Managing Secret Information in Azure Key Vault and Scala application to manage secret APIs.

1. Application Security
Azure Key Vault

2. Actors in Key Vault

3. Access Control and Key Vault Authentication

4. Scala Application for Key Vault Integration
Step 1: Authenticate with Azure Active Directory for Key Vault Application
def appKVCredentials (clientId: String, secretId: String): KeyVaultCredentials = {
val kvCred: KeyVaultCredentials = new KeyVaultCredentials() {
def doAuthenticate(request: ServiceRequestContext , challenge: util.Map[String, String]): Header = {
var authorization: String = challenge.get("authorization")
var resource: String = challenge.get("resource")
println("authorization: "+authorization + " " + resource)
var token: AuthenticationResult = getAccessTokenFromClientCredentials(authorization, resource, clientId,
secretId);
return new BasicHeader("Authorization", token.getAccessTokenType() + " " + token.getAccessToken());
}
};
return kvCred
}

5. Scala Application for Key Vault Integration (Cont.)
Step 2: Get Access Token from Key Vault
def getAccessTokenFromClientCredentials(authorization: String, resource: String, clientId: String, clientKey: String): AuthenticationResult
= {
var context: AuthenticationContext = null;
var result: AuthenticationResult = null;
var service: ExecutorService = null;
try {
service = Executors.newFixedThreadPool(1);
context = new AuthenticationContext(authorization, false, service);
var credentials: ClientCredential = new ClientCredential(clientId, clientKey);
println("clientKey: "+credentials.getClientSecret + " clientId: "+credentials.getClientId)
val future = context.acquireToken(resource, credentials,null);
result = future.get
} catch {
case e: Exception => e.printStackTrace()
throw new RuntimeException(e);
} finally {
service.shutdown();
}
if (result == null) {
throw new RuntimeException("authentication result was null");
}
return result;
}

6. Scala Application for Key Vault Integration (Cont.)
Step 3: Create Key Vault Client with Key Vault Credentials
def appKVClient(kvCred: KeyVaultCredentials): KeyVaultClient = {
val config: Configuration = KeyVaultConfiguration.configure(null, kvCred);
val vc: KeyVaultClient = KeyVaultClientService.create(config);
return vc
}

7. Scala Application for Key Vault Integration (Cont.)
Step 4: Get Secret Value from Key Vault
a.
def getSecretValueFromKV(vc: KeyVaultClient, secretIdentifier: String): String = {
val secretValue: Future[Secret] = vc.getSecretAsync(secretIdentifier)
return secretValue.get.getValue
}
b.
def getSecretValueFromKV(vc: KeyVaultClient, vaultBaseUrl: String, secretName: String, secretVersion: String):
String = {
val secretValue: Future[Secret] = vc.getSecretAsync(vaultBaseUrl, secretName, secretVersion)
return secretValue.get.getValue
}

8. Questions?
Braja Das
bkd_108@yahoo.com