# How to access secrets in Azure Key Vault using Java
## What is Azure Key Vault?
[Azure Key Vault](https://azure.microsoft.com/en-us/services/key-vault/) is a cloud service offered by Microsoft to securely store cryptographic keys, certificates, and secrets. At StratoGator we use Key Vault as part of our solution to keep our client secrets secure.
## How do I get started
The following information is required to access the Key Vault:
- Key Vault URL
- Client Id
- Client Key (or certificate)
### Key Vault URL
Create the Key Vault through the Azure Portal. The name you choose for the key vault will determine the first part of the URL:
https://_your_key_vault_name_.vault.azure.net
### Client Id
To locate your client/application id:
1. Navigate to Azure Active Directory.
2. Select “App Registrations”.
3. Choose your application.
4. The Application ID can be copied from the page that appears.
### Client Key
To generate a client/application key:
1. Navigate to Azure Active Directory.
2. Select “App Registrations”.
3. Choose your application.
4. Select the “Keys” blade.
5. Add a new key and hit “Save”.
6. When you create your new key, the secret value will be revealed. This is your only opportunity to copy the key value.
### Permissions
In order for your application to have access to the Key Vault contents, you must set the appropriate permissions for your application in the Key Vault.
1. Navigate to Key vaults.
2. Select your Key Vault.
3. Select the “Access Policies” blade.
4. Select “Add new”.
5. Choose your application as the Principal.
6. Select the minimum required permissions for your application.
7. Hit “OK” to complete.
8. Select “Save” to save your new access policy.
## Dependencies
Accessing an Azure Key Vault using Java requires the [Azure SDK for Java](https://github.com/Azure/azure-sdk-for-java/) ([Maven link](https://mvnrepository.com/artifact/com.microsoft.azure/azure)) and [Azure KeyVault SDK for Java](https://github.com/Azure/azure-sdk-for-java/tree/master/azure-mgmt-keyvault) ([Maven link](https://mvnrepository.com/artifact/com.microsoft.azure/azure-keyvault)).
These dependencies must be added to your pom.xml:
| | |
|--------|-------------------------------------------------------------|
| 1
2
3
4
5
6
7
8
9
10 |
com.microsoft.azure
azure
1.3.0
com.microsoft.azure
azure-keyvault
1.0.0
|
## Connection
You must implement a _KeyVaultCredentials_ class to connect to the Key Vault. The follow is an example adapted from the [Microsoft KeyVaultCredentials API documentation](https://azure.github.io/azure-sdk-for-java/com/microsoft/azure/keyvault/authentication/KeyVaultCredentials.html#doAuthenticate-java.lang.String-java.lang.String-java.lang.String-).
| | |
|--------|-------------------------------------------------------------|
| 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56 | package com.example.azure.keyvault;
import com.microsoft.aad.adal4j.AuthenticationContext;
import com.microsoft.aad.adal4j.AuthenticationResult;
import com.microsoft.aad.adal4j.ClientCredential;
import com.microsoft.azure.keyvault.authentication.KeyVaultCredentials;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import java.util.concurrent.Future;
/\*
\* Based on example from Microsoft documentation:
\* https://azure.github.io/azure-sdk-for-java/com/microsoft/azure/keyvault/authentication/KeyVaultCredentials.html
\*/
public class ClientSecretKeyVaultCredential extends KeyVaultCredentials
{
private String clientId;
private String clientKey;
public ClientSecretKeyVaultCredential(String clientId, String clientKey ){
this.clientId= clientId;
this.clientKey= clientKey;
}
@Override
public String doAuthenticate(String authorization, String resource, String scope){
AuthenticationResult token = getAccessTokenFromClientCredentials(
authorization, resource, clientId, clientKey);
return token.getAccessToken();
}
private static AuthenticationResult getAccessTokenFromClientCredentials(
String authorization, String resource, String clientId, String clientKey){
AuthenticationContext context = null;
AuthenticationResult result = null;
ExecutorService service = null;
try{
service = Executors.newFixedThreadPool(1);
context = new AuthenticationContext(authorization, false, service);
ClientCredential credentials = new ClientCredential(clientId, clientKey);
Future future = context.acquireToken(
resource, credentials, null);
result = future.get();
} catch(Exception e){
throw new RuntimeException(e);
} finally{
service.shutdown();
}
if(result == null){
throw new RuntimeException("authentication result was null");
}
return result;
}
} |
## Access Key Vault information
Use the _KeyVaultCredentials_ class you’ve created to instantiate a _KeyVaultClient_, and then perform your actions.
[KeyVaultClient API documentation](https://docs.microsoft.com/en-us/java/api/com.microsoft.azure.keyvault._key_vault_client)
For example:
| | |
|--------|-------------------------------------------------------------|
| 1
2
3
4
5
6
7
8 | // ClientSecretKeyVaultCredential is the implementation of KeyVaultCredentials
KeyVaultClient client = new KeyVaultClient(
new ClientSecretKeyVaultCredential(clientId, clientKey));
// KEYVAULT_URL is the location of the keyvault to use: https://yourkeyvault.vault.azure.net
// "testSecret" is the name of the secret in the key vault
SecretBundle secret = client.getSecret( KEYVAULT_URL, "testSecret");
log(secret.value()); |
## Related Links
[How to use keys, secrets and certificates with Key Vault](https://docs.microsoft.com/en-us/rest/api/keyvault/about-keys--secrets-and-certificates)
[Spring Boot Starter](https://github.com/Microsoft/azure-spring-boot/tree/master/azure-spring-boot-starters/azure-keyvault-secrets-spring-boot-starter)