如何从密钥库中获取秘密？答案

【问题标题】：How can i get secret from key vault?如何从密钥库中获取秘密？
【发布时间】：2020-02-21 14:21:50
【问题描述】：

我想从 Azure 密钥保管库获取机密。

我在下面找到了代码并尝试了它。但我因错误而失败。

    private String clientId= '<I put my client Id here>';
    private String secret= '<I put my client secret here>';



KeyVaultClient client = new KeyVaultClient(credentials);

String secret = client.getSecret("https://<myVault>.vault.azure.net", "secret name").value();
        log.debug("secret=============",secret);
    }


    ServiceClientCredentials credentials = new KeyVaultCredentials() {

        @Override
        public String doAuthenticate(String authorization, String resource, String scope) {
            AuthenticationResult res = null;

            try {
                res = GetAccessToken(authorization, resource, clientId, secret);
            } catch (InterruptedException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            } catch (ExecutionException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
                return res.getAccessToken();
        }

        private AuthenticationResult GetAccessToken(String authorization, String resource, String clientID, String clientKey)
                throws InterruptedException, ExecutionException {
            AuthenticationContext ctx = null;
            ExecutorService service = Executors.newFixedThreadPool(1);
            try {
                ctx = new AuthenticationContext(authorization, false, service);
            } catch (MalformedURLException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
            Future<AuthenticationResult> resp = ctx.acquireToken(resource, new ClientCredential(
                clientID, clientKey), null);
                AuthenticationResult res = resp.get();
                return res;
            }

我收到如下错误：

[http-nio-8080-exec-1] ERROR c.t.c.e.GlobalExceptionHandler - Error >>> java.net.ConnectException: Failed to connect

如何从密钥库中获取秘密？还有什么我应该做的吗？

谢谢。

【问题讨论】：

您从哪里运行此代码？就像您已在 azure 上部署此代码或在本地运行一样？确保无论您在何处运行代码，都必须授权它访问密钥保管库。类似的 SO 查询：stackoverflow.com/questions/57764432/…

标签： java azure spring-boot azure-keyvault

【解决方案1】：

您似乎想使用应用程序访问 azure 密钥库。

在 Azure AD 中注册 Web 应用
您可以在概览中获取客户端 ID（应用程序 ID）
添加秘密
在密钥保管库中分配访问策略
保存策略，使其生效。
代码示例

public class KeyVaultTest {

    private static AuthenticationResult getAccessToken(String authorization, String resource) throws InterruptedException, ExecutionException, MalformedURLException {

        String clientId = "dc17****-****-****-****-ea03****a5e7"; // Client ID
        String clientKey = "1YWt******k21";  //Client Secret

        AuthenticationResult result = null;

        //Starts a service to fetch access token.
        ExecutorService service = null;
        try {
            service = Executors.newFixedThreadPool(1);
            AuthenticationContext context = new AuthenticationContext(authorization, false, service);

            Future<AuthenticationResult> future = null;

            //Acquires token based on client ID and client secret.
            if (clientKey != null && clientKey != null) {
                ClientCredential credentials = new ClientCredential(clientId, clientKey);
                future = context.acquireToken(resource, credentials, null);
            }

            result = future.get();
        } finally {
            service.shutdown();
        }

        if (result == null) {
            throw new RuntimeException("Authentication results were null.");
        }
        return result;
    }

    public static void main(String[] args) {
        String vaultBase = "https://jackkv.vault.azure.net/";

        KeyVaultClient keyVaultClient = new KeyVaultClient(new KeyVaultCredentials(){
            @Override
            public String doAuthenticate(String authorization, String resource, String scope) {
                String token = null;
                try {
                    AuthenticationResult authResult = getAccessToken(authorization, resource);
                    token = authResult.getAccessToken();
                } catch (Exception e) {
                    e.printStackTrace();
                }
                return token;
            }
        });

        SecretBundle test = keyVaultClient.getSecret(vaultBase, "test");
        System.out.println(test.value());
    }
}

更新：

如果您遇到连接问题，请检查您是否为密钥保管库设置了防火墙。

如果您设置了防火墙，请将您的 IP 添加到允许列表中：

【讨论】：

谢谢！我真的很感谢你的帮助。它对我有用。
@SehunPark 我很高兴它有帮助。您能否将其标记为正确答案，以便其他人从中受益？谢谢！

【解决方案2】：

在从 Azure Key Vault 获取机密之前，请确保您有权访问 Key Vault。确保登录或提供正确的 Azure 凭据。 you can refer this link for getting secret

或者你执行这个powershell命令Get-AzureKeyVaultSecret -VaultName 'VaultName' -Name 'sceretName'

【讨论】：