| | | 1 | | // Copyright (c) Microsoft Corporation. All rights reserved. |
| | | 2 | | // Licensed under the MIT License. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using Azure.Extensions.AspNetCore.DataProtection.Keys; |
| | | 6 | | using Azure.Core; |
| | | 7 | | using Azure.Core.Cryptography; |
| | | 8 | | using Azure.Security.KeyVault.Keys.Cryptography; |
| | | 9 | | using Microsoft.AspNetCore.DataProtection.KeyManagement; |
| | | 10 | | using Microsoft.Extensions.DependencyInjection; |
| | | 11 | | |
| | | 12 | | #pragma warning disable AZC0001 // Extension methods have to be in the correct namespace to appear in intellisense. |
| | | 13 | | namespace Microsoft.AspNetCore.DataProtection |
| | | 14 | | #pragma warning disable |
| | | 15 | | { |
| | | 16 | | /// <summary> |
| | | 17 | | /// Contains Azure KeyVault-specific extension methods for modifying a <see cref="IDataProtectionBuilder"/>. |
| | | 18 | | /// </summary> |
| | | 19 | | public static class AzureDataProtectionKeyVaultKeyBuilderExtensions |
| | | 20 | | { |
| | | 21 | | /// <summary> |
| | | 22 | | /// Configures the data protection system to protect keys with specified key in Azure KeyVault. |
| | | 23 | | /// </summary> |
| | | 24 | | /// <param name="builder">The builder instance to modify.</param> |
| | | 25 | | /// <param name="keyIdentifier">The Azure Key Vault key identifier used for key encryption.</param> |
| | | 26 | | /// <param name="tokenCredential">The token credential to use for authentication.</param> |
| | | 27 | | /// <returns>The value <paramref name="builder"/>.</returns> |
| | | 28 | | public static IDataProtectionBuilder ProtectKeysWithAzureKeyVault(this IDataProtectionBuilder builder, Uri keyId |
| | | 29 | | { |
| | 0 | 30 | | Argument.AssertNotNull(keyIdentifier, nameof(keyIdentifier)); |
| | 0 | 31 | | return ProtectKeysWithAzureKeyVault(builder, keyIdentifier.ToString(), new KeyResolver(tokenCredential)); |
| | | 32 | | } |
| | | 33 | | |
| | | 34 | | /// <summary> |
| | | 35 | | /// Configures the data protection system to protect keys with specified key in Azure KeyVault. |
| | | 36 | | /// </summary> |
| | | 37 | | /// <param name="builder">The builder instance to modify.</param> |
| | | 38 | | /// <param name="keyResolver">The <see cref="IKeyEncryptionKeyResolver"/> to use for Key Vault access.</param> |
| | | 39 | | /// <param name="keyIdentifier">The Azure Key Vault key identifier used for key encryption.</param> |
| | | 40 | | /// <returns>The value <paramref name="builder"/>.</returns> |
| | | 41 | | public static IDataProtectionBuilder ProtectKeysWithAzureKeyVault(this IDataProtectionBuilder builder, string ke |
| | | 42 | | { |
| | 0 | 43 | | Argument.AssertNotNull(builder, nameof(builder)); |
| | 0 | 44 | | Argument.AssertNotNull(keyResolver, nameof(keyResolver)); |
| | 0 | 45 | | Argument.AssertNotNullOrEmpty(keyIdentifier, nameof(keyIdentifier)); |
| | | 46 | | |
| | 0 | 47 | | builder.Services.AddSingleton<IKeyEncryptionKeyResolver>(keyResolver); |
| | 0 | 48 | | builder.Services.Configure<KeyManagementOptions>(options => |
| | 0 | 49 | | { |
| | 0 | 50 | | options.XmlEncryptor = new AzureKeyVaultXmlEncryptor(keyResolver, keyIdentifier); |
| | 0 | 51 | | }); |
| | | 52 | | |
| | 0 | 53 | | return builder; |
| | | 54 | | } |
| | | 55 | | } |
| | | 56 | | } |