Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

KeyVaultErrorException: Operation returned an invalid status code 'Forbidden'

I'm trying to set up my web app, hosted in Azure to read settings from Azure KeyVault.

I've been following this guide: https://anthonychu.ca/post/secrets-aspnet-core-key-vault-msi/

The example shows how to access app settings from KeyVault with the configuration:

public static IWebHost BuildWebHost(string[] args) =>     WebHost.CreateDefaultBuilder(args)      .ConfigureAppConfiguration((ctx, builder) =>      {          var keyVaultEndpoint = Environment.GetEnvironmentVariable("KEYVAULT_ENDPOINT");          if (!string.IsNullOrEmpty(keyVaultEndpoint))          {              var azureServiceTokenProvider = new AzureServiceTokenProvider();              var keyVaultClient = new KeyVaultClient(                  new KeyVaultClient.AuthenticationCallback(                      azureServiceTokenProvider.KeyVaultTokenCallback));              builder.AddAzureKeyVault(                  keyVaultEndpoint, keyVaultClient, new DefaultKeyVaultSecretManager());          }      })     .UseApplicationInsights()     .UseStartup<Startup>()     .Build(); 

I've added the KEYVAULT_ENDPOINT environment variable to the application settings. I've enabled MSI on the app service, and I've authorized my Azure User, and my application, from the Key Vault Access Policies:

enter image description here

With Get and List Operations:

enter image description here

And I've added the secret to key vault. Running locally, I can access the secret.

But my ASP .NET Core site fails on startup with this in the stdout logs:

Unhandled Exception: Microsoft.Azure.KeyVault.Models.KeyVaultErrorException: Operation returned an invalid status code 'Forbidden'    at Microsoft.Azure.KeyVault.KeyVaultClient.GetSecretsWithHttpMessagesAsync(String vaultBaseUrl, Nullable`1 maxresults, Dictionary`2 customHeaders, CancellationToken cancellationToken)    at Microsoft.Azure.KeyVault.KeyVaultClientExtensions.GetSecretsAsync(IKeyVaultClient operations, String vaultBaseUrl, Nullable`1 maxresults, CancellationToken cancellationToken)    at Microsoft.Extensions.Configuration.AzureKeyVault.AzureKeyVaultConfigurationProvider.LoadAsync()    at Microsoft.Extensions.Configuration.AzureKeyVault.AzureKeyVaultConfigurationProvider.Load()    at Microsoft.Extensions.Configuration.ConfigurationRoot..ctor(IList`1 providers)    at Microsoft.Extensions.Configuration.ConfigurationBuilder.Build()    at Microsoft.AspNetCore.Hosting.WebHostBuilder.BuildCommonServices(AggregateException& hostingStartupErrors)    at Microsoft.AspNetCore.Hosting.WebHostBuilder.Build()    at Blog.Program.BuildWebHost(String[] args) in D:\a\1\s\[csproj name]\Program.cs:line 22    at [csproj name].Program.Main(String[] args) in D:\a\1\s\[csproj name]\Program.cs:line 16 

I've checked that MSI_ENDPOINT and MSI_SECRET environment variables exist by calling SET from the debug console. enter image description here

I can also see the KEYVAULT_ENDPOINT variable.

Any suggestions what could be going wrong or on what to try next? Since it works locally it must be an authentication issue, but I believe it's authenticating locally with my azure User that I've authorized in key vault, rather than as the Azure App Service.

like image 285
zola25 Avatar asked Jul 01 '18 15:07

zola25


1 Answers

It is dodgy, but the problem with your setup is that you enabled "Authorized application" when you created the Access policy for your KeyValut.

You can see it because you have "Application+Application" on your screenshot. I imagine, you created the policy with your webapp being both principal and authrorized application. This kinda creates a loop.

To make this setup work just delete your existing policy and create a new one, where you select only the Principal:

enter image description here

like image 161
JleruOHeP Avatar answered Sep 28 '22 20:09

JleruOHeP