Azure: Allow usage of managed identities instead of app registration to access Azure resources

fff · October 13, 2023, 4:50pm

Today, key connector only support app registration credential to access Azure Keyvault.

bitwarden/key-connector/blob/master/src/KeyConnector/Services/AzureKeyVaultCertificateProviderService.cs#L21


      
          {
              private readonly KeyConnectorSettings _settings;
          
              public AzureKeyVaultCertificateProviderService(KeyConnectorSettings settings)
              {
                  _settings = settings;
              }
          
              public async Task<X509Certificate2> GetCertificateAsync()
              {
                  var credential = new ClientSecretCredential(_settings.Certificate.AzureKeyvaultAdTenantId,
                      _settings.Certificate.AzureKeyvaultAdAppId, _settings.Certificate.AzureKeyvaultAdSecret);
                  var keyVaultUri = new Uri(_settings.Certificate.AzureKeyvaultUri);
          
                  var certificateClient = new CertificateClient(keyVaultUri, credential);
                  var certificateResponse = await certificateClient.GetCertificateAsync(
                      _settings.Certificate.AzureKeyvaultCertificateName);
                  var certificate = certificateResponse.Value;
                  if (certificate.Policy?.Exportable == true && certificate.Policy?.KeyType == CertificateKeyType.Rsa)
                  {
                      var secretName = ParseSecretName(certificate.SecretId);

It would be great to be able to use Azure managed identity to access Azure resources.

It’s only a matter of using DefaultCredential function from the Azure.Identity library.

(same for mssql access…)