Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

SQL Server Always Encrypted feature with KeyVault and MSI

See original GitHub issue

Question

We are trying to use SQL Server Always Encrypted feature with KeyVault and MSI. Azure App Service MSI feature is used on the database on KeyVault. Please provide an example without keyvault ClientId and ClientSecret.

We have a working solution based on keyvault ClientId and ClientSecret, But we are checking a solution without using ClientId and ClientSecret.

SQLServerColumnEncryptionAzureKeyVaultProvider akvProvider = new SQLServerColumnEncryptionAzureKeyVaultProvider(alwaysOnEncyrptionClientId, alwaysOnEncyrptionClientSecret);
	    Map<String, SQLServerColumnEncryptionKeyStoreProvider> keyStoreMap = new HashMap<>();
	    keyStoreMap.put(akvProvider.getName(), akvProvider);
	    SQLServerConnection.registerColumnEncryptionKeyStoreProviders(keyStoreMap);

Relevant Issues and Pull Requests

Issue Analytics

State:
Created 4 years ago
Comments:6 (3 by maintainers)

Top GitHub Comments

2reactions

ronneyramoncommented, Jun 14, 2019

Hi,

@venkatareddym, you can get the Azure Key Vault access token using the AzureServiceTokenProvider (from Microsoft.Azure.Services.AppAuthentication 1.2.0 preview).

The GetToken method:

public static Task<string> GetToken(string authority, string resource, string scope)
{
	return (new AzureServiceTokenProvider()).GetAccessTokenAsync("https://vault.azure.net");
}

SqlColumnEncryptionAzureKeyVaultProvider azureKeyVaultProvider = new SqlColumnEncryptionAzureKeyVaultProvider(GetToken);

Dictionary<string, SqlColumnEncryptionKeyStoreProvider> providers = new Dictionary<string, SqlColumnEncryptionKeyStoreProvider>();

providers.Add(SqlColumnEncryptionAzureKeyVaultProvider.ProviderName, azureKeyVaultProvider);
SqlConnection.RegisterColumnEncryptionKeyStoreProviders(providers);

1reaction

lilgreenbirdcommented, Apr 2, 2020

hi all, as of the latest 8.3.0 preview release the driver added support for authentication to AKV using Managed Identity. Here is a wiki on how to use this feature. Please give this a try and let us know if you have any questions.

I’ll close this feature request issue now if any questions or problems please open a new issue. Thanks…