Skip to content

Add support for OIDC client assertion authentication - #1013

Open
jmapro wants to merge 1 commit into
turbot:mainfrom
jmapro:feat/oidc-federated-identity
Open

Add support for OIDC client assertion authentication#1013
jmapro wants to merge 1 commit into
turbot:mainfrom
jmapro:feat/oidc-federated-identity

Conversation

@jmapro

@jmapro jmapro commented Aug 6, 2026

Copy link
Copy Markdown
Contributor
  • Introduced client_assertion and client_assertion_path config fields for OIDC federated identity
  • Updated authentication flow to support OIDC credentials in both GetNewSessionUpdated and GetNewSession
  • Added azcoreTokenAuthorizer bridge for using OIDC credentials with legacy SDK clients
  • Enhanced documentation and config examples for new authentication method

closes #1014

Integration test logs

Logs N/A

Example query results

Results

Test done with this obfuscated configuration

      connection "azure" {
        plugin      = "azure"
        type        = "aggregator"
        connections = ["azure_*"]
      }
      
      connection "azure_ c3e096e57a5f8d4f68d0bfd65fc01e66" {
        plugin                = "azure"
        tenant_id             = "8da3500a0f55b6071e7aeea62a6b6950"
        subscription_id       = " c3e096e57a5f8d4f68d0bfd65fc01e66"
        client_id             = "961c9a675b22ac0d408ccaeef8dc7132"
      }
      
      connection "azure_6f9524ded4e33c540b25df35a5da8a9a" {
        plugin                = "azure"
        tenant_id             = "8da3500a0f55b6071e7aeea62a6b6950"
        subscription_id       = "6f9524ded4e33c540b25df35a5da8a9a"
        client_id             = "961c9a675b22ac0d408ccaeef8dc7132"
        client_assertion_path = "/tmp/azure-oidc-token.txt"
      }
$ steampipe query "select md5(display_name) as display_name, md5(subscription_id) as subscription_id, md5(tenant_id) as tenant_id, cloud_environment from azure_subscription limit 5;"
+----------------------------------+----------------------------------+----------------------------------+-------------------+
| display_name                     | subscription_id                  | tenant_id                        | cloud_environment |
+----------------------------------+----------------------------------+----------------------------------+-------------------+
| b352f657e243096b4f3cd55663d9fafa | c3e096e57a5f8d4f68d0bfd65fc01e66 | 8da3500a0f55b6071e7aeea62a6b6950 | AzurePublicCloud  |
| 184bed812c3fac93865bffcb0b97ac57 | 6f9524ded4e33c540b25df35a5da8a9a | 8da3500a0f55b6071e7aeea62a6b6950 | AzurePublicCloud  |
+----------------------------------+----------------------------------+----------------------------------+-------------------+

- Introduced `client_assertion` and `client_assertion_path` config fields for OIDC federated identity

- Updated authentication flow to support OIDC credentials in both GetNewSessionUpdated and GetNewSession

- Added azcoreTokenAuthorizer bridge for using OIDC credentials with legacy SDK clients

- Enhanced documentation and config examples for new authentication method
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

add OIDC Federated identity authentication

1 participant