Track progress on Azure Key Vault support for .NET Core

[David-Engel]

Microsoft.SqlServer.Management.AlwaysEncrypted.AzureKeyVaultProvider does not yet support .NET Core. Filing this issue to keep track of when the team that owns it releases an update that does support .NET Core.

Reference: https://www.nuget.org/packages/Microsoft.SqlServer.Management.AlwaysEncrypted.AzureKeyVaultProvider

[naresh1990]

Any update on this? or any timeline for this to be included in .NET Core?

[David-Engel]

Any update on this? or any timeline for this to be included in .NET Core?

No update. It's not "in .NET Core". It's an independent library which needs to support .NET Core targets. The team that owns it says it's a high priority on their TODO list but there is no timeline right now.

[ghost]

I was able to get this to work by re-implementing the SqlColumnEncryptionAzureKeyVaultProvider by mostly copying the decompiled source of the .NET Framework version. Using dotPeek or ILSpy on the dll inside the https://www.nuget.org/api/v2/package/Microsoft.SqlServer.Management.AlwaysEncrypted.AzureKeyVaultProvider/2.1.0 nupkg you can see the decompiled source of SqlColumnEncryptionAzureKeyVaultProvider, and the only real things that needed changing that I could see were replacing new SHA256Cng() with SHA256.Create() a few times and replacing System.Data.SqlClient with Microsoft.Data.SqlClient (and I was lazy and replaced the resource managed strings in Strings.cs with constants).
Then, with this copied class, the only nuget packages you need (which are .net standard) are Microsoft.Azure.KeyVault and Microsoft.IdentityModel.Clients.ActiveDirectory. From there, I was able to follow this guide https://docs.microsoft.com/en-us/azure/sql-database/sql-database-always-encrypted-azure-key-vault#register-the-azure-key-vault-provider without issue.

My test application had these package references:

<PackageReference Include="Microsoft.Azure.KeyVault" Version="2.3.2" />
<PackageReference Include="Microsoft.Data.SqlClient" Version="1.0.19221.1-Preview" />
<PackageReference Include="Microsoft.IdentityModel.Clients.ActiveDirectory" Version="5.2.0" />

Also tested and worked (on my machine! through windows and docker) with Microsoft.Azure.KeyVault 3.0.4.

I would post the source of the provider, but I'm not sure if posting modified decompiled source goes against the license.

[David-Engel]

Update: The team that owns the AKV provider is going to pass it to us (the SqlClient team) to work on. We will start working on it as soon as we can and hopefully have an updated version out in September/October.

[beufordy3k]

Update: The team that owns the AKV provider is going to pass it to us (the SqlClient team) to work on. We will start working on it as soon as we can and hopefully have an updated version out in September/October.

@David-Engel
Will this be available as a dev myget feed here? https://dotnet.myget.org/gallery/aspnetcore-dev

Does this have any milestones set yet? Thanks!

[Tim-Bijnens]

Any update or timeframe on this?

We have several new .Net Core projects running on Azure app service that have to use (time consuming and not ideally performing) work arounds to handle the encrypted data via the regular EF Azure KeyVault provider.

I tried @dferretti suggestion but could not get it to work in the limited time frame I was given.

Thank you!

[ErikEJ]

@Tim-Bijens Looks like it is planned for 1.1: https://github.com/dotnet/SqlClient/projects/4

[cperras]

@cheenamalhotra @David-Engel hi - any eta an when 1.1 might be released and/or a preview version of SqlColumnEncryptionAzureKeyVaultProvider will be available?

we have an open story on this, so we just want to plan next steps. thanks!

[cheenamalhotra]

@cperras very soon! Stay tuned :)

[cheenamalhotra]

@cperras @Tim-Bijnens @beufordy3k @naresh1990 @dferretti

We have released the first public preview version of Azure Key Vault Provider today, please download from here: v1.0.0-preview1

Please note that the AKV Provider is targeted for SqlClient v1.1 hence will work with v1.1.0-preview1 version of Microsoft.Data.SqlClient.

Please try it out and send us your feedback so we can enhance the library for a stable version.

[cheenamalhotra]

M.D.S AE Azure Key Vault Provider 1.0.0 GA version of library has been released today.
Closing issue.

[chris5287]

Great news! Has this been retargeted at MDS v1.0.1 or has v1.1.0 been released as well?

[cheenamalhotra]

@chris5287 it now targets M.D.S v1.0.19269.1

[chris5287]

Would this work with EF Core 3 straight out the box, or is there a change needed in their code base?

[cheenamalhotra]

I don't see EF Core 3.0 or 3.0.1 nuget is referencing driver version 1.0.19269.1 yet, but 3.1.0-preview2 seems to have updated to this version that can be used.

[ErikEJ]

You can always reference a newer version explicitly