A safer way to use key storage

Question

Usually, when you use the key store to encrypt and decrypt data, you should save your registered AD application (with authorization to access the key store) ClientID and ClientSecret in plain text. This seems like a security issue if someone steals the ClientID and Secret, and anyone can claim to be a registered application.

Is there or can be a safer approach?

Answer 1

You can use a certificate for authentication instead of secret.

For this approach, three things must be done:

• .
• Active Directory, , , 1. , , 'll New-AzureRMADApplication PowerShell.
• Key Vault. AuthenticationContext.AcquireTokenAsync(), ClientAssertionCertificate . ClientAssertionCertificate, X509Certificate2.

.

Answer 2

KeyVault, Azure Managed Service Identity Azure . : Azure VM, Azure App Service, Azure Function, Azure Event Hub Azure Service Bus. https://docs.microsoft.com/en-us/azure/active-directory/msi-overview

[ ] - KeyVault, Azure MSI . AzureServiceTokenProvider()

(, Ansible) Ansibe Vault 256- . . Azure.