Add generic OIDC authentication

[derkoe]

Adds a way to provide the OIDC token directly to the provider.

This enables to use the provider without tokens/passwords in GitLab CI
See: https://docs.gitlab.com/ee/ci/cloud_services/

Closes #16901

[manicminer]

Many thanks for this contribution @derkoe! This is mostly looking good, I just have a few suggestions mainly around the documentation. I'm going to go ahead and update this, hope you don't mind, and we'll be able to get this in for the release this week. Thanks again!

[derkoe]

@manicminer yes please go ahead and update!

and we'll be able to get this in for the release this week.

Wow that would be really fast!

[github-actions]

This functionality has been released in v3.20.0 of the Terraform Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[karlschriek]

Does this also support Azure Workload Identities?

[karlschriek]

Nevermind me, yes it does!

As follows (if running terraform within a Pod using a ServiceAccount that has been set up as an Azure Workload Identity)

export ARM_CLIENT_ID=$AZURE_CLIENT_ID
export ARM_SUBSCRIPTION_ID=xxx-xxx-xxx-xxx-xxx #this isn't populated by the AWI webhook
export ARM_TENANT_ID=$AZURE_TENANT_ID
export ARM_OIDC_TOKEN=$(cat $AZURE_FEDERATED_TOKEN_FILE)

In conjunction with:

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "3.20.0"
    }
  }
}

and

provider "azurerm" {
  use_oidc = true
  features {}
}

[karlschriek]

...but it isn't supported by the AzureRM backend yet unfortunately. I have opened an issue on that on the hashicorp/terraform issue board: hashicorp/terraform#31802

Would someone familiar with both projects be able to easily port this over to the AzureRM Backend?

[manicminer]

Thanks @karlschriek, since the backend is tied to the Terraform Core release cycle, this will be done for the v1.4.0 release as v1.3.0 is currently at pre-release.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.