Support Microsoft Foundry authentication with Entra ID - #84
Merged
Conversation
ai-config gains an `azure` connection section (authMode apikey|entra, scope, tenantId) carried by the built-in ms-foundry key only, with MS_FOUNDRY_DEFAULTS resolving an absent authMode to apikey and an absent scope to https://cognitiveservices.azure.com/.default, plus MS_FOUNDRY_AUTH_MODE / MS_FOUNDRY_ENTRA_SCOPE / MS_FOUNDRY_TENANT_ID env overlays. ai-credentials gains AzureEntraCredentials (azure-entra): baseUrl + required scope + optional tenantId/customHeaders, and no secret material. The bridge adds @azure/identity and a process-level cached getBearerTokenProvider(DefaultAzureCredential) keyed by scope+tenant, with token-acquisition failures normalized into an actionable az-login error. The Foundry provider accepts azure-entra credentials: static model discovery keys off baseUrl, and the client factory injects the bearer token per request around the shared OpenAI-compatible fetch so customHeaders and request/stream normalization still apply.
Surface a ResolvedConnectionFieldSource (user / enforced / environment / default) for each UI-managed ms-foundry field — azure.authMode, azure.scope, azure.tenantId, baseUrl — so configure forms can disable individually pinned controls without re-deriving source precedence from resolved values.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Microsoft Foundry connections currently require an API key, so organizations that disable key-based authentication cannot use their deployments. This change lets the built-in Microsoft Foundry provider use Microsoft Entra ID instead, acquiring and refreshing tokens through Azure CLI credentials, managed identity, workload identity, or an environment service principal. API-key authentication remains the default for existing configurations. If Azure credentials are unavailable, users receive an actionable message that directs them to run
az login; token providers remain separate for different tenants and scopes.Changes
Breaking changes
The Azure SDK dependencies require Node.js 22.12 or later. Consumers using an older Node.js release must upgrade before adopting this version.
Related to posit-dev/positron#15663