Combine multiple authentication options

[fgheysels]

I have an application (web api) that queries an ADX database.

This web api runs in Azure, and I use the managed identity of the Web App service where the api is hosted to get access to the ADX database. This is configured like this:

services.AddSingleton<ICslQueryProvider>(sp =>
{
    var settings = sp.GetService<IOptions<KustoSettings>>().Value;

    var kustoConnectionStringBuilder =
    new KustoConnectionStringBuilder(settings.AdxClusterUrl, settings.DatabaseName)
                                .WithAadSystemManagedIdentity();

    return KustoClientFactory.CreateCslQueryProvider(kustoConnectionStringBuilder);
});

However, when I run this api locally on my machine for debugging, this obviously doesn't work. Therefore, I thought about doing this:

services.AddSingleton<ICslQueryProvider>(sp =>
{
    var settings = sp.GetService<IOptions<KustoSettings>>().Value;

    var kustoConnectionStringBuilder =
    new KustoConnectionStringBuilder(settings.AdxClusterUrl, settings.DatabaseName)
                                .WithAadSystemManagedIdentity()
                               .WithAadAzCliAuthentication();

    return KustoClientFactory.CreateCslQueryProvider(kustoConnectionStringBuilder);
});

My idea behind this was that one of the 2 authentication methods could be used. When running on Azure, the System Managed Identity auth could be used, when running locally, I could use my Az CLI token.

However, this doesn't work. When I run this locally, I get this error:

'ManagedIdentityCredential authentication unavailable. No Managed Identity endpoint found.'

When I run this in Azure, it doesn't work either as it then complains that there is no Azure CLI credential found.

Is there a way to define that one of the 2 authentication methods should be used ?

[yogilad]

You can use a combination of KustoConnectionStringBuilder.WithAadAzureTokenCredentialsAuthentication(Azure.Core.TokenCredential tokenCredential) and Azure.Identity.DefaultAzureTokenCredentials to achive that.

https://learn.microsoft.com/en-us/dotnet/api/azure.identity.defaultazurecredential?view=azure-dotnet

[fgheysels]

For completeness sake, I've done it like this:

 var kustoConnectionStringBuilder =
                            new KustoConnectionStringBuilder(settings.AdxClusterUrl, settings.DatabaseName)
                               .WithAadAzureTokenCredentialsAuthentication(new DefaultAzureCredential(new DefaultAzureCredentialOptions()
                                {
                                    ExcludeEnvironmentCredential = true,
                                    ExcludeInteractiveBrowserCredential = true,
                                    ExcludeSharedTokenCacheCredential = true,
                                    ExcludeAzureCliCredential = false,
                                    ExcludeManagedIdentityCredential = false,
                                    ExcludeVisualStudioCredential = true
                                }));