fix: Replace DefaultAzureCredential with ManagedIdentityCredential for production-safe authentication #1873
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Purpose
This pull request introduces a significant refactor to replace the use of
DefaultAzureCredentialwith a new utility function,get_azure_credential, to dynamically select credentials based on the application environment. Additionally, it includes a minor fix in an environment variable name and adds a new environment variable to.env.sample.Credential Management Refactor:
DefaultAzureCredentialwithget_azure_credentialin multiple files, includingdatabase_factory.py,postgresdbservice.py,azure_blob_storage_client.py,azure_computer_vision_client.py,azure_form_recognizer_helper.py,azure_postgres_helper.py,azure_search_helper.py,env_helper.py,llm_helper.py, and several others. This change ensures that the appropriate credential is selected based on whether the environment isdevorprod. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28]Utility Function Addition:
get_azure_credentialandget_azure_credential_asyncfunctions inazure_credential_utils.py. These functions dynamically select betweenDefaultAzureCredentialandManagedIdentityCredentialbased on theAPP_ENVenvironment variable.Environment Configuration Updates:
APP_ENVvariable to.env.sampleto specify the application environment (devorprod). This variable is used to determine the credential type in the new utility functions.SEMANTIC_KERNEL_SYSTEM_PROMPTinenv_helper.py.These changes improve the flexibility and security of credential management while also addressing a minor issue in the environment configuration.
Does this introduce a breaking change?
How to Test
What to Check
Verify that the following are valid