生产环境中如何存储Azure客户端密钥？

1. Windows凭据管理器（原生安全存储） #

• 利用Windows原生加密机制存储，仅授权账户可访问
• 操作步骤：
  • 打开「控制面板→用户账户→凭据管理器→Windows凭据」
  • 添加「通用凭据」，设置目标名称（如AzureKeyVaultClientSecret），密码栏填入Client Secret
  • 应用中读取示例：

    using System;
    using System.Runtime.InteropServices;
    using System.Text;
    
    public static string GetSecretFromCredentialManager(string targetName)
    {
        IntPtr credPtr;
        bool result = CredRead(targetName, CRED_TYPE.CRED_TYPE_GENERIC, 0, out credPtr);
        if (!result) throw new Exception("读取凭据失败");
    
        using (var credHandle = new CriticalCredHandle(credPtr))
        {
            var cred = (CREDENTIAL)Marshal.PtrToStructure(credPtr, typeof(CREDENTIAL));
            return Marshal.PtrToStringUni(cred.CredentialBlob, (int)cred.CredentialBlobSize / 2);
        }
    }
    
    [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
    private static extern bool CredRead(string targetName, CRED_TYPE type, int reservedFlag, out IntPtr credentialPtr);
    
    private enum CRED_TYPE : uint { CRED_TYPE_GENERIC = 1 }
    
    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
    private struct CREDENTIAL
    {
        public uint Flags;
        public CRED_TYPE Type;
        public string TargetName;
        public string Comment;
        public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
        public uint CredentialBlobSize;
        public IntPtr CredentialBlob;
        public uint Persist;
        public uint AttributeCount;
        public IntPtr Attributes;
        public string TargetAlias;
        public string UserName;
    }
    
    private class CriticalCredHandle : Microsoft.Win32.SafeHandles.CriticalHandleZeroOrMinusOneIsInvalid
    {
        public CriticalCredHandle(IntPtr handle) => SetHandle(handle);
        protected override bool ReleaseHandle() => CredFree(handle);
        [DllImport("advapi32.dll")] private static extern bool CredFree(IntPtr cred);
    }
    

2. EFS加密配置文件 #

• 对存放appsettings.json的文件夹启用EFS加密，仅运行服务的账户可解密
• 操作：右键文件夹→属性→高级→勾选「加密内容以便保护数据」
• 注意：务必备份EFS加密证书，防止服务器故障导致数据无法恢复

3. Azure AD混合托管标识（推荐） #

• 完全规避Client Secret存储，用托管标识实现无凭据访问
• 配置步骤：
  • 通过Azure Arc将本地Windows Server接入Azure，注册混合托管标识
  • 在Azure Key Vault中为该标识分配「机密读取者」角色
  • 应用中简化调用：

    using Azure.Identity;
    using Azure.Security.KeyVault.Secrets;
    
    var vaultUri = new Uri("https://your-keyvault.vault.azure.net/");
    var client = new SecretClient(vaultUri, new DefaultAzureCredential());
    var apiKeySecret = client.GetSecret("your-api-key-name");
    

4. 注册表加密存储 #

• 将Client Secret加密后存入权限受限的注册表路径
• 代码示例：

  using System.Security.Cryptography;
  using Microsoft.Win32;
  using System.Text;
  
  // 加密存储
  var secretBytes = Encoding.Unicode.GetBytes("your-client-secret");
  var encryptedBytes = ProtectedData.Protect(secretBytes, null, DataProtectionScope.LocalMachine);
  Registry.SetValue(@"HKLM\Software\YourAppName", "ClientSecret", encryptedBytes, RegistryValueKind.Binary);
  
  // 读取解密
  var storedBytes = (byte[])Registry.GetValue(@"HKLM\Software\YourAppName", "ClientSecret", null);
  var secret = Encoding.Unicode.GetString(ProtectedData.Unprotect(storedBytes, null, DataProtectionScope.LocalMachine));
  

• 注意：需为注册表路径设置权限，仅允许服务运行账户访问

内容的提问来源于stack exchange，提问作者Kevin Z