encryptionkeys Encryption keys in Azure Key Vault (instead of web.config)

[Goossens]

PasswordState encryption keys are currently split and stored in two places: the database and the web.config file.

 

To improve protection of the keys in certain scenarios, we would like to store the keys in an Azure Key Vault. It would be sufficient if only the keys stored in Web.config could be stored in the Key Vault instead.

 

It seems Configuration Builders can be used to achieve this, which requires changes to the application. Access to key vault would ideally be done using Managed Identity.

 

This could also allow the connection string to be stored in the Key Vault.

Thanks.