Azure / Azure/azure-functions-core-tools

Support development time TokenCredential

Open
#4,396 1 comment 3 reactions 0 assignees View on GitHub
core-tools design enhancement
Dominant language
C#
Stars
1.5k
Forks
498
Avg merge
4d 20h
Merged PRs (30d)
14

Description

### Description

To improve local development, core-tools should offer a way to support development time `TokenCredential`.

### Background

Today Azure Functions supports credential via configuration. The exact credentials supported is intentionally aligned with what Azure SDK supports via `AzureComponentFactory.CreateTokenCredential`. This works for scenarios but is limiting for local development. The only local dev route is to 'trick' it into giving you a `DefaultAzureCredential`, and then _hoping_ that resolves to the dev credential you want.

That later part is a challenge when you are developing on a machine with higher precedence credentials that you do not want to use (such as a valid managed identity endpoint).

### Plan

We will add support to core tools to inject a custom `ChainedTokenCredential` for the host which includes only common dev-time credentials in it (exact creds TBD, but current theory is everything from [DefaultAzureCredential](https://learn.microsoft.com/en-us/dotnet/api/azure.identity.defaultazurecredential?view=azure-dotnet) less managed identity credential).

Injecting of the credential will be done via setting a global default credential with the `.AddAzureClients()` call:

``` CSharp
services.AddAzureClients(b => b.UseCredential(/* dev time credential */));
```

### Design Needed

1. What is the opt-in mechanism for customers is here?

### Known Limitations

The mechanism this relies on is how [AzureComponentFactoryImpl](https://github.com/Azure/azure-sdk-for-net/blob/6d246a4976c6cd9982660f90d796a9fcac11ee97/sdk/extensions/Microsoft.Extensions.Azure/src/Internal/AzureComponentFactoryImpl.cs#L26) will fall back to `_globalOptions.CurrentValue.CredentialFactory(_serviceProvider);` when the `ClientFactory.CreateCredential` returns `null`. This poses two known limitations:

1. Whatever we do here will not take precedence over `ClientFactory.CreateCredential`, as it runs first. So if a customer has valid credential config for a trigger, that will preferred over the global dev credentials.
2. In the same theme, there will be no way to configure per-trigger dev credentials. There will only be one global dev credential
3. Not all extensions use `AzureComponentFactory`. These will not be in-scope for this work.

# Related Issues
https://github.com/Azure/azure-functions-dotnet-worker/issues/3027

Contributor guide

Open the contributing guide

Research direction

Start by reading the issue plan and related issue 3027, then inspect AzureComponentFactoryImpl and the AddAzureClients().UseCredential() entry point linked here. Resolve the opt-in mechanism and which development credentials are included, accounting for configured per-trigger credentials and extensions outside AzureComponentFactory. Done means core-tools can provide the agreed global development credential behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
cli, cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.