CommonKeyVaultServices 1.0.0

CommonKeyVaultServices

A reusable .NET library for integrating Azure Key Vault into applications with minimal setup.

Features

• Azure Key Vault configuration bootstrap
• SecretClient registration for dependency injection
• Support for DefaultAzureCredential and ClientSecretCredential
• SQL Server Always Encrypted Azure Key Vault provider registration
• Configuration via strongly typed KeyVaultOptions
• Compatible with ASP.NET Core, Azure Functions, Console Applications, and Class Libraries

Installation

Install the package from NuGet:

dotnet add package CommonKeyVaultServices

Basic Usage

Register Services

builder.Services.AddSharedKeyVaultServices(options =>
{
    options.VaultName = configuration["KeyVault:VaultName"];
    options.CredentialMode = "ClientSecret";
    options.TenantId = configuration["KeyVault:TenantId"];
    options.ClientId = configuration["KeyVault:ClientId"];
    options.ClientSecret = configuration["KeyVault:ClientSecret"];
});

Initialize Key Vault

builder.Configuration.AddSharedKeyVault(options =>
{
    options.VaultName = configuration["KeyVault:VaultName"];
    options.CredentialMode = "ClientSecret";
    options.TenantId = configuration["KeyVault:TenantId"];
    options.ClientId = configuration["KeyVault:ClientId"];
    options.ClientSecret = configuration["KeyVault:ClientSecret"];
});

Read Secrets

public class MyService
{
    private readonly IKeyVaultSecretReader _secretReader;

    public MyService(IKeyVaultSecretReader secretReader)
    {
        _secretReader = secretReader;
    }

    public async Task<string> GetSecretAsync()
    {
        return await _secretReader.GetSecretAsync("MySecret");
    }
}

Supported Credential Modes

Default

Uses Azure DefaultAzureCredential.

{
  "KeyVault": {
    "CredentialMode": "Default",
    "VaultName": "my-key-vault"
  }
}

ClientSecret

Uses Azure ClientSecretCredential.

{
  "KeyVault": {
    "CredentialMode": "ClientSecret",
    "VaultName": "my-key-vault",
    "TenantId": "<tenant-id>",
    "ClientId": "<client-id>",
    "ClientSecret": "<client-secret>"
  }
}

SQL Always Encrypted

The library can register the Azure Key Vault provider required by SQL Server Always Encrypted.

builder.InitializeSharedKeyVault(options =>
{
    // configuration
});

Requirements

• .NET 10 or later
• Azure Key Vault
• Appropriate Azure permissions for the selected credential type

Security

This package does not contain or store credentials, secrets, connection strings, tenant IDs, or vault information.

All credentials must be supplied by the consuming application.

Versioning

This project follows Semantic Versioning.

• Patch: Bug fixes (1.0.1)
• Minor: Backward-compatible features (1.1.0)
• Major: Breaking changes (2.0.0)

License

MIT License