Create a new secret provider

Prerequisites

The secret providers are configured during the initial application build-up in the Program.cs:

using Microsoft.Extensions.Hosting;
public class Program{    public static void Main(string[] args)    {        CreateHostBuilder(args).Build().Run();    }
    public static IHostBuilder CreateHostBuilder(string[] args)    {        return Host.CreateDefaultBuilder(args)                   .ConfigureSecretStore((context, config, builder) =>                   {                       builder.AddEnvironmentVariables();                   })                   .ConfigureWebHostDefaults(webBuilder => webBuilder.UseStartup<Startup>());    }}

This section describes how a new secret store source can be added to the pipeline.

Developing a secret provider

1. Install the NuGet package Arcus.Security.Core.

2. Implement your own implementation of the ISecretProvider ex:

   using Arcus.Security.Core;
   namespace Application.Security.CustomProviders{    public class RegistrySecretProvider : ISecretProvider    {        public Task<string> GetRawSecretAsync(string secretName)        {            object value = Registry.LocalMachine.GetValue(secretName);            return Task.FromResult(value?.ToString());        }
           public async Task<Secret> GetSecretAsync(string secretName)        {            string secretValue = await GetRawSecretAsync(secretName);            return new Secret(secretValue);        }    }}

3. Optionally, you can provide an extension for a consumer-friendly way to add the provider. ex:

    namespace Microsoft.Extensions.Hosting {     public static class SecretStoreBuilderExtensions     {         public static SecretStoreBuilder AddRegistry(this SecretStoreBuilder builder)         {             var provider = new RegistrySecretProvider();             return builder.AddProvider(provider);         }     } }

   And in the Startup.cs:

   .ConfigureSecretStore((context, config, builder) =>{    builder.AddRegistry();})

   Or, you can use your provider directly.

   .ConfigureSecretStore((context, config, builder) => {    var provider = new RegistrySecretProvider();    builder.AddProvider(provider);})

4. Now, the secret source is available in the resulting ISecretProvider registered in the dependency injection container. ex:

   using Arcus.Security.Core;
   namespace Application.Controllers{    [ApiController]    public class OrderController : ControllerBase    {        public class OrderController(ISecretProvider secretProvider)        {        }    }}

5. Note that when your secret provider requires caching, you can wrap the provider in a CachedSecretProvider at registration: ex:

   using Arcus.Security.Core.Caching;
    namespace Microsoft.Extensions.Hosting {     public static class SecretStoreBuilderExtensions     {         public static SecretStoreBuilder AddCachedRegistry(this SecretStoreBuilder builder)         {             var provider = new RegistrySecretProvider();             var configuration = new CacheConfiguration(TimeSpan.FromSeconds(5));
                return builder.AddProvider(new CachedSecretProvider(provider, configuration));         }     } }

   When accessing the provider in the application, you can use the ICachedSecretProvider to have access to the cache-specific methods. ex:

   using Arcus.Security.Core.Caching;
    namespace Application.Controllers {     [ApiController]     public class OrderController : ControllerBase     {         public class OrderController(ICachedSecretProvider secretProvider)         {         }     } }

Contribute your secret provider

We are open for contributions and are more than happy to receive pull requests with new secret providers!