Azure App Service Container Managed Identity Key Vault in.NET Core C#

Question

I have a C# app running in a linux docker container in Azure App Services that gets it's configuration information from Azure Key vault.

In the past we did this:

config.AddAzureKeyVault(builtConfig["Azure:Auth:Vault"],
    builtConfig["Azure:Auth:ClientId"], builtConfig["Azure:Auth:ClientSecret"]);

We've been trying to, instead, use managed identity. So I:

1. When to identity on the app service and clicked enable on the system identity and hit save.
2. Went into the azure keyvault and added the system identity for the app service with get, list, decrypt and unwrap on the 3 areas for it like we do for users using VS.net authentication for this.

3. Added the AppAuthenication library from nuget.

4. Updated my code like this:

   var azureServiceTokenProvider = new AzureServiceTokenProvider();
   var keyVaultClient = new KeyVaultClient(
       new KeyVaultClient.AuthenticationCallback(
           azureServiceTokenProvider.KeyVaultTokenCallback));
   config.AddAzureKeyVault(builtConfig["Azure:Auth:Vault"], keyVaultClient, 
       new DefaultKeyVaultSecretManager());
   

But when we put this into Azure App Services by updating the container, it just hangs trying to start the app. Nothing happens and eventually it times out.

I can find lots of documentation for direct app services, but nothing different for containers. It appears to say that it's supported however.

What am I missing for making this work for linux containers in App Services?

Even turning on managed identity causes the container to never respond to ping checks let alone start properly.

Answer 1

At the moment this does not seem to be supported. What I did to validate this statement:

1. Created two instances with a system assigned identity:

   • a VM
   • an app service with a custom image

2. Deployed the same exact code to get a token through curl.

It worked as expected on the VM, but it did not work on the custom image.

It is unfortunate that Azure does not provide managed identities on its managed services as advertised.