUDE [code sample for key vault](./includes/code-keyvault-me-id.md)]
66+
7567
### User-assigned managed identity
7668

69+
#### SpringBoot client type
70+
71+
| Default environment variable name | Description | Example value |
72+
|-----------------------------------|-----------------------------|-------------------------------------------|
73+
| azure.keyvault.uri | Your Key Vault endpoint URL | `"https://<vault-name>.vault.azure.net/"` |
74+
| azure.keyvault.client-id | Your Client ID | `<client-ID>` |
75+
| azure.keyvault.scope | Your Azure RBAC scope | `https://management.azure.com/.default` |
76+
| spring.cloud.azure.keyvault.secret.credential.managed-identity-enabled | Whether to enable managed identity for Spring Cloud Azure version 4.0 and above | `true` |
77+
| spring.cloud.azure.keyvault.secret.endpoint | Your Key Vault endpoint URL for Spring Cloud Azure version 4.0 and above | `"https://<vault-name>.vault.azure.net/"` |
78+
| spring.cloud.azure.keyvault.secret.credential.client-id | Your Client ID for Spring Cloud Azure version 4.0 and above | `<client-ID>` |
79+
80+
#### Other client types
81+
7782
| Default environment variable name | Description | Example value |
7883
|-----------------------------------|-------------------------|-----------------------------------------|
7984
| AZURE_KEYVAULT_SCOPE | Your Azure RBAC scope | `https://management.azure.com/.default` |
8085
| AZURE_KEYVAULT_RESOURCEENDPOINT | Your Key Vault endpoint | `https://<vault-name>.vault.azure.net/` |
8186
| AZURE_KEYVAULT_CLIENTID | Your Client ID | `<client-ID>` |
8287

88+
#### Sample code
89+
90+
Refer to the steps and code below to connect to Azure Key Vault using a system-assigned managed identity.
91+
[!INCLUDE [code sample for key vault](./includes/code-keyvault-me-id.md)]
92+
8393
### Service principal
8494

95+
#### SpringBoot client type
96+
97+
| Default environment variable name | Description | Example value |
98+
|-----------------------------------|-----------------------------|-------------------------------------------|
99+
| azure.keyvault.uri | Your Key Vault endpoint URL | `"https://<vault-name>.vault.azure.net/"` |
100+
| azure.keyvault.client-id | Your Client ID | `<client-ID>` |
101+
| azure.keyvault.client-key | Your Client secret | `<client-secret>` |
102+
| azure.keyvault.tenant-id | Your Tenant ID | `<tenant-id>` |
103+
| azure.keyvault.scope | Your Azure RBAC scope | `https://management.azure.com/.default` |
104+
| spring.cloud.azure.keyvault.secret.endpoint | Your Key Vault endpoint URL for Spring Cloud Azure version 4.0 and above | `"https://<vault-name>.vault.azure.net/"` |
105+
| spring.cloud.azure.keyvault.secret.credential.client-id | Your Client ID for Spring Cloud Azure version 4.0 and above | `<client-ID>` |
106+
| spring.cloud.azure.keyvault.secret.credential.client-secret | Your Client secret for Spring Cloud Azure version 4.0 and above | `<client-secret>` |
107+
| spring.cloud.azure.keyvault.secret.profile.tenant-id | Your Tenant ID for Spring Cloud Azure version 4.0 and above | `<tenant-id>` |
108+
109+
#### Other client types
110+
85111
| Default environment variable name | Description | Example value |
86112
|-----------------------------------|-------------------------|-----------------------------------------|
87113
| AZURE_KEYVAULT_SCOPE | Your Azure RBAC scope | `https://management.azure.com/.default` |
@@ -90,15 +116,10 @@ Use the connection details below to connect compute services to Azure Key Vault.
90116
| AZURE_KEYVAULT_CLIENTSECRET | Your Client secret | `<client-secret>` |
91117
| AZURE_KEYVAULT_TENANTID | Your Tenant ID | `<tenant-id>` |
92118

93-
### Java - Spring Boot service principal
119+
#### Sample code
94120

95-
| Default environment variable name | Description | Example value |
96-
|-----------------------------------|-----------------------------|-------------------------------------------|
97-
| azure.keyvault.uri | Your Key Vault endpoint URL | `"https://<vault-name>.vault.azure.net/"` |
98-
| azure.keyvault.client-id | Your Client ID | `<client-ID>` |
99-
| azure.keyvault.client-key | Your Client secret | `<client-secret>` |
100-
| azure.keyvault.tenant-id | Your Tenant ID | `<tenant-id>` |
101-
| azure.keyvault.scope | Your Azure RBAC scope | `https://management.azure.com/.default` |
121+
Refer to the steps and code below to connect to Azure Key Vault using a system-assigned managed identity.
122+
[!INCLUDE [code sample for key vault](./includes/code-keyvault-me-id.md)]
102123

103124
## Next steps
104125

‎articles/service-connector/includes/code-appconfig-me-id.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -71,9 +71,9 @@ ms.author: wchi
7171
7272
// for service principal
7373
// ClientSecretCredential defaultCredential = new ClientSecretCredentialBuilder()
74-
// .clientId(System.getenv("<AZURE_APPCONFIGURATION_CLIENTID>"))
75-
// .clientSecret(System.getenv("<AZURE_APPCONFIGURATION_CLIENTSECRET>"))
76-
// .tenantId(System.getenv("<AZURE_APPCONFIGURATION_TENANTID>"))
74+
// .clientId(System.getenv("AZURE_APPCONFIGURATION_CLIENTID"))
75+
// .clientSecret(System.getenv("AZURE_APPCONFIGURATION_CLIENTSECRET"))
76+
// .tenantId(System.getenv("AZURE_APPCONFIGURATION_TENANTID"))
7777
// .build();
7878
7979
String endpoint = System.getenv("AZURE_APPCONFIGURATION_ENDPOINT");

0 commit comments

Comments
 (0)