Azure Service Fabric and Azure Key Vault Secret Error - azure-service-fabric

Question

I am getting the following when trying to implement Azure Key Vault Secret from a stateless service fabric works just fine from a console app.
System.TypeLoadException
HResult=0x80131522
Message=Inheritance security rules violated by type: 'System.Net.Http.WebRequestHandler'. Derived types must either match the security accessibility of the base type or be less accessible.
Source=Microsoft.Rest.ClientRuntime
StackTrace:
at Microsoft.Rest.ServiceClient`1.CreateRootHandler
public async Task<string> GetAccessToken(string authority, string resource, string scope)
{
var clientId = MyConfig.Settings.Sections["MyConfigSection"].Parameters["AuthClientId"].Value;
var clientSecret = MyConfig.Settings.Sections["MyConfigSection"].Parameters["AuthClientSecret"].Value;
ClientCredential clientCredential = new ClientCredential(clientId, clientSecret);
var context = new AuthenticationContext(authority, TokenCache.DefaultShared);
var result = await context.AcquireTokenAsync(resource, clientCredential);
return result.AccessToken;
}
public string GetCRMConnectionString()
{
var secretvaultAddress = MyConfig.Settings.Sections["MyConfigSection"].Parameters["SecretVaultUrl"].Value;
var client = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(GetAccessToken));
return client.GetSecretAsync(secretvaultAddress).GetAwaiter().GetResult().Value;
}

Answer 1

WebRequestHandler type(whose instance gets created in your case) is a part of System.Net.Http.WebRequest.dll. If you explore assembly's attributes, you'll find the next one applied to it -
[assembly: AllowPartiallyTrustedCallers]
This attribute makes the assembly being considered as SecurityTransparent. WebRequestHandler is derived from HttpClientHandler defined in another assembly - System.Net.Http.dll. So probably on the environment where you have the code deployed, System.Net.Http.dll is missing AllowPartiallyTrustedCallers which makes it security-critical, meaning that rules get violated - transparent code can not call into security-critical one.
Try to resolve it by either creating a binding rule to a specific System.Net.Http.dll version that has AllowPartiallyTrustedCallers attribute or try to create HttpClient explicitly and pass it then into KeyVaultClient ctr.
Refer to this link for more details and options - Inheritance security rules violated by type: 'System.Net.Http.WebRequestHandler'.