Retrieve Hidden Information from Azure Key Vault using Node.js

Question

Retrieve Hidden Information from Azure Key Vault using Node.js

I'm looking to retrieve the list of users from the Azure active directory. The client has set up a Graph API application but is hesitant to share the client secret, opting instead to use Key Vault for security. How can I access the key required to fetch the user list from my node.js application?

I attempted the code below, but encountered an error and am unsure about the authentication process.

const { DefaultAzureCredential } = require("@azure/identity");
const { SecretClient } = require("@azure/keyvault-secrets");

const credential = new DefaultAzureCredential();

const vaultName = "lsm-keyvault";
const url = `https://${vaultName}.vault.azure.net`;

const client = new SecretClient(url, credential);

const secretName = "Demo";

async function main() {
  const result = await client.setSecret(secretName, "MySecretValue", {
    enabled: false
  });

  console.log(result)
}

node.js azure azure-active-directory azure-keyvault

Answer 1

Answer №1

If you choose to run the code locally, the DefaultAzureCredential will automatically utilize environmental variables.

In your specific scenario, it is necessary to register an application with Azure AD, obtain the tenant id, client id(i.e. application id),

client secret(i.e. application secret)

, set the environmental variables as AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and AZURE_TENANT_ID.

Regarding the 403 error mentioned, if you observe that it was added as a compound entity, chances are the correct service principal associated with the AD App was not added properly to the keyvault's Access policies. The entry should appear as APPLICATION rather than COMPOUND IDENTITY once correctly added.

When adding it, search for either the client Id(i.e. application Id) or

the name of your App Registration

directly to ensure accuracy. Further information on this topic can be found in this similar issue.

To retrieve the secret, simply having the Get permission is sufficient, using the provided code snippet:

const retrievedSecret = await client.getSecret(secretName);

It appears that in your code you are utilizing client.setSecret, which is meant for saving a secret and therefore requires the Set permission to function effectively.

For additional insights, refer to Quickstart: Azure Key Vault client library for Node.js (v4).

Update:

You mentioned the need to eventually deploy this code in a non-Azure environment. To accomplish this, you will have to manually include the required environment variables in your code.

This entails modifying your authentication process by directly inputting the three values into the code.

Replace these lines:

const { DefaultAzureCredential } = require("@azure/identity");
const credential = new DefaultAzureCredential();

With the following:

const { ClientSecretCredential } = require("@azure/identity");
const credential = new ClientSecretCredential(tenantId, clientId, clientSecret);

Refer to - https://www.npmjs.com/package/@azure/identity/v/1.0.3#authenticating-as-a-service-principal

Answer 2

If you choose to run the code locally, the DefaultAzureCredential will automatically utilize environmental variables.

In your specific scenario, it is necessary to register an application with Azure AD, obtain the tenant id, client id(i.e. application id),

client secret(i.e. application secret)

, set the environmental variables as AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and AZURE_TENANT_ID.

Regarding the 403 error mentioned, if you observe that it was added as a compound entity, chances are the correct service principal associated with the AD App was not added properly to the keyvault's Access policies. The entry should appear as APPLICATION rather than COMPOUND IDENTITY once correctly added.

When adding it, search for either the client Id(i.e. application Id) or

the name of your App Registration

directly to ensure accuracy. Further information on this topic can be found in this similar issue.

To retrieve the secret, simply having the Get permission is sufficient, using the provided code snippet:

const retrievedSecret = await client.getSecret(secretName);

It appears that in your code you are utilizing client.setSecret, which is meant for saving a secret and therefore requires the Set permission to function effectively.

For additional insights, refer to Quickstart: Azure Key Vault client library for Node.js (v4).

Update:

You mentioned the need to eventually deploy this code in a non-Azure environment. To accomplish this, you will have to manually include the required environment variables in your code.

This entails modifying your authentication process by directly inputting the three values into the code.

Replace these lines:

const { DefaultAzureCredential } = require("@azure/identity");
const credential = new DefaultAzureCredential();

With the following:

const { ClientSecretCredential } = require("@azure/identity");
const credential = new ClientSecretCredential(tenantId, clientId, clientSecret);

Refer to - https://www.npmjs.com/package/@azure/identity/v/1.0.3#authenticating-as-a-service-principal

Answer 3

Answer №2

To complete the process, simply follow the steps outlined below:

Begin by creating an App in the Azure Active Directory (Service Principal) from the App Registrations section.
Next, navigate to the Key Vault resource and access the Access Policy blade. Assign read access to the Azure AD App (Service Principal) created in the previous step.
Make sure to set three Environment variables - AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_CLIENT_SECRET within your App Service. Retrieve the values for these variables from the app created in step 1.
Utilize DefaultAzureCredential, which is currently in use. This will automatically obtain the credentials from the environment variables specified in the App Service for authentication purposes.

Alternatively, you can dynamically acquire a Key Vault token and utilize that token to access the secrets stored in the Key Vault - https://learn.microsoft.com/en-us/samples/azure-samples/app-service-msi-keyvault-node/app-service-msi-keyvault-node/

For additional information, refer to the following resources:

Answer 4

To complete the process, simply follow the steps outlined below:

Begin by creating an App in the Azure Active Directory (Service Principal) from the App Registrations section.
Next, navigate to the Key Vault resource and access the Access Policy blade. Assign read access to the Azure AD App (Service Principal) created in the previous step.
Make sure to set three Environment variables - AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_CLIENT_SECRET within your App Service. Retrieve the values for these variables from the app created in step 1.
Utilize DefaultAzureCredential, which is currently in use. This will automatically obtain the credentials from the environment variables specified in the App Service for authentication purposes.

Alternatively, you can dynamically acquire a Key Vault token and utilize that token to access the secrets stored in the Key Vault - https://learn.microsoft.com/en-us/samples/azure-samples/app-service-msi-keyvault-node/app-service-msi-keyvault-node/

For additional information, refer to the following resources:

Retrieve Hidden Information from Azure Key Vault using Node.js

Answer №1

Answer №2

Similar questions

Resolving Node.js Troubles: An Encounter with 'Module Not Found' Error

What discrepancies exist between running npm install on Windows versus Linux operating systems?

Guide to navigating to a different webpage with Node.js

Retrieve information from various MongoDB collections

The decision will be dependent on the outcomes provided by the $resource promise

What is the best way to implement locking with Mutex in NodeJS?

Why does my ajax call always send a GET request instead of a POST?

Using two different Readable streams to pipe to the same Writable stream multiple times

The cPanel Node.js application is experiencing difficulties connecting to the MongoDB Atlas cluster, yet it functions without any issues on

Developing middleware for managing event handlers

Ticking mechanism relying on Express JS GET/POST triggers

Getting a JWT token from Express to Angular using ngResource: A step-by-step guide

The `findOne` operation in Mongoose fails to complete within the 10000ms time limit

What is the reason for the absence of the $.ajax function in the jQuery package designed for node.js?

What is the best way to break down multiple query results one after another?

Make dark mode the default setting in your Next JS application

Sequelize - The name 'xxx_idx' for the identifier is too lengthy while trying to establish a one-to-many relationship

Error encountered while using JavaScript for waiting in Selenium

Node.js Token-Based Authorization with Role-Based Access Control

Implementing Singletons in Node.js