OIDC with Azure

See the general OIDC documentation before diving into the Azure specific setup.

Azure specific setup

Creating a vault (if necessary)

It's typical when working with OIDC to have at least one locked vault which holds any relevant secrets and OIDC tokens necessary to authenticate.

If you have multiple identities you need to authenticate with, for example if you have separate development and production credentials, you may consider having one vault for each with different permissions.

Creating your service principal or managed identity

Before you begin, ensure you've created either a service principal or a user-assigned managed identity and have assigned a role to it.

Once you've created this, create a secret in your vault for each of the AZURE_CLIENT_ID, AZURE_SUBSCRIPTION_ID, and AZURE_TENANT_ID associated with it.

Configuring your OIDC token in RWX

Now, you can configure the OIDC token in the RWX Vault UI, it's customary to name the token azure.

After setting the name and audience in the UI, you'll see copyable audience and subject values that you can copy into Azure. See documentation below for specific instructions for each service provider.

You can then reference the token in RWX run definitions like this:

${{ vaults.your-vault.oidc.azure }}

For the audience, you can choose either Azure's default audience of api://AzureADTokenExchange or set a custom one.

Configuring a federated identity credential in Azure

Copy the subject shown for the token in the RWX Vault UI.

In Azure, create a federated identity credential for your service principal or for your user-assigned managed identity.

Eventually, you'll reach a screen asking for the following information:

  • Issuer URL: https://cloud.rwx.com/mint
  • Subject identifier: the value you copied from the RWX Vault UI earlier
  • Name: a name of your choice to identify the credential
  • Audience: By default, this is api://AzureADTokenExchange. If you chose a different value when configuring your token, enter it here.

Authenticating with OIDC in an RWX run

The azure/install-cli and azure/auth-oidc packages install the CLI and add authentication hooks to the tasks that use them.

tasks:
  - key: azure-cli
    call: azure/install-cli 1.1.0

  - key: azure-auth
    call: azure/auth-oidc 2.1.0
    with:
      client-id: ${{ vaults.your-vault.secrets.AZURE_CLIENT_ID }}
      subscription-id: ${{ vaults.your-vault.secrets.AZURE_SUBSCRIPTION_ID }}
      tenant-id: ${{ vaults.your-vault.secrets.AZURE_TENANT_ID }}

  - key: use-azure-cli
    use: [azure-cli, azure-auth]
    run: az account show
    env:
      AZURE_OIDC_TOKEN_PATH: ${{ vaults.your-vault.oidc.azure.path }}

The package accepts either a token file path in AZURE_OIDC_TOKEN_PATH or the token contents in AZURE_OIDC_TOKEN, but not both. With AZURE_OIDC_TOKEN_PATH, the hook reads the current token before each task calls az login. The Azure CLI does not reread it during the task, so every task that authenticates must use the authentication hook and provide one of these environment variables.

If the identity is only used for tenant-level resources, omit subscription-id and set allow-no-subscription: true on the azure-auth task.