CODEWITHSUNDEEP
c#.net-coreazure-keyvault
user1259332
user1259332

Reputation: 426

How to get a SecureString out of an Azure KeyVault - C#

I have a Azure KeyVault providing a password which I'd like to read into a SecureString.

If I try to read the string as a SecureString from the IConfiguration object, it will return a null:

config.GetValue<SecureString>("AdminPW") == null

I can read the string in as a string and convert to SecureString, but this seems like a dirty hack:

 var pass = new SecureString();
 foreach (var c in config.GetValue<string>("AdminPW").ToCharArray())
 {
    pass.AppendChar(c);
 }

Is there a way to get a SecureString directly from the IConfiguration?

Upvotes: 1

Views: 2255

Answers (2)

user1259332
user1259332

Reputation: 426

For anyone else checking this, it is not possible to directly get a SecureString out of an Azure KeyVault.

Upvotes: 2

Joey Cai
Joey Cai

Reputation: 20127

As Hans said, it is not security.

If the assemblies you are using don't have native support for SecureString serialization, that's exactly where you Key Vault as a service for secrets need to pass them only an encrypted payload which when you do decrypt is kept immediately in a SecureString (CryptoStream byte by byte to SecureString followed by dispose to purge the buffers from memory).

So not suggest you get a SecureString out of an Azure KeyVault.

You could refer to this issue Azure KeyVault client should support SecureStrings.

Upvotes: 0

Related Questions