I'm new to Azure and have a resource that is accessed by a web app in another Azure tenant. The web app currently authenticates with a service principal, which requires embedding the client ID, tenant ID, and client secret in its script. Storing the secret in a Key Vault doesn't seem to solve the problem because the app would still need credentials to access the vault. Would using a separate service principal for Key Vault access work, or is there a better secretless authentication approach?
2 Answers
Certificate-based authentication is another option. The app registration stores only the public certificate, while the consuming application keeps the private key in a protected certificate store or managed secret system. If the workload runs in Azure, a system-assigned managed identity can also be granted access to Key Vault, avoiding hardcoded credentials entirely.
Workload identity federation is usually the best option here. It lets the external application authenticate through a trusted token provider without storing a client secret, so there’s no secret to expose or rotate. The exact setup depends on the web app’s identity provider and deployment environment.
That sounds safer than putting another service principal secret in the application. I’ll look into whether the web app’s identity provider supports federation.