// Extension method that configures KeyVault config provider using App registration with 509 Cert
        public static void ConfigureKeyvaultAppRegistration(this IConfigurationBuilder config, string keyvaulturl, string secret, string aadappid)
        {
            if (string.IsNullOrEmpty(keyvaulturl) || string.IsNullOrEmpty(aadappid))
            {
                throw new ArgumentException("missing keyvault URI or aadappid");
            }

            config.AddAKVwithAppRegistrationSecretAuth(keyvaulturl, secret, aadappid);

            //TODO: if this worked we'd use it but there is a dependency failure
            //config.AddAzureKeyVault(
            //    //TODO store kv name in config
            //    //$"https://{builtConfig["KeyVaultName"]}.vault.azure.net/",
            //    keyvaultbase,
            //    appclientid,
            //    GetCertbyIssuer(certissuer)
            //    );
            //});
        }