如何在Autofac中正确注册Azure KeyVault的SecretClient？

项目中使用Autofac实现IoC依赖注入，可正常注册MicrosoftGraphEmailService与AzureKeyVaultSecretManager，但尝试三种方式注册Azure Key Vault的SecretClient均构建失败：

报错详情 #

1. 前两种尝试（代码中attempt 1、attempt 2）报错：
   'ContainerBuilder' does not contain a definition for 'AddSecretClient' and the best extension method overload 'SecretClientBuilderExtensions.AddSecretClient(SecretClient, Uri)' requires a receiver of type 'SecretClient'
2. 第三种尝试（attempt 3）报错：
   No overload for method 'RegisterType' takes 1 arguments

使用微软原生DI方式可正常注册SecretClient，但需在Autofac中完成该注册，求解决方法。

相关代码 #

AutofacConfigurationExtensions #

public static class AutofacConfigurationExtensions
{
    public static void AddAutofac(this IHostBuilder builder)
    {
        builder.UseServiceProviderFactory(new AutofacServiceProviderFactory());

        builder.ConfigureContainer<ContainerBuilder>
        (
            (_, builder) =>
            {
                builder.RegisterAssemblyModules(typeof(AutofacConfigurationExtensions));
                builder.RegisterModule(new SharedAutofacModule());
            }
        );
    }
}

SharedAutofacModule #

using Autofac;
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
using Microsoft.Extensions.Azure;

public class SharedAutofacModule : Autofac.Module
{
    protected override void Load(ContainerBuilder builder)
    {
        var uri = new Uri("keyVaultUrl");
        var tokenCredential = new DefaultAzureCredential(new DefaultAzureCredentialOptions { ManagedIdentityClientId = "clientId" });

        //attempt 1
        builder.AddSecretClient<SecretClient>(uri).WithCredential(tokenCredential);
        //attempt 2
        builder.AddSecretClient<SecretClient>(_ => new(new Uri(keyVaultUrl), tokenCredential));
        //attempt 3
        builder.RegisterType<SecretClient>(_ => new(new Uri("keyVaultUrl"), "tokenCredential"));

        builder.RegisterType<MicrosoftGraphEmailService>().As<IMailMessageSender>();
        builder.RegisterType<AzureKeyVaultSecretManager>();
    }
}

微软原生DI可正常运行的代码（Program.cs） #

var config = InitConfiguration();
var clientId = config["AzureKeyVault:ClientId"];
var keyVaultUrl = config["AzureKeyVault:KeyVaultUrl"];

if (!string.IsNullOrEmpty(clientId) && !string.IsNullOrEmpty(keyVaultUrl))
{
    var tokenCredential = new DefaultAzureCredential(new DefaultAzureCredentialOptions { ManagedIdentityClientId = clientId });

    var builder = new HostBuilder()
    .ConfigureFunctionsWorkerDefaults()
    .ConfigureServices(s => s.AddSingleton<SecretClient>(_ => new(new Uri(keyVaultUrl), tokenCredential)));

    builder.AddAutofac();
    var host = builder.Build();
    await host.RunAsync();
}

Autofac的API逻辑和微软原生DI不同，你之前的尝试均因API使用错误导致失败，以下是两种正确的注册方式：

方式一：直接注册单例实例 #

如果Key Vault地址和Managed Identity Client ID在模块加载时就能确定，可以直接创建SecretClient实例并注册为单例：

protected override void Load(ContainerBuilder builder)
{
    var keyVaultUrl = "your-key-vault-url";
    var clientId = "your-managed-identity-client-id";
    
    var uri = new Uri(keyVaultUrl);
    var tokenCredential = new DefaultAzureCredential(new DefaultAzureCredentialOptions { ManagedIdentityClientId = clientId });
    var secretClient = new SecretClient(uri, tokenCredential);

    // 注册为单例，对应原生DI的AddSingleton
    builder.RegisterInstance(secretClient).As<SecretClient>().SingleInstance();

    // 其他服务注册保持不变
    builder.RegisterType<MicrosoftGraphEmailService>().As<IMailMessageSender>();
    builder.RegisterType<AzureKeyVaultSecretManager>();
}

方式二：依赖容器配置延迟创建实例 #

如果需要从容器中获取IConfiguration读取配置项（更符合配置解耦的最佳实践），可以用lambda表达式延迟创建实例：

protected override void Load(ContainerBuilder builder)
{
    // 通过容器解析IConfiguration获取配置，延迟创建SecretClient
    builder.Register(c => 
    {
        var config = c.Resolve<IConfiguration>();
        var keyVaultUrl = config["AzureKeyVault:KeyVaultUrl"];
        var clientId = config["AzureKeyVault:ClientId"];
        
        var uri = new Uri(keyVaultUrl);
        var tokenCredential = new DefaultAzureCredential(new DefaultAzureCredentialOptions { ManagedIdentityClientId = clientId });
        return new SecretClient(uri, tokenCredential);
    }).As<SecretClient>().SingleInstance();

    // 其他服务注册保持不变
    builder.RegisterType<MicrosoftGraphEmailService>().As<IMailMessageSender>();
    builder.RegisterType<AzureKeyVaultSecretManager>();
}

错误原因说明 #

1. Attempt 1/2报错：AddSecretClient是微软原生DI（IServiceCollection）的专属扩展方法，Autofac的ContainerBuilder没有实现该方法，不能直接照搬原生DI的写法。
2. Attempt 3报错：Autofac的RegisterType<T>仅用于注册类型（由容器自动实例化），不支持传入实例创建的lambda；自定义实例创建逻辑需使用Register<T>(Func<IComponentContext, T>)方法。

内容的提问来源于stack exchange，提问作者Diego Perez