search

Azure / azure-sdk-for-net

This repository is for active development of the Azure SDK for .NET. For consumers of the SDK we recommend visiting our public developer docs at https://learn.microsoft.com/dotnet/azure/ or our versioned developer docs at https://azure.github.io/azure-sdk-for-net.
MIT License
5.49k stars 4.81k forks source link

[Azure.Identity] Explicitly selecting the managed identity source #23044

Closed mataness closed 3 years ago

mataness commented 3 years ago

In Azure.Identity NuGet, the implementation of ManagedIdentityCredential implicitly selecting the ManagedIdentitySource (e.g. IMDS, ServiceFabric).

In my scenario, we have both IMDS and ServiceFabric managed identities available for the process. However, in some cases I want that my application will use ServiceFabricManagedIdentitySource and in some other cases I want to use the IMDS source.

Is it possible to add additional constructor to ManagedIdentityCredential that will force choosing the managed identity source?

jsquire commented 3 years ago

Thank you for your feedback. Tagging and routing to the team members best able to assist.

christothes commented 3 years ago

As a workaround, the IMDS endpoint host can now be configured via environment variable. https://github.com/Azure/azure-sdk-for-net/blob/72630d5bb04538967195c199632d8260133d25e5/sdk/identity/Azure.Identity/src/EnvironmentVariables.cs#L21

mataness commented 3 years ago

Not sure why it's closed, overriding the environment variable is not a clean design. Why not exposing this functionality as a constructor parameter?

christothes commented 3 years ago

Hi @mataness - We'll consider this a feature request and monitor the issue to see if there is more demand for this feature.

mataness commented 3 years ago

If I want to contribute and submit a PR to support this functionality, will you allow it ?

christothes commented 2 years ago

If I want to contribute and submit a PR to support this functionality, will you allow it ?

We're happy to accept contributions. How were you planning to implement this?

mataness commented 2 years ago

ManagedIdentityCredential

  1. Defining a new enum: ManagedIdentitySource with the following values: AppService, CloudShell, AzureArc, ServiceFabric, TokenExchange, InstanceMetadataService
  2. Add a new optional parameter to ManagedIdentityCredential constructor - that enum (e.g. ManagedIdentitySource? identitySource = null)
  3. The parameter value will be proagated from ManagedIdentityCredential to the underyling ManagedIdentityClient, when given, the SelectManagedIdentitySource will use that source explicitly, if it fails to use that source - it will thrown an exception.

What do you think? should I go ahead and implement this ?