👁 Image
CasCap.Api.Azure.Auth 1.5.0

CasCap.Api.Azure.Auth

Helper library for Azure authentication. Provides a factory for creating TokenCredential instances from certificate-based configuration properties and an abstraction for Azure Key Vault and Entra ID settings.

Installation

dotnet add package CasCap.Api.Azure.Auth

Target frameworks: net8.0, net9.0, net10.0

Services / Extensions

Key Methods

• TokenCredentialExtensions.IsPodManagedIdentity — Checks whether the current pod is using Azure workload identity (federated tokens).
• TokenCredentialExtensions.CreateTokenCredential(IAzureAuthConfig) — Creates a ClientCertificateCredential from the certificate properties in the configuration, or returns null if no certificate is available.

Configuration

AzureAuthConfig implements both IAppConfig and IAzureAuthConfig. The TokenCredential property is lazily created from the certificate properties via TokenCredentialExtensions.

Running Without Key Vault

Set KeyVaultName to "skip" (case-insensitive) to disable Key Vault integration entirely. When IsKeyVaultEnabled returns false:

• The application skips adding Azure Key Vault as a configuration source at startup.
• TokenCredential is not resolved (no certificate lookup is attempted).
• Secrets must be supplied via alternative configuration sources (environment variables, user secrets, or appsettings.json).
• Sink services that use StorageExtensions.CreateTableClient() automatically fall back to connection strings when the connection string contains ; (e.g. Azurite emulator).

Override via any configuration source:

• Environment variable: AppConfig__KeyVaultName=skip
• User secrets: { "AppConfig": { "KeyVaultName": "skip" } }
• appsettings override: same JSON shape

Data Flow

TokenCredential creation from configuration:

flowchart TD
 CONFIG["AzureAuthConfig<br/>(IAzureAuthConfig)"]

 subgraph Detection["Environment Detection"]
 POD_CHECK{"IsPodManagedIdentity()?<br/>(Azure Workload Identity)"}
 WORKLOAD["WorkloadIdentityCredential<br/>(Federated token from pod)"]
 end

 subgraph CertificateSource["Certificate Source"]
 THUMBPRINT{"CertThumbprint<br/>provided?"}
 PFX{"PfxPath +<br/>PfxPassword<br/>provided?"}
 STORE["X509Store<br/>(LocalMachine\\My)"]
 FILE["X509Certificate2<br/>(from PFX file)"]
 end

 CREDENTIAL["ClientCertificateCredential"]
 NULL["null<br/>(no credential)"]

 subgraph AzureServices["Azure Services"]
 KV["Key Vault"]
 STORAGE["Storage"]
 EH["Event Hub"]
 SB["Service Bus"]
 end

 CONFIG --> SKIP_CHECK{"KeyVaultName<br/>= 'skip'?"}
 SKIP_CHECK -->|"Yes"| NULL
 SKIP_CHECK -->|"No"| POD_CHECK
 POD_CHECK -->|"Yes"| WORKLOAD
 POD_CHECK -->|"No"| THUMBPRINT

 THUMBPRINT -->|"Yes"| STORE
 THUMBPRINT -->|"No"| PFX

 PFX -->|"Yes"| FILE
 PFX -->|"No"| NULL

 STORE --> CREDENTIAL
 FILE --> CREDENTIAL
 WORKLOAD --> KV
 WORKLOAD --> STORAGE
 WORKLOAD --> EH
 WORKLOAD --> SB

 CREDENTIAL --> KV
 CREDENTIAL --> STORAGE
 CREDENTIAL --> EH
 CREDENTIAL --> SB

Credential Resolution Priority:

0. Skip sentinel — KeyVaultName = "skip" → null (no credential, no Key Vault)
1. Azure Workload Identity (Kubernetes pod with federated token) — auto-detected
2. Certificate thumbprint — searches LocalMachine\My certificate store
3. PFX file — loads certificate from path with password
4. null — no credential available

Dependencies

NuGet Packages

Project References

None.