Azure key vault for secrets

Azure key vault for secrets

Azure key vault for secrets

The passwords and secrets that are entered in settings and workflow components, are by default encrypted using InterFormNG2’s built in AES encryption.
Alternatively it is also possible to read secret values from Azure Key Vault. This is especially useful when InterFormNG2 is hosted on Azure. It is recommended to create a separate key vault that is only used for InterFormNG2 secrets.

Configuration

To use Azure Key Vault with InterFormNG2, you first need to create an app registration in Microsoft Entra Admin Center:

Microsoft Entra admin center

  1. From the left side menu, navigate to Applications -> App registrations -> New registration.

  2. On this screen, enter a suitable name for the app, for instance "InterForm" and select "Accounts in this organizational directory only (XXX.XXX only - Single tenant)". Leave "redirect URI" undefined and press the "Register" button.

  3. An Application (client) ID and Directory (tenant) ID have been generated for you. Now click the link "Add a certificate or secret" next to "Client credentials".

  4. Under "Client Secrets" use the "New client secret" button to create a secret. Select any expiry time that you like, but note that you have to create a new secret when it expires.

  5. Now that you have created a secret, immediately make a copy of the value in the "Value" column, as you will not be able to see this again later.

Next you need to assign permissions to the app registration on the Azure Portal. This process can be scripted, but this is outside the scope of this document. Below is a description of how to do it manually on Microsoft Azure

  1. Create a new key vault or select an existing one to use. Make sure the key vault is configured for Azure role-based access control”.

  2. In the left-side menu, select "Access control (IAM)", then Add → Add role assignment.

  3. Select the role “Key Vault Secrets User” then press the “Next” button.

  4. Select Next → select members. Here type the name of the previously created app registration and select it. 

  5. Now use the button "Review + assign" two times to complete the process.

Now log in as admin on InterFormNG2 and configure the connection in the system settings.

Under “Azure Key Vault” as “Key vault URI” enter the Vault URI as displayed on Azure Portal. This has the format https://<vaultname>.vault.azure.net/

If InterFormNG2 is hosted on Azure, then it is recommended to enable the “use default credentials” switch. In this case, the credentials must be set as environment variables on the VM that is hosting InterFormNG2. There are different options on how this can be done, for details see DefaultAzureCredential Class . For instance you can set the values of the previously created app registration as three environment variables:

  • AZURE_CLIENT_ID: Client ID of the Microsoft Entra application.

  • AZURE_TENANT_ID: Directory ID of the Microsoft Entra tenant.

  • AZURE_CLIENT_SECRET: One of the application's client secrets.

If InterFormNG2 is not hosted on Azure, then disable the switch “use default credentials” and enter the app registration credentials in the InterFormNG2 settings.

To test that the connection is working, as “secret name” enter the name of a secret that exists in the Azure Key Vault and then use the button “Test connection”. If the connection is working, the text “Successfully read secret” will be displayed. Otherwise an error is displayed. For obvious security reasons, the value of the secret is not displayed.

The configuration is now complete.

Using secrets from Azure Key Vault

The secrets need to be created in the Azure Key Vault through scripting or the Azure Portal UI. InterFormNG2 will not create secrets in the vault, it can only read secrets that already exist in the vault.

In all password / secret fields in the InterFormNG2 settings and workflow components, it is possible to refer to a secret from the vault instead of using InterFormNG2’s own encryption. To refer to a secret in Azure Key Vault, it must be entered as “{AZV}secretname” where “secretname” is the name of the secret in the vault. The {AZV} prefix indicates that this is an ID from the vault rather than a literal value.

    • Related Articles

    • From Azure Service Bus

      A workflow in InterFormNG2 can be initiated by a message from Azure Service Bus with this input type: The parameters are: Azure Service Bus instance Select the connection configuration to use. Fully qualified namespace (host name) Enter the host name ...

    • Delayed email cancel key

      The Delayed email cancel key component is used together with these workflow components: Cancel delayed email. Use this component to cancel a delayed email. PDF Delayed email. This defines a delayed email. Send emails from delay queue. This sends out ...

    • Azure Service Bus send message

      You can use the advanced, output workflow component, Azure Service Bus send message to send the current payload in InterFormNG2 to Azure Service Bus. The component has these parameters: Azure Service Bus instance Select the connection settings ...

    • Log info key component

      The job logs of InterFormNG2 includes all requests, but it can be a bit difficult to identify a specific document, so to make that possible you can assign a value to the Log info meta data key. This makes it much easier to search for a specific job ...

    • Split spool (complex key)

      A spooled file can be split into smaller files depending on the contents e.g. to split up a larger spooled file with many invoices into individual invoices. If the other spooled file split functions are not enough, then you can consider this workflow ...