improvement: handle azure workload identity authentication #945
Conversation
|
hey @abestel Since you're using |
So far the Azure OpenAI integration was handling authentication using Client ID / Client Secret and Managed identity using the IMDS endpoint which is deprecated in favor of Workload Identity (using the public OAuth2 endpoint of Entra ID). This changeset aims at handling this new authentication type. Note that this requires reading environment variables set by the Azure runtime onto the virtual machine / pod using a workload identity. It also needs to read a file on disk (containing an assertion to use to exchange against a JWT).
abestel
force-pushed
the
improvement/azure-workload-identity
branch
from
a76ec2f to
87e2ff5
Compare
|
Hey @narengogi |
|
@abestel We'll test this today |
| const federatedToken = fs.readFileSync(federatedTokenFile, 'utf8'); | ||
|
|
||
| if (federatedToken) { | ||
| const scope = 'https://cognitiveservices.azure.com/.default'; |
There was a problem hiding this comment.
We can remove the scope from here and just handling inside the getAzureWorkloadIdentityToken.
| runtime === 'node' | ||
| ) { | ||
| const fs = await import('fs'); | ||
| const federatedToken = fs.readFileSync(federatedTokenFile, 'utf8'); |
There was a problem hiding this comment.
@VisargD Please share your opinion here, we can also accept the contents of AZURE_FEDERATED_TOKEN_FILE file from header and parse it here. With this we can also make sure this works with cloudflare env as well.
|
hey, @abestel Sorry for back and forth changes, everything looks good to me, just a minor change. Will merge after that. |
Title:
Description: (optional)
So far the Azure OpenAI integration was handling authentication using Client ID / Client Secret and Managed identity using the IMDS endpoint which is deprecated in favor of Workload Identity (using the public OAuth2 endpoint of Entra ID).
This changeset aims at handling this new authentication type.
Note that this requires reading environment variables set by the Azure runtime onto the virtual machine / pod using a workload identity. It also needs to read a file on disk (containing an assertion to use to exchange against a JWT).
Motivation: (optional)
Related Issues: (optional)
/