Azure / Azure/azure-rest-api-specs
Azure IoT DPS should support disabling local authentication / Shared Access Key authentication
- Dominant language
- TypeSpec
- Stars
- 3.1k
- Forks
- 5.9k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 424
Description
### API Spec link
https://global.azure-devices-provisioning.net/[ID_Scope]/registrations/[registration_id]/register?api-version=2021-06-01
### API Spec version
2021-06-01
### Describe the bug
Azure IoT Hub supports disabling local authentication through the disableLocalAuth/local_authentication_enabled setting.
However, Azure IoT Device Provisioning Service (DPS) does not appear to expose an equivalent setting.
DPS automatically creates/maintains shared access policies and their associated keys, and there does not appear to be a way to disable SAS/shared-key authentication and require Microsoft Entra ID /managed identity authentication only.
This creates a problem for environments where the security requirement is to eliminate local authentication and long-lived shared access keys.
Request:
Please provide an equivalent of disableLocalAuth /localAuthenticationEnabled for Azure IoT DPS.
### Expected behavior
DPS automatically creates/maintains shared access policies and their associated keys, and there does not appear to be a way to disable SAS/shared-key authentication and require Microsoft Entra ID /managed identity authentication only.
### Actual behavior
DPS automatically creates/maintains shared access policies and their associated keys, and there does not appear to be a way to disable SAS/shared-key authentication and require Microsoft Entra ID /managed identity authentication only.
### Reproduction Steps
Delete the default shared access and wait a few seconds; it will reappear again.
### Environment
_No response_
Contributor guide
Research direction
Start with the linked Azure IoT DPS API specification and compare its settings with the described IoT Hub disableLocalAuth/localAuthenticationEnabled behavior. Confirm whether the 2021-06-01 DPS API exposes a corresponding property, then identify the specification changes and validation needed to support disabling SAS/shared-key authentication.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- authentication, cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100