Merge pull request #83 from HynekBlaha/workload-identity

Add Workload Identity Credentials
duckdb · Oct 1, 2024 · 68b9232 · 68b9232
2 parents b0ffe7a + f08f876
commit 68b9232
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/src/azure_extension.cpp b/src/azure_extension.cpp
@@ -27,7 +27,7 @@ static void LoadInternal(DatabaseInstance &instance) {
 	    LogicalType::VARCHAR);
 	config.AddExtensionOption("azure_credential_chain",
 	                          "Ordered list of Azure credential providers, in string format separated by ';'. E.g. "
-	                          "'cli;managed_identity;env'",
+	                          "'cli;workload_identity;managed_identity;env'",
 	                          LogicalType::VARCHAR, nullptr);
 	config.AddExtensionOption("azure_endpoint",
 	                          "Override the azure endpoint for when the Azure credential providers are used.",

diff --git a/src/azure_storage_account_client.cpp b/src/azure_storage_account_client.cpp
@@ -22,6 +22,7 @@
 #include <azure/identity/default_azure_credential.hpp>
 #include <azure/identity/environment_credential.hpp>
 #include <azure/identity/managed_identity_credential.hpp>
+#include <azure/identity/workload_identity_credential.hpp>
 #include <azure/storage/blobs/blob_options.hpp>
 #include <azure/storage/blobs/blob_service_client.hpp>
 
@@ -138,6 +139,8 @@ CreateChainedTokenCredential(const std::string &chain,
 	for (const auto &item : chain_list) {
 		if (item == "cli") {
 			sources.push_back(std::make_shared<Azure::Identity::AzureCliCredential>(credential_options));
+		} else if (item == "workload_identity") {
+			sources.push_back(std::make_shared<Azure::Identity::WorkloadIdentityCredential>(credential_options));
 		} else if (item == "managed_identity") {
 			sources.push_back(std::make_shared<Azure::Identity::ManagedIdentityCredential>(credential_options));
 		} else if (item == "env") {