Here is a short „lessons learned“ blog post about a thing which: a) seems not have an updated blog post, stack overflow etc, b) wasted a day of my life and c) turned to be quite trivial once I figured out how to do it.
Basically, as Scott Hanselman blogged about a long time ago you might have users distributed around the globe in which case you would like them to use resources which are close to them and improve their perf. Or another use case is that auto-scale up/out capabilities of the single App Service are not enough and you would like to use multiple app services supporting your website.
Well if this sounds interesting, I have good news – like many other things with Azure this one turns out to be quite simple so let me show you how to set up SSL balancing with custom names using Azure Trafic manager.
Step 1 – create app services which will distribute the load
For the purpose of this blog post, I will create two app service: one in US and one in Europe data center with the idea that all of the users who are in US will be hitting the US app service and all the other users will use the EU app service.
There are many other use cases other than the typical geo distribution one like for example auto scale-out capabilities of a single app service are not sufficient, getting phased rollouts without using the slots, a/b tests, complying with the data sovereignty mandates etc…
Step 2 – create azure traffic manager endpoint
We need a single URL address which will then route traffic to the app services and one way to achieve that in Azure is by using the Azure Traffic Manager.
Hit that little plus, search for Traffic and – voila!
Two important things on this screen:
name – defines the unique public URL which will be called by service consumers and which will then go to individual app services
routing method – there are 4 different ways how the app service routing can be driven where the most commonly used is the performance one but just for the kicks, I am going to use in my post Geographic one.
Now open traffic manager endpoint and do yourself a favor, open configuration and enable https only traffic
Step 3 – map the app services to the traffic manager
We need to inform traffic manager where it can redirect the traffic – go to the Endpoints/Add
And there define what app service should be used by which geographical area.
As we said for this example US service will handle North America traffic and EU service the rest of the world.
This definition is specific to Geographic routing and it can be specified to smaller geographic areas – for example, you can have app service for the state of New York
Now quickly the other app service which should take all the traffic which is not from North America
Well on most of the blogs this will be sufficient but as I always take care of both of my blog subscribers I will explain here how to take the things explained so far and elevate them to something really usefull in real world 🙂
Step 4 – Define CNAME mapping for the traffic manager
While you can use the url with its trafficmanager.net domain for demos, it is totally lame to use it in production for your product so we are going to define a CNAME mapping which will allow us to access it through our domain.
Here is how that setting looks like with my DNS provider
So everyone hitting blog-api.papiri.rs will be hitting the papiri-tm.trafficmanager.net which will then route traffic to the app services.
Step 5 – magic (define custom names for all of the app services)
In this step, we are going open all of the app services which are mapped to traffic manager and set their custom names to the same one mapped through DNS in step #5
The fact this works is magical as there were no DNS mapping defined for the app service itself but the validation passes. This works due to the fact that traffic manager is not a real load balancer but more of another DNS entry so the DNS mappings defined for the manager are valid also for the app services mapped to it!
As I said already, you should NEVER store passwords in any file going to your Git repo – there is a circle in Dante’s hell just for people doing that 🙂
Up until recently you had a few options to store secrets where the most used one was to store them in Application settings of your Azure App Service (there is another circle for people still using cloud service/VMs in 2018) and then during the runtime app service will override the local dev settings with the appropriate environment ones. That is a bit better as now you don’t have to be afraid of anyone having access to your repo that just about anyone having access to the Azure Portal with services.
To make this even safer Microsoft created a secure storage called Azure Key Vault to which you move all the secrets from Application Settings and now only folks who have access to Azure Key Vault can see them.
The problem is now how to authenticate with Key Vault and the only solution up until a few months ago was to use Azure Key Vault from a web app using client secret which basically meant that you have to store your Key Vault password into the Application settings which kind of made the whole purpose of Key Vault questionable as anyone having access to App settings will get the password for Key Vault and 3 minutes later access to the secrets there.
Basically, the idea is here that you make an AAD account for your app service with secret credentials not shown anywhere on the portal and then you grant Azure Key Vault access rights to that account so without any secrets stored anywhere your app service will be authorized for Key Vault access.
How to create AAD account for your app service?
Easy peasy! Open your app service and scroll the settings until you find Manage service identity one click On and Save – that’s it. Here is how I did that on my app service called keyvault-demo
How to authorize managed service identity to access Key Vault?
Also easy (you have to love new MS/Azure stack – superb simple and strong stuff) – open or create Key Vault, click on Access Policies and then click on Add.
Here is how I did that on my key vault called nivatech-demo
On the Add access policy first select the template what the app service should have access too (I’ve given it in this blog post access to everything (keys, secrets and certs) , then click Select principal list item and in the search box on the right side enter the name of app service MSI you want to authorize (in this blog post keyvault-demo) and then click Select.
Don’t forget to click Save on the next screen 🙂
Et voila! Your app service can now access key vault and read keys/secrets/certs.
Can I see the sample of the code reading the value from Key Vault using this MSI thingy?
Oh, sure – it is quite simple.
Let say we want to store in our key vault a secret which will be used for JWT authorization in a key called jwt-secret-key and with value Y31n55o835dv2CpSAKsErqVUqkNb42P0.
In Key Vault find Secrets and click Generate/Import button.
And then fill the fields with the key name and value
(The story about the need of rotating keys will have to wait for some other time so we will not set any expiration date here)
How can I retrieve the value from Key Vault in my service?
The best way is to add KeyVault as a configuration provider and then the value will come out of the simple usage of IConfiguration as all the other config values.
The way how I do this in Papiri application is by modifying Program.cs file to be something like this
public class Program
public static void Main(string args)
var builder = WebHost.CreateDefaultBuilder(args);
//Add CacheKey Vault to configuration pipeline
builder.ConfigureAppConfiguration((context, configBuilder) =>
// vault host address - you can get the value from app settings
var vaultHost = "https://nivatech-demo.vault.azure.net/";
//Create Managed Service Identity token provider
var tokenProvider = new AzureServiceTokenProvider();
//Create the CacheKey Vault client
var kvClient = new KeyVaultClient((authority, resource, scope) =>
tokenProvider.KeyVaultTokenCallback(authority, resource, scope));
//Add CacheKey Vault to configuration pipeline
configBuilder.AddAzureKeyVault(vaultHost, kvClient, new DefaultKeyVaultSecretManager());
and that’s pretty much it – anywhere in your code you can do now
var keyFromVault = this.configuration.GetValue<string>("jwt-secret-key");
Wow, this is super cool but how can I run this code on my dev box?
I don’t use KeyVault locally (I prefer user secrets) but if you want to use it it is easy and all it is need is a few steps:
Go to Key Vault / Access Policies / Add New and add yourself. My subscription is tied to my Microsoft Account (MSA) and I use the same to login to my dev box but this works the same if you are using AAD accounts.