[FEATURE REQ] Add support for AZURE_CLIENT_ID environment variable to ManagedIdentityCredential

[jongio]

Library or service name.
Azure Identity

Is your feature request related to a problem? Please describe.
Developers need to be able to specify which AZURE_CLIENT_ID Managed Identity Credential with an environment variable.

#5696
#6769

[sophiajt]

Just to confirm the design here:

https://github.com/Azure/azure-sdk-for-js/blob/master/sdk/identity/identity/src/credentials/managedIdentityCredential.ts#L44-L50

This will allow the user to call the second constructor shape, and then inside the constructor we'll check for the environment variable. If it exists, we'll act as if they called the first constructor with it?

[jongio]

Please follow up with @schaabs before implementing.

[schaabs]

@jonathandturner I don't think this is the design we want. The user already has the ability to specify no clientId to the constructor, in which case we consider the credential to not be a user assigned identity, but rather a system assigned identity, and I think we need to maintain this behavior.

In .NET what we have done is to read the environment variable only when constructing this credential from the DefaultAzureCredential. It isolates the behavioral change of this environment variable to only the DefaultAzureCredential authentication flow.

[AdamMachera]

Can't you guys consider checking AZURE_CLIENT_MANAGED_ID if clientId was not passed to constructor. Some of customers want to use USER assigned identities and If internally ManagedIdentityClient cannot read clientId,
it is required to do something like this
let tokenCredential: identity.TokenCredential;
const clientId = process.env['AZURE_CLIENT_ID'];
if (WEBSITE_INSTANCE_ID) {
tokenCredential = new identity.ChainedTokenCredential(new identity.ManagedIdentityCredential(clientId), new identity.EnvironmentCredential());
} else {
tokenCredential = new identity.DefaultAzureCredential();
}

instead of:
const tokenCredential = new identity.DefaultAzureCredential();

[ramya-rao-a]

@jongio, @sadasant, @schaabs,

We had started reading the AZURE_CLIENT_ID env variable to pick up the clientId for ManagedIdentityCredential when one uses the DefaultAzureCredential almost a year ago. It was added in #7994

Is this issue about the need for ManagedIdentityCredential to do the same itself when used directly?

[sadasant]

The latest design approach is to have the Managed Identity Credential read in client-id from environment variable “AZURE_MANAGED_IDENTITY_CLIENT_ID”

Thanks to @g2vinay for the help 🤝

[sadasant]

Based on our emails, we’ve decided not to include this change. I’m closing this issue.