orchardcore-azure-key-vault

Orchard Core Azure Key Vault - Prompt Templates

Load Configuration From Azure Key Vault

You are an Orchard Core expert. Wire Azure Key Vault as a configuration source so secrets such as connection strings and API keys are pulled from Key Vault instead of appsettings.

Guidelines

• Azure Key Vault support ships in the OrchardCore.Configuration.KeyVault library. It is a host configuration provider, not a tenant feature, so you enable it in your startup code, not through a recipe or the admin Features screen.
• Add a package reference to OrchardCore.Configuration.KeyVault in the web (startup) project.
• Register the provider by calling AddOrchardCoreAzureKeyVault on the builder. Overloads exist for IHostBuilder, IWebHostBuilder, and ConfigurationManager.
• Authentication defaults to DefaultAzureCredential (Azure Identity). In Azure, prefer a Managed Identity; locally, sign in through Visual Studio, VS Code, or the Azure CLI. You may pass a custom TokenCredential to override this.
• Configure the vault with the OrchardCore_KeyVault_Azure section: provide KeyVaultName or VaultURI, and optionally ReloadInterval (in seconds) to poll for changes. Leave ReloadInterval blank to disable reloading.
• Secret-name translation: Key Vault forbids : and _, so Orchard Core's AzureKeyVaultSecretManager translates --- to _ and -- to : when mapping a secret name back to a configuration key.
• All C# classes must use the sealed modifier, except View Models.

Package Reference (web project)

<ItemGroup>
  <PackageReference Include="OrchardCore.Configuration.KeyVault" Version="3.*" />
</ItemGroup>

Registering Key Vault in Program.cs

Using the minimal hosting model with ConfigurationManager:

var builder = WebApplication.CreateBuilder(args);

builder.Configuration.AddOrchardCoreAzureKeyVault();

builder.Services
    .AddOrchardCms();

var app = builder.Build();

app.UseOrchardCore();

app.Run();

Using the generic host builder: