Skip to content
This repository has been archived by the owner on Jun 17, 2024. It is now read-only.

Commit

Permalink
Move to Track2 Update 2 (#8)
Browse files Browse the repository at this point in the history
  • Loading branch information
tzhanl authored and jongio committed Jan 7, 2020
1 parent e72f6bd commit ac5ca50
Show file tree
Hide file tree
Showing 5 changed files with 112 additions and 100 deletions.
212 changes: 112 additions & 100 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,45 +6,37 @@ languages:
products:
- azure-key-vault
- azure
description: "This QuickStart shows how to store a secret in Key Vault and how to retrieve it using a Web app. This web app may be run locally or in Azure."
urlFragment: key-vault-node-quickstart
description: "How to set and get secrets from Azure Key Vault using Node.js."
urlFragment: get-set-keyvault-secrets-managed-id-nodejs
---

# Quickstart: Set and retrieve a secret from Azure Key Vault using a Node Web App
# How to set and get secrets from Azure Key Vault using Node.js

This Quickstart shows how to store a secret in Key Vault and how to retrieve it using a Web app. This web app may be run locally or in Azure. The Quickstart uses Node.js and [Azure Managed Identities](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/)
This sample shows how to store a secret in Key Vault and how to retrieve it using a Web app. This web app may be run locally or in Azure. The sample uses Node.js and [Azure Managed Identities]

> * Create a Key Vault.
> * Store a secret in Key Vault.
> * Retrieve a secret from Key Vault.
> * Create an Azure Web Application.
> * [Enable Azure Managed Identities](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/).
> * [Enable Azure Managed Identities].
> * Grant the required permissions for the web application to read data from Key vault.
Before you proceed make sure that you are familiar with the [Key Vault Concepts](https://docs.microsoft.com/en-us/azure/key-vault/key-vault-overview).
Before you proceed make sure that you are familiar with the [Key Vault Concepts].

# SDK Versions
## SDK Versions

In this sample, you will find the following folders:
* **key-vault-node-quickstart-v3** - references Key Vault SDK v3.0
* **key-vault-node-quickstart-v4** - references Key Vault SDK v4.0


* To use the latest Azure SDK version [key-vault-node-quickstart-v4](./key-vault-node-quickstart-v4) please add the following dependency:
* [@azure/identity](https://www.npmjs.com/package/@azure/identity)
* [@azure/keyvault-secrets](https://www.npmjs.com/package/@azure/keyvault-secrets)
* For the previous Azure SDK version [key-vault-node-quickstart-v3](./key-vault-node-quickstart-v3) please add the following dependency:
* [ms-rest-azure](https://www.npmjs.com/package/ms-rest-azure)
* [azure-keyvault](https://www.npmjs.com/package/azure-keyvault)
* **v3** - references Key Vault SDK v3
* **v4** - references Key Vault SDK v4

## Prerequisites

* [Node.js](https://nodejs.org)
* [Git](https://www.git-scm.com/)
* [Azure CLI](https://docs.microsoft.com/cli/azure/install-azure-cli?view=azure-cli-latest) 2.0.4 or later
* An Azure subscription. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
* [Node.js]
* [Git]
* [Azure CLI] 2.0.4 or later
* An Azure subscription. If you don't have an Azure subscription, create a [free account] before you begin.

## Log in to Azure
### Log in to Azure

1. Open a command prompt, i.e. cmd, terminal, etc
2. Execute the following command to log in to Azure
Expand All @@ -53,15 +45,15 @@ In this sample, you will find the following folders:
az login
```

## Create Resource Group
### Create Resource Group

**1. What is a Resource Group**

An Azure Resource Group is a logical container into which Azure resources are deployed and managed.

**2. How to create a Resource Group**

Create a Resource Group with the [az group create](https://docs.microsoft.com/en-us/azure/azure-resource-manager/manage-resources-cli) command.
Create a Resource Group with the [az group create] command.

When you create a Resource Group you have give it a unique custom name. Please think of a custom name for your Resource Group and replace the text below `"<MyResourceGroupName>"` with the custom name you created.

Expand All @@ -74,7 +66,7 @@ az group create --name "<MyResourceGroupName>" --location eastus

The Resource Group you just created is used throughout this tutorial.

## Create an Azure Key Vault
### Create an Azure Key Vault

Next you will create a Key Vault using the Resource Group created in the previous step. Provide the following information:

Expand All @@ -86,7 +78,7 @@ Next you will create a Key Vault using the Resource Group created in the previou
az keyvault create --name "<MyKeyVaultName>" --resource-group "<MyResourceGroupName>" --location eastus
```

## Add a Secret to Key Vault
### Add a Secret to Key Vault

Next, we'll add a secret to Key Vault to help illustrate how Secret Value works. You could store an SQL connection string or any other information that you need to keep secure and make it available to your application.

Expand All @@ -102,95 +94,36 @@ To view the value contained in the Secret as plain text, please type the followi
az keyvault secret show --name AppSecret --vault-name "<MyKeyVaultName>"
```

## Clone the repo
### Clone the repo

Run the following command to clone this Quickstart code to your local machine:
Run the following command to clone this sample code to your local machine:

```Bash
git clone https://github.com/Azure-Samples/key-vault-node-quickstart.git
git clone https://github.com/Azure-Samples/azure-sdk-for-js-keyvault-secret-get-set-managedid.git
```

## Install dependencies
### Install dependencies

Run the following command to install dependencies for "SDK version 3.0" and "SDK version 4.0":
Run the following command to install dependencies for "SDK version 3" and "SDK version 4":

- SDK version 4.0
- SDK version 4

```Bash
cd key-vault-node-quickstart-v4
cd v4
```
```Bash
npm install
```

- SDK version 3.0
- SDK version 3

```Bash
cd key-vault-node-quickstart-v3
cd v3
```
```Bash
npm install
```

## Publish the web application to Azure

To publish this web application to Azure, we need to create an Azure App Service, Azure Web App, and create a Deployment User.

**1. Azure App Service**

The first step is to create an [Azure App Service](https://azure.microsoft.com/services/app-service/) Plan. You can store multiple web apps in this plan. Use the Resource Group that you created earlier in the following command:

```Bash
az appservice plan create --name "<MyAppServicePlan>" --resource-group "<MyResourceGroup>"
```

**2. Azure Web App**

Next we create a web app. In the following example, replace <AppName> with a globally unique app name (valid characters are a-z, 0-9, and -). The runtime is set to NODE|6.9. To see all supported runtimes, run az webapp list-runtimes:


# Bash
az webapp create --resource-group "<MyResourceGroup>" --plan "<MyAppServicePlan>" --name "<AppName>" --runtime "NODE|6.9" --deployment-local-git
# PowerShell
az webapp create --resource-group "<MyResourceGroup>" --plan "<MyAppServicePlan>" --name "<AppName>" --runtime "NODE|6.9"

After the web app is created, the Azure CLI outputs something similar to the following:


{
"availabilityState": "Normal",
"clientAffinityEnabled": true,
"clientCertEnabled": false,
"cloningInfo": null,
"containerSize": 0,
"dailyMemoryTimeQuota": 0,
"defaultHostName": "<AppName>.azurewebsites.net",
"enabled": true,
"deploymentLocalGitUrl": "https://<UserName>@<AppName>.scm.azurewebsites.net/<AppName>.git"
< JSON data removed for brevity. >
}

Browse to your newly created web app, and you should see a functioning web app. Replace `<AppName>` with the unique app name that you chose previously.

```Bash
http://<AppName>.azurewebsites.net
```

The above command also creates a Git-enabled app which allows you to deploy to Azure from your local git.
Local Git repository is configured with this url:

```Bash
https://<UserName>@<AppName>.scm.azurewebsites.net/<AppName>.git
```

**3. Deployment User**

After running the previous command, you can add an Azure Remote to your local Git repository. Replace `<url>` with the URL of the Git Remote that you got from [enabling Git for your app](https://docs.microsoft.com/en-us/azure/app-service/deploy-local-git).

```Bash
git remote add azure <url>
```

### Configuring your Key Vault

- Create a service principal and configure its access to Azure resources:
Expand Down Expand Up @@ -229,7 +162,7 @@ git remote add azure <url>
az keyvault show --name "<MyKeyVaultName>"
```

## Enable Azure Managed Identities
### Enable Azure Managed Identities

Azure Key Vault provides a way to securely store credentials and other keys and secrets, but your code needs to be authenticated to Key Vault before retrieving them. Azure Managed Identities simplify this need by giving Azure services an automatically managed identity in Azure Active Directory (Azure AD). You can use this identity to authenticate to any service that supports Azure AD authentication, including Key Vault, without having to store any credentials in your code.

Expand All @@ -255,6 +188,65 @@ Then, run this command using the name of your Key Vault and the value of Princip
az keyvault set-policy --name "<MyKeyVaultName>" --object-id "<PrincipalId>" --secret-permissions get
```

## Publish the web application to Azure

To publish this web application to Azure, we need to create an Azure App Service, Azure Web App, and create a Deployment User.

**1. Azure App Service**

The first step is to create an [Azure App Service] Plan. You can store multiple web apps in this plan. Use the Resource Group that you created earlier in the following command:

```Bash
az appservice plan create --name "<MyAppServicePlan>" --resource-group "<MyResourceGroup>"
```

**2. Azure Web App**

Next we create a web app. In the following example, replace <AppName> with a globally unique app name (valid characters are a-z, 0-9, and -). The runtime is set to NODE|6.9. To see all supported runtimes, run az webapp list-runtimes:


# Bash
az webapp create --resource-group "<MyResourceGroup>" --plan "<MyAppServicePlan>" --name "<AppName>" --runtime "NODE|6.9" --deployment-local-git
# PowerShell
az webapp create --resource-group "<MyResourceGroup>" --plan "<MyAppServicePlan>" --name "<AppName>" --runtime "NODE|6.9"

After the web app is created, the Azure CLI outputs something similar to the following:


{
"availabilityState": "Normal",
"clientAffinityEnabled": true,
"clientCertEnabled": false,
"cloningInfo": null,
"containerSize": 0,
"dailyMemoryTimeQuota": 0,
"defaultHostName": "<AppName>.azurewebsites.net",
"enabled": true,
"deploymentLocalGitUrl": "https://<UserName>@<AppName>.scm.azurewebsites.net/<AppName>.git"
< JSON data removed for brevity. >
}

Browse to your newly created web app, and you should see a functioning web app. Replace `<AppName>` with the unique app name that you chose previously.

```Bash
http://<AppName>.azurewebsites.net
```

The above command also creates a Git-enabled app which allows you to deploy to Azure from your local git.
Local Git repository is configured with this url:

```Bash
https://<UserName>@<AppName>.scm.azurewebsites.net/<AppName>.git
```

**3. Deployment User**

After running the previous command, you can add an Azure Remote to your local Git repository. Replace `<url>` with the URL of the Git Remote that you got from [enabling Git for your app].

```Bash
git remote add azure <url>
```

## Deploy the Node App to Azure and retrieve the secret value

Now that everything is deployed and configured, run the following command to deploy the app to Azure. This will push your local master branch to the git remote called 'azure' that you created earlier:
Expand All @@ -269,11 +261,31 @@ Make sure that you replaced the name `<AppName>` with your vault name.

## Next steps

* [Azure Key Vault Home Page](https://azure.microsoft.com/services/key-vault/)
* [Azure Key Vault Documentation](https://docs.microsoft.com/azure/key-vault/)
* [Azure SDK For Node.js](https://docs.microsoft.com/javascript/api/overview/azure/key-vault)
* [Azure REST API Reference](https://docs.microsoft.com/rest/api/keyvault/)
* [Azure Key Vault Home Page]
* [Azure Key Vault Documentation]
* [Azure SDK For JavaScript]
* [Azure Key Vault REST API Reference]

## Contributing

This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
This project has adopted the [Microsoft Open Source Code of Conduct]. For more information see the [Code of Conduct FAQ] or contact [opencode@microsoft.com] with any additional questions or comments.


<!-- LINKS -->
[Azure Managed Identities]: https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/
[Enable Azure Managed Identities]: https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/
[Key Vault Concepts]: https://docs.microsoft.com/en-us/azure/key-vault/key-vault-overview
[Node.js]: https://nodejs.org
[Git]: https://www.git-scm.com/
[Azure CLI]: https://docs.microsoft.com/cli/azure/install-azure-cli?view=azure-cli-latest
[free account]: https://azure.microsoft.com/free/?WT.mc_id=A261C142F
[az group create]: https://docs.microsoft.com/en-us/azure/azure-resource-manager/manage-resources-cli
[Azure App Service]: https://azure.microsoft.com/services/app-service/
[enabling Git for your app]: https://docs.microsoft.com/en-us/azure/app-service/deploy-local-git
[Azure Key Vault Home Page]: https://azure.microsoft.com/services/key-vault/
[Azure Key Vault Documentation]: https://docs.microsoft.com/azure/key-vault/
[Azure SDK For JavaScript]: https://github.com/Azure/azure-sdk-for-js/tree/master/sdk/keyvault/keyvault-secrets
[Azure Key Vault REST API Reference]: https://docs.microsoft.com/rest/api/keyvault/
[Microsoft Open Source Code of Conduct]: https://opensource.microsoft.com/codeofconduct/
[Code of Conduct FAQ]: https://opensource.microsoft.com/codeofconduct/faq/
[opencode@microsoft.com]: mailto:opencode@microsoft.com
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.

0 comments on commit ac5ca50

Please sign in to comment.