.NET 7 Web API如何通过ClientId与Thumbprint认证Azure Key Vault请求

我有一个.NET 7 Web API应用，当前使用AddAzureKeyVault方法将Azure Key Vault配置添加到IConfigurationBuilder实例中，采用DefaultAzureCredential进行认证。现在希望修改该方法，使用ClientId和Thumbprint来完成Azure Key Vault请求的认证，替代默认凭据类型。

现有代码如下：

AddAzureKeyVaultConfiguration扩展方法 #

public static IConfigurationBuilder AddAzureKeyVaultConfiguration(this IConfigurationBuilder configurationBuilder, IWebHostEnvironment hostingEnvironment)
{
    if (!hostingEnvironment.IsEnvironment("Localhost"))
    {
        var builtConfig = configurationBuilder.Build();
        var keyVaultEndpoint = $"https://{builtConfig["KeyVaultConfigOption:Name"]}.vault.azure.net/";

        configurationBuilder.AddAzureKeyVault(
            new Uri(keyVaultEndpoint),
            new DefaultAzureCredential(new DefaultAzureCredentialOptions
            {
                ExcludeEnvironmentCredential = true,
                ExcludeInteractiveBrowserCredential = true,
                ExcludeAzurePowerShellCredential = true,
                ExcludeSharedTokenCacheCredential = true,
                ExcludeVisualStudioCodeCredential = true,
                ExcludeVisualStudioCredential = true,
                ExcludeAzureCliCredential = false,
                ExcludeManagedIdentityCredential = false,
            })

            );
    }

    return configurationBuilder;
}

Program.cs #

var builder = WebApplication.CreateBuilder(args);
{
    // Environment configuration
    var configuration = builder.Configuration;
    var env = builder.Environment;

    configuration.AddAppConfiguration(env);

    // Add azure key vault configuration
    builder.Configuration.AddAzureKeyVaultConfiguration(env);

    builder.Services.AddMediatR(cfg => cfg.RegisterServicesFromAssemblyContaining<Program>());
    builder.Services.AddHttpClient();

    builder.Services.AddApplication();
    builder.Services.AddInfrastructure(builder.Configuration);

    builder.Services.AddHelpers();

    builder.Services.AddControllers()
       // Configures the JSON serialization options for controllers.
       .AddJsonOptions(options =>
        {
            options.JsonSerializerOptions.PropertyNamingPolicy = null;
        });

    builder.Services.Configure<ApiBehaviorOptions>(options =>
    {
        options.SuppressModelStateInvalidFilter = true;
    });

}

var app = builder.Build();
{
    app.UseHttpsRedirection();

    // Authentication & Authorization
    app.UseAuthentication();
    app.UseAuthorization();
    app.MapControllers();

    app.UseRouting();
    app.UseSwaggerWithVersioning();
}

if (app.Environment.IsDevelopment())
{
    //DEV configurations
}

app.Run();

appsettings.json #

"KeyVaultConfigOption": {
    "Name": "{KeyValultName}",
    "Url": "https://{KeyVaultName}.vault.azure.net",
    "Thumbprint": "",
    "ClientId": ""
  }

要实现用ClientId和证书Thumbprint认证Azure Key Vault，需要用ClientCertificateCredential替代DefaultAzureCredential，具体修改步骤如下：

1. 确认依赖包 #

确保项目已安装以下NuGet包：

Azure.Security.KeyVault.Secrets
Azure.Identity

2. 更新扩展方法 #

替换原有的认证逻辑，改用证书凭据：

using Azure.Identity;
using System.Security.Cryptography.X509Certificates;

public static IConfigurationBuilder AddAzureKeyVaultConfiguration(this IConfigurationBuilder configurationBuilder, IWebHostEnvironment hostingEnvironment)
{
    if (!hostingEnvironment.IsEnvironment("Localhost"))
    {
        var builtConfig = configurationBuilder.Build();
        // 从配置读取必要参数
        var keyVaultEndpoint = builtConfig["KeyVaultConfigOption:Url"];
        var clientId = builtConfig["KeyVaultConfigOption:ClientId"];
        var certificateThumbprint = builtConfig["KeyVaultConfigOption:Thumbprint"];
        var tenantId = builtConfig["AzureAd:TenantId"];

        // 从本地证书存储加载对应Thumbprint的证书
        var certificate = LoadCertificateByThumbprint(certificateThumbprint);

        // 初始化证书凭据
        var credential = new ClientCertificateCredential(
            tenantId: tenantId,
            clientId: clientId,
            certificate: certificate
        );

        // 添加Key Vault配置源
        configurationBuilder.AddAzureKeyVault(new Uri(keyVaultEndpoint), credential);
    }

    return configurationBuilder;
}

// 辅助方法：根据Thumbprint查找本地证书
private static X509Certificate2 LoadCertificateByThumbprint(string thumbprint)
{
    using var store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
    store.Open(OpenFlags.ReadOnly);
    
    // 查找证书（忽略有效性校验，根据实际需求调整validOnly参数）
    var certificates = store.Certificates.Find(
        X509FindType.FindByThumbprint, 
        thumbprint, 
        validOnly: false
    );

    if (certificates.Count == 0)
    {
        throw new InvalidOperationException($"未找到Thumbprint为{thumbprint}的证书");
    }

    return certificates[0];
}

3. 补充配置项 #

在appsettings.json中添加租户ID配置：

"AzureAd": {
    "TenantId": "{你的Azure AD租户ID}"
},
"KeyVaultConfigOption": {
    "Name": "{KeyValultName}",
    "Url": "https://{KeyVaultName}.vault.azure.net",
    "Thumbprint": "{证书的Thumbprint值}",
    "ClientId": "{Azure AD应用注册的ClientId}"
}

注意事项 #

• 证书必须是包含私钥的PFX格式，并且已安装在应用运行环境的证书存储中（本地开发用CurrentUser，服务器部署可能需要LocalMachine）
• Azure AD应用注册需绑定该证书，且应用拥有Key Vault的访问权限（如Secrets Reader）
• 如果部署到Azure App Service，可通过门户上传证书，并设置WEBSITE_LOAD_CERTIFICATES环境变量让应用访问证书

内容的提问来源于stack exchange，提问作者Rakesh Kumar