Woof.Config 5.4.0

Woof.Config

.NET extension created by CodeDog

Distributed under MIT License. (c)2021 by CodeDog, All rights reserved.

About

This is an extension for Microsoft.Extensions.Configuration.IConfiguration that reads configuration files from JSON files placed in the same directory as the entry assembly. The configuration can be read using IConfiguration interface methods, or bound to an object property via Microsoft.Extensions.Configuration.ConfigurationBinder.Bind method.

It can also read some sensitive configuration data from Azure Key Vault.

Major changes since version 5.3.0

Configuration is now writeable (use Write() method). Also values can be set with IConfiguration.SetValue() method.

The configuration files can be protected with DPAPI module. On Linux, if the key directory is not set explicitly, it will be set with DPAPI.AutoConfigure() method.

On Windows specifying DataProtectionScope in constructors will make the configuration protected, that is encrypted in the specified protection scope.

That's also the reason the package has now a new dependency on Newtonsoft.Json that provides the necessary tools to build the JSON document tree from scratch.

Usage

Create JSON configuration file in main project directory, set its CopyToOutputDirectory like

<None Update="Config.json">
    <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
</None>

Optionally, for a different configuration for the DEBUG mode, create another file like

<None Update="Config.dev.json">
    <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
</None>

Create the IConfiguration instance like

var config = new JsonConfig("Config");

Optionally bind the config instance to configuration object instance with Bind method, see included test project for further details.

To use AKV access, create similar Access.json file in main project directory:

{
    "VaultUri": "[paste your vault URI here]",
    "DirectoryId": "[paste your directory ID here]",
    "ApplicationId": "[paste your application ID here]",
    "ClientSecret": "[paste your client secret here]"
}

Create instance of the AccessData data with:

var accessData = new AccessData("Access");

Now you can read configured secrets for the application, also, encrypt and decrypt sensitive data using keys defined as secrets in AKV. See the XML documentation of the AccessData class for details.

IMPORTANT: Since the configuration file contains client secret - it is sensitive and when put on a server the access to the file must be restricted!

When revoking client access is needed, it can be done from the AKV level, without touching the application.

Using credentials encryption provided in this module allows to achieve a kind of DPAPI equivalent on Linux servers. All credentials in application database are encrypted and the keys are stored on AKV. Important thing is when the AKV key is lost - the encrypted credentials will not be readable anymore, so on production environments the encryption keys must be backed up.

Compatibility

The package is compatible with .NET 5.0 or newer. The applications using the module can run both on Windows and Linux.

Disclaimer

Please report any issues to the toolkit developer.

Woof Toolkit is a work in progress in constant development, however it's carefully maintained with production code quality.