I have created an Azure Key Vault which saves my application secrets.
And I want to retrieve the secrets from my Controller code. My controller code is based on ASP.Net core.
From here, https://learn.microsoft.com/en-us/dotnet/api/overview/azure/identity-readme
I see the example of how to create a SecretClient
// Create a secret client using the DefaultAzureCredential
var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), new DefaultAzureCredential());
My question is Since I am running the code on the service side (in Controller side), how can I create DefaultAzureCredential without any interactive authentication?
According to Document referred by you under DefaultAzureCredential , In service side you can use the application with user Managed Identity,DefaultAzureCredential
will authenticate with that account which is without interactive mode.
// When deployed to an azure host, the default azure credential will authenticate the specified user assigned managed identity.
string userAssignedClientId = "<your managed identity client Id>";
var credential = new DefaultAzureCredential(new DefaultAzureCredentialOptions { ManagedIdentityClientId = userAssignedClientId });
var blobClient = new BlobClient(new Uri("https://myaccount.blob.core.windows.net/mycontainer/myblob"), credential);
The Azure_client_id environment variable can be used to set the ManagedIdentityClientId in addition to setting it via code. When utilising the DefaultAzureCredential, these two approaches are equal. Without having to expose credentials in your code, you may use this identity to log in to any service that accepts Azure AD authentication, including Key Vault.
You can also refer this MS-Document more in detail to use managed identity to connect Key Vault to an Azure web app in .NET