CODEWITHSUNDEEP
azureazure-active-directoryazure-keyvault
Bill Software Engineer
Bill Software Engineer

Reputation: 7782

Access Azure Key Vault using Service-to-Service Access Token via REST

I am having trouble getting enough permission to access Azure Key Vault using my app ( and not via user login ). Here is my setup:

I have a azure key vault setup: Key Vault Setup

I have given my app called "KeyVault" every permission.

My app is registered with Azure Active Directory. And I have give it permission to access the Key Vault:

App registered with Azure Active Directory App given permission to access Key Vault

After all this, I try to get an Access Token using the following REST API:

https://login.microsoftonline.com/<DOMAIN_ID>/oauth2/token

The client_id and resource are both the App ID of my registered app in Active Directory I showed earlier. ( is this correct? )

enter image description here

I do get an Access Token back, which I use to try to query a secret in my vault. Unfortunately as you can see it return an 401 error, which is no permission. What am I doing wrong?

Querying the key vault

The URL is from the "Secret Identifier" of the secret in the key vault.

Upvotes: 0

Views: 1461

Answers (2)

Shui shengbao
Shui shengbao

Reputation: 19195

The client_id and resource are both the App ID of my registered app in Active Directory I showed earlier.

No, the resource id is not app id. As Rich said, the value is https://vault.azure.net.

I test it in my lab with Power Shell, the code should like below:

$TENANTID=""
$APPID=""
$PASSWORD=""
$result=Invoke-RestMethod -Uri https://login.microsoftonline.com/$TENANTID/oauth2/token?api-version=1.0 -Method Post -Body @{"grant_type" = "client_credentials"; "resource" = "https://vault.azure.net"; "client_id" = "$APPID"; "client_secret" = "$PASSWORD" }
$token=$result.access_token

$url="https://shui.vault.azure.net/secrets/shui01/cea20d376aee4d25a2d714df19314c26?api-version=2016-10-01"

$Headers=@{
    'authorization'="Bearer $token"

}

Invoke-RestMethod  -Uri $url  -Headers $Headers -Method GET

Note: If you want to get the API input information, you could use Azure Power Shell -debug to get it. For example:

enter image description here

Upvotes: 1

Rich Randall
Rich Randall

Reputation: 1982

When requesting the token from AAD you should set the resource to be:

https://vault.azure.net

That will ensure that the returned token is 'addressed' to Key Vault.

Upvotes: 1

Related Questions