Support for OIDC Authentication

[ms-henglu]

Use OpenID Connect within your workflows to authenticate with Azure.

Blocked by Azure/azure-sdk-for-go#15615

doc: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-azure
similar issue: hashicorp/terraform-provider-azurerm#16554

[ms-henglu]

https://github.com/Azure/azure-sdk-for-go/tree/main/sdk/azidentity doesn't support OIDC yet.

Roadmap: Azure/azure-sdk-for-go#16728

[petr-stupka]

Helper already available via hashicorp/go-azure-helpers#115

Terraform 1.2.0 introduced support for backend authentication OIDC as well

[LaurentLesle]

@ms-henglu can you check if you can progress with this issue? Looks like the dependency has been closed Azure/azure-sdk-for-go#16728

[jamescrowley]

Just got blocked by this as we're using OIDC for GitHub Actions on a new project.

We're setting the ARM_USE_OIDC environment variable, as used by azurerm provider & backend to enable the feature, so if you end up needing a switch to turn this on, if you could utilise an environment variable like that (in addition to whatever properties you decide on the provider itself), that would be fab. Many thanks.

[ms-henglu]

@LaurentLesle - Thanks! I just checked again, it seems they're tracking this feature by Azure/azure-sdk-for-go#15615 according to Azure/azure-sdk-for-go#16728 (comment).

[ghost]

Any news on that feature ?

[dschniepp]

Does it make sense to provide a temporarily solution based on the upcoming release, with the workaround described here Azure/azure-sdk-for-go#15615 (comment)? @ms-henglu would you be interested in this as a contribution from the community?

[ms-henglu]

Hi @dschniepp ,

Thanks for the suggestion! I'll give it a try when the azidentity v1.2.0 stable version released in the next week.

[dschniepp]

Thanks, @ms-henglu if you need support feel free to loop me in.

[AdamCoulterOz]

@grayzu was this planned for 1.1? looks like it didn't make it?

[ms-henglu]

Hi all,

This feature has been released in v1.3.0. More details can be found here: https://registry.terraform.io/providers/Azure/azapi/latest/docs/guides/service_principal_oidc

I'll close this issue but feel free to reopen it if there's any further question.