Add Support for Workload Identity Federation for Azure Service Connections

[ChristineWanjau]

Does @azure/identity for js support authentication for service connections using workload identity federated credential?

Tasks

Beta Give feedback

No tasks being tracked yet.

[joshfree]

Related https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/TROUBLESHOOTING.md#troubleshoot-workloadidentitycredential-authentication-issues

[ChristineWanjau]

@joshfree the doc only says it supports authentication for workloads running on Kubernetes what about authentication for service connections using workload identity federated credential in azure devops?

[KarishmaGhiya]

@joshfree I spoke to @ChristineWanjau Looks like App Configuration is using the preview feature Azure Devops for their authenication for service connection using workload identity. Essentially what happens is when they request an idToken, it gets supplied by Azure Devops (https://devblogs.microsoft.com/devops/public-preview-of-workload-identity-federation-for-azure-pipelines/#custom-azure-tasks-and-extensions). But this idToken is not written to a file, it's speculated to be supplied through the env. So the ask was that do we support the scenario.

[joshfree]

@KarishmaGhiya could you give an update on this item?

[cyclelabs-ryanberger]

Please provide an update on when this will be allowed. This is also impacting AzureFileCopy task: https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/azure-file-copy-v4?view=azure-pipelines

[KarishmaGhiya]

@ryanberger-az This work item is only tracking the support of WI on Azure Identity SDK for Azure Service Connections scenario.
For support for pipeline tasks, I think you should refer to this blog - https://devblogs.microsoft.com/devops/public-preview-of-workload-identity-federation-for-azure-pipelines/#built-in-pipeline-tasks
Unless the Azure File Copy task uses the Azure Identity SDK, I don't think you should be blocked on us.

[KarishmaGhiya]

Github Gist -https://gist.github.com/KarishmaGhiya/81ee6265ab6e9109d3bf510678878b34
We are waiting on the service team to complete the environment variable consolidation for OIDC token request from Azure Devops. https://dev.azure.com/mseng/AzureDevOps/_workitems/edit/2103036

[maorleger]

Linking to #28726 (comment)

@MRayermannMSFT assuming I understood the ask correctly, I believe this is the issue you want to follow along on - is that right?

[MRayermannMSFT]

@maorleger I think you are probably right?

[KarishmaGhiya]

PR to support this - #28628