Accessing Azure Key Vault in a Windows Server Container on an on-prem hybrid joined server with managed identities

Question

I am working on configuring an on-prem Windows Server 2022 production web server that is hybrid joined to Azure using Azure Arc. I will be running windows containers hosting asp.net core applications. The applications will use Azure Key vault for secret management. I would like for the application to use the hosts managed identity to access the key vault. I am using DefaultAzureCredential in the applications. On the host server I am able to access the keyvault with a sample application but when running this app inside the container I am not able to access it, and I get an error that ManagedIdentityCredential authentication failed. What do I need to give the container for it to use the host server's identity to access the key vault?

The app I am testing with is a console app. My program.cs is

using Azure.Core;
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;

var keyVaultName = "your-key-vault-name";
var secretName = "your-secret-name";
var kvUri = $"https://{keyVaultName}.vault.azure.net/";
var client = new SecretClient(new Uri(kvUri), new DefaultAzureCredential());

try
{
  KeyVaultSecret secret = await client.GetSecretAsync(secretName);
  Console.WriteLine($"Secret Value: {secret.Value}");
}
catch (Exception ex)
{
  Console.WriteLine($"Failed to retrieve secret: {ex.Message}");
}

My docker file is for a windows server

My Docker command is

docker run -it --rm -e IDENTITY_ENDPOINT=$Env:IDENTITY_ENDPOINT -e IMDS_ENDPOINT=$Env:IMDS_ENDPOINT -v C:\azuretest:C:\azuretest --name my-app-container mcr.microsoft.com/windows/nanoserver:ltsc2022 cmd

The error I am getting is

Failed to retrieve secret: DefaultAzureCredential failed to retrieve a token from the included credentials. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/defaultazurecredential/troubleshoot
- EnvironmentCredential authentication unavailable. Environment variables are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot
- WorkloadIdentityCredential authentication unavailable. The workload options are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/workloadidentitycredential/troubleshoot
- ManagedIdentityCredential authentication unavailable. No response received from the managed identity endpoint.
- Visual Studio Token provider can't be accessed at C:\Users\ContainerUser\AppData\Local\.IdentityService\AzureServiceAuth	okenprovider.json
- Azure CLI not installed
- PowerShell is not installed.
- Azure Developer CLI could not be found.

When I try using the host server IP address I get the following error

A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.

When I try just mapping the environment variables, I get the following error

Failed to retrieve secret: ManagedIdentityCredential authentication failed:

I tried mapping the IMDS environment variables, opening port 4032 on the host firewall, and using the host IP address but still receive this error.

Answer

Hello Brandon Gilbert,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

Regarding your scenario and explanation, there are couple of a few things you will need to resolve the issue:

First confirm that system-assigned managed identity is enabled on your Azure resource by using this bash command: az vm show --resource-group --name --query identity --output json Use this link for more info - https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview
Configure Azure Key Vault Access Policy for access to your application using bash command: az keyvault set-policy --name --object-id --secret-permissions get list For more info - https://docs.microsoft.com/azure/key-vault/general/assign-access-policy

In your Docker, you will need to set environment variable as

    `IDENTITY_ENDPOINT`
    `IMDS_ENDPOINT`

and use:

   docker run -it --rm -e IDENTITY_ENDPOINT=http://169.254.169.254/metadata/identity/oauth2/token -e IMDS_ENDPOINT=http://169.254.169.254/metadata/instance -v C:\azuretest:C:\azuretest --name my-app-container mcr.microsoft.com/windows/nanoserver:ltsc2022 cmd

Make sure your application is using DefaultAzureCredential correctly.

   using Azure.Identity;
   using Azure.Security.KeyVault.Secrets;
   // Create a secret client
   var client = new SecretClient(new Uri("https://.vault.azure.net/"), new DefaultAzureCredential());
   // Get a secret
   KeyVaultSecret secret = await client.GetSecretAsync("");

For more info: https://docs.microsoft.com/dotnet/api/overview/azure/identity-readme

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Share via

Accessing Azure Key Vault in a Windows Server Container on an on-prem hybrid joined server with managed identities

1 answer

Your answer