问题描述

使用Java SDK获取Key Vault Secret机密信息时，需要获取授权。通常是使用AAD的注册应用（Client ID， Tenant ID， Client Secret）来获取 credential 对象。

  SecretClient secretClientidentity = new SecretClientBuilder()
                        .vaultUrl(keyVaultUri)
                        .credential(new DefaultAzureCredentialBuilder() 
                                        .authorityHost(AzureAuthorityHosts.AZURE_CHINA)
                                        .build())
                        .buildClient();

如果使用 DefaultAzureCredentialBuilder 来创建，则需要把 Client ID， Secret 和 Tenant ID 设置为环境变量。

image.png

如果不想设置环境变量，而想直接把三个参数值通过代码传递，是否有示例代码呢？

问题解答

可以的。使用 ClientSecretCredentialBuilder 就可以把Client ID，Secret 和 Tenant ID 参数显示设置。

代码如下：

   // /** // *  Authenticate with client secret. // */
        String clientID="xxxxxxxx-8216-xxxxxxxx-8924-xxxxxxxxxxxxxxxx";
        String tenantID="xxxxxxxx-66d7-xxxxxxxx-8f9f-xxxxxxxxxxxxxxxx";
        String clientSecret="xxxxxxxx.3ay_aOti..4";
        ClientSecretCredential clientSecretCredential = new ClientSecretCredentialBuilder()
                .clientId(clientID)
                .clientSecret(clientSecret)
                .tenantId(clientSecret)
                .authorityHost(AzureAuthorityHosts.AZURE_CHINA)
                .build();

        SecretClient secretClientidentity = new SecretClientBuilder()
                .vaultUrl(keyVaultUri)
                .credential(clientSecretCredential)
                .buildClient();

完整代码

package com.example.demokeyvault; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; import com.azure.identity.AzureAuthorityHosts; import com.azure.identity.ClientSecretCredential; import com.azure.identity.ClientSecretCredentialBuilder; import com.azure.identity.DefaultAzureCredentialBuilder; import com.azure.security.keyvault.secrets.SecretClient; import com.azure.security.keyvault.secrets.SecretClientBuilder; import com.azure.security.keyvault.secrets.models.KeyVaultSecret;

@SpringBootApplication public class DemokeyvaultApplication { public static void main(String[] args) {
        SpringApplication.run(DemokeyvaultApplication.class, args);

        System.out.println("Hello World!");
        String keyVaultUri = "https://yourkeyvaultname.vault.azure.cn/";

        System.out.printf(" key vault URI = %s \n", keyVaultUri); // String userIdentityID = " - - - - "; // .managedIdentityClientId(userIdentityID) // /** // * Authenticate with client secret. // */
        String clientID = "xxxx-xxxx-xxxx-xxxx-xxxx";
        String tenantID = "xxxx-xxxx-xxxx-xxxx-xxxx";
        String clientSecret = "xxxx.xxxx..4";
        ClientSecretCredential clientSecretCredential = new ClientSecretCredentialBuilder()
                .clientId(clientID)
                .clientSecret(clientSecret)
                .tenantId(clientSecret)
                .authorityHost(AzureAuthorityHosts.AZURE_CHINA)
                .build();

        SecretClient secretClientidentity = new SecretClientBuilder()
                .vaultUrl(keyVaultUri)
                .credential(clientSecretCredential)
                .buildClient(); // /** // * Authenticate with DefaultAzureCredentialBuilder. // */ // SecretClient secretClientidentity = new SecretClientBuilder() // .vaultUrl(keyVaultUri) // .credential(new DefaultAzureCredentialBuilder() // .authorityHost(AzureAuthorityHosts.AZURE_CHINA) // .build()) // .buildClient();
 String secretName = "testsecret01";

        KeyVaultSecret retrievedSecret = secretClientidentity.getSecret(secretName);

        System.out.println("Your secret's value is '" + retrievedSecret.getValue() + "'.");

        System.out.println("done.");
    }

}

POM.XML

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>1.5.9.RELEASE</version>
        <relativePath /> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.example</groupId>
    <artifactId>demokeyvault</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>demokeyvault</name>
    <description>Demo project for Spring Boot</description>
    <properties>
        <java.version>8</java.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>com.azure</groupId>
            <artifactId>azure-security-keyvault-secrets</artifactId>
            <version>4.2.3</version>
        </dependency>

        <dependency>
            <groupId>com.azure</groupId>
            <artifactId>azure-identity</artifactId>
            <version>1.2.0</version>
        </dependency>
        <dependency>
            <groupId>io.projectreactor</groupId>
            <artifactId>reactor-core</artifactId>
            <version>3.4.19</version>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

</project>

参考资料

Client secret credential : https://learn.microsoft.com/en-us/azure/developer/java/sdk/identity-service-principal-auth#client-secret-credential

适用于 Java 的 Azure Key Vault 机密客户端库 : https://docs.azure.cn/zh-cn/key-vault/secrets/quick-create-java?tabs=azure-cli

当在复杂的环境中面临问题，格物之道需：浊而静之徐清，安以动之徐生。 云中，恰是如此!

分类: 【Azure Developer】

标签: Azure Developer, Azure Key Vault, DefaultAzureCredentialBuilder, ClientSecretCredentialBuilder