DefaultAzureIdentity And Its Various Credential Types

Modern applications consist of lots of independent components. Microservice architecture brings great benefits but it also has its downsides. Developers must take care of communication between various parts of the system and make it secure and authenticated. One of the preferred ways is to give your component identity from Azure Active Directory (AAD) and utilize the use of AAD tokens. This demo shows various ways how to retrieve identity from application context using a single line of code and get sample secrets from the Azure Key Vault. This all is done with the help of DefaultAzureCredential class from Azure.Identity NuGet package.

The whole demo can be cloned from my GitHub repo.

Prerequisites

We will create an instance of the Azure Key vault. As the second step, we insert the value `supersecurevalue` as a secret with the key `mylittlesecret`. This all is done with the help of Azure CLI.

az keyvault create --location westeurope --name azureidentityvault --resource-group identitytest  
az keyvault secret set --name mylittlesecret --value supersecurevalue --vault-name azureidentityvault

DefaultAzureCredential

There are various identities we want to use for our application during different stages of the development cycle. For example, one for development, one for integration testing, and one for production. For sure we don’t want to have a separate code section for each environment. Azure.Identity NuGet package makes retrieving identity unified. The following example retrieves our secret from the created Key vault (uses C# 9 and top-level statements). 

using System;  
using Azure.Identity;  
using Azure.Security.KeyVault.Secrets;  
  
const string keyvaultName = "azureidentityvault";  
const string secretKey = "mylittlesecret";  
  
var credential = new DefaultAzureCredential();  
  
var client = new SecretClient(new Uri($"https://{keyvaultName}.vault.azure.net/"), credential);  
KeyVaultSecret secret = client.GetSecret(secretKey);  
Console.WriteLine(secret.Value);

var credential = new InteractiveBrowserCredential();

var credential = new DefaultAzureCredential(includeInteractiveCredentials: true);

var credential = new AzureCliCredential();

VisualStudioCodeCredential

var credential = new new VisualStudioCodeCredential();

Azure Visual studio extensions required you to be logged in to show your Azure resources. You need an Azure account extension for this purpose. It providers various commands on how to perform sign-in. Just hit F1 and start typing “Azure Sign In”. VisualStudioCodeCredential takes this identity and uses it for the identity of our application during runtime.

VisualStudioCredential

var credential = new new VisualStudioCredential();

This option is very similar to the previous one. It differs only in the IDE and the way of providing credentials to it. In the “big” Visual studio you find the login form in Tools > Options > Azure service authentication.

SharedTokenCacheCredential

var credential = new new SharedTokenCacheCredential();

Many Microsoft applications use Azure single sign-on. This class uses identity, that was already stored in the local cache by one of them.

ManagedIdentityCredential

var credential = new ManagedIdentityCredential();  

az storage account create --name identityfunctionstorage --resource-group identitytest  
az functionapp create --name identityfunctiondemo --resource-group identitytest --storage-account identityfunctionstorage --consumption-plan-location westeurope

az functionapp identity assign --name identityfunctiondemo --resource-group mirotest

{  
  "principalId": "3fedf722-7c5d-426f-9d35-d985d3eb59bc",  
  "tenantId": "8d099a24-312e-4bb5-8fe4-aed67b7c4921",  
  "type": "SystemAssigned",  
  "userAssignedIdentities": null  
}

az keyvault set-policy --name azureidentityvault --object-id 3fedf722-7c5d-426f-9d35-d985d3eb59bc --secret-permission get

func azure functionapp publish identityfunctiondemo  
  
Microsoft (R) Build Engine version 16.8.0+126527ff1 for .NET  
Copyright (C) Microsoft Corporation. All rights reserved.  
  
  Determining projects to restore...  
  All projects are up-to-date for restore.  
  Azure_Identity_Demo_Function -> D:\working\Azure.Identity.Demo.Function\bin\publish\bin\Azure_Identity_Demo_Function.dll  
  
Build succeeded.  
    0 Warning(s)  
    0 Error(s)  
  
Time Elapsed 00:00:02.22  
  
  
Getting site publishing info...  
Creating archive for current directory...  
Uploading 4,06 MB [###############################################################################]  
Upload completed successfully.  
Deployment completed successfully.  
Syncing triggers...  
Functions in identityfunctiondemo:  
    IdentityHttpFunction - [httpTrigger]  
        Invoke url: https://identityfunctiondemo.azurewebsites.net/api/identityhttpfunction?code=QOLVCOC0FNtMIgN5bRur4sQSoEXkGraUovGmcsnULKPBiHuJXVKQwg==

var credential = new EnvironmentCredential();

Conclusion

DefaultAzureCredential class makes the everyday life of developers much easier. By typing a single line of code, we can provide a unified solution for providing identity. It adapts well to various environments starting from local debugging in IDE, continuing with build runners, and ending up in production cloud hosting.