连接到保管库并使用凭据

Question

我正在尝试设置 hashcorp 保险库并获取我们存储在保险库中的键值对（数据库凭据）。

我按照下面的链接连接到保险库并从保险库中获取凭据 https://github.com/rajanadar/VaultSharp

我可以很好地连接并从保管库中获取凭据，但我的问题是如何将此凭据传递给我的数据库上下文。 我是否需要将这些凭据存储在某个地方，从那里获取然后传递给我的数据库上下文，或者我是否需要每次都初始化这个类。 下面是获取凭证的示例代码

public class VaultService : IVaultService 
{   
    public async Task Configure()
    {
       //code to authenticate role and connect vault here 
       
        //Below is the code that actually fetches the credentials. I am just providing relevant code.
        Secret<SecretData> secret = await vaultClient.V1.Secrets.KeyValue.V2.ReadSecretAsync(kvpPath.Value, mountPoint: "kv");
        foreach (var kvp in secret.Data.Data)
        {
            // Console.WriteLine(kvp.Key + " : " + kvp.Value);
        }      
    }   
}   

如何使用上述类来获取和传递凭据。

下面是定义我的数据库上下文的启动类：

public class Startup
{
   public void ConfigureServices(IServiceCollection services)
   {
      services.AddTransient<IDbAdapterService, DbAdapterService>();     
   }
}

下面是我需要使用凭据的 DbAdapterService

public class DbAdapterService : DbAdapterService
{
      private readonly AppSettings _settings;
      public DbAdapterService(IOptions<AppSettings> settings)
      {
           _settings = settings?.Value;
           DbConnectionStringBuilder builder = new DbConnectionStringBuilder();
           //Below is where I need to update the credentials
           builder.ConnectionString = _settings.ConnectionString;           
      }
}

Answer 1

我认为你做得很好。 这是您需要的作品。

 builder.ConnectionString = "server=(local);user id=*******;" +
        "password=*******;initial catalog=AdventureWorks";
    builder["Server"] = ".";
//set up individual key with value

现在换班

public class DbAdapterService : DbAdapterService ,IVaultService 


{

 

    private readonly AppSettings _settings;
          public DbAdapterService(IOptions<AppSettings> settings)
          {
               _settings = settings?.Value;
    
    Secret<SecretData> secret = await vaultClient.V1.Secrets.KeyValue.V2.ReadSecretAsync(kvpPath.Value, mountPoint: "kv");
      string Key="";
            foreach (var kvp in secret.Data.Data)
            {
                // Console.WriteLine(kvp.Key + " : " + kvp.Value);
    Key= kvp.Value;
            }   
    
            builder.ConnectionString = "server=(local);user id=*******;" +
                "password=*******;initial catalog=AdventureWorks";
            builder["Server"] = Key;
            builder["User ID"] = Key;
           
    }
    
    }

Answer 2

您可以通过遵循 ASP.NET Core 的配置抽象来简化并使事情变得更加健壮。

ASP.NET Core 为您提供 IConfiguration 和 IConfigurationProvider 接口，它们抽象出配置的来源和来源。

您可以使用 Andrew Lock 的 Hashicorp Vault 配置提供程序 NetEscapades.Configuration.Vault，这将使应用程序从 Vault 服务器获取配置和机密。

public static IWebHost BuildWebHost(string[] args) =>
    WebHost.CreateDefaultBuilder(args)
        .ConfigureAppConfiguration((ctx, builder)=> 
        {
            // build the initial config
            var builtConfig = config.Build();

            builder.AddVaultWithAppRole(
                config["VaultUri"], //The Vault uri with port
                config["RoleId"], // The role_id for the app
                config["SecretId"], // The secret_iId for the app
                config["SecretPath"] // secret paths to load
                );
        })
        .UseStartup<Startup>()
        .Build();

然后在 Startup 类中，您可以使用IConfiguration 并获取连接字符串来配置 DbContext。

public IConfiguration Configuration { get; set; }
public void ConfigureServices(IServiceCollection services) {
    services.AddDbContext<AppDbContext>(o => 
        o.UseSqlServer(Configuration.GetConnectionString("SqlServer"))
    );
}

参考资料：

• https://docs.microsoft.com/en-us/dotnet/core/extensions/custom-configuration-provider
• https://andrewlock.net/creating-a-custom-iconfigurationprovider-in-asp-net-core-to-parse-yaml/