[FEATURE REQ] clientCertificateCredential to support x5c for Azure AD

[gaoyp830]

Library name

Microsoft.Extensions.Azure

Please describe the feature.

In order for Azure function service bus trigger to support connection using Azure AD, the code snippet here (which is used to generate token to be used in the creation of service bus client) needs to set SendX5C to be true in the options. (https://learn.microsoft.com/en-us/dotnet/api/microsoft.identity.web.microsoftidentityoptions.sendx5c?view=msal-model-dotnet-latest)

[github-actions]

Thank you for your feedback. Tagging and routing to the team member best able to assist.

[jsquire]

Hi @gaoyp830. Thank you for reaching out and we regret that you are experiencing difficulties. For your scenario, you'll need to override the default options by calling UseCredential as part of your DI registration. This allows you to control credential creation and set the options desired for your specific needs.

In this case, I believe you'll want to look at setting ClientCertificateCredentialOptions.SendCertificateChain and using that with a new instance of ClientCertificateCredential. For example:

services.AddAzureClients(clientBuilder =>
{
    var options = new ClientCertificateCredentialOptions { SendCertificateChain = true };
    var credential = new ClientCertificateCredential(options);
            
    // This will set the credential used by all Azure clients.
    clientBuilder.UseCredential(credential);
});

More context and discussion can be found in:

• Dependency injection with the Azure SDK for .NET
• Azure.Identity Credentials overview

[github-actions]

Hi @gaoyp830. Thank you for opening this issue and giving us the opportunity to assist. We believe that this has been addressed. If you feel that further discussion is needed, please add a comment with the text "/unresolve" to remove the "issue-addressed" label and continue the conversation.

[gaoyp830]

Hi @jsquire, thanks for the information! from Dependency injection with the Azure SDK for .NET, I see that in the example the client is passed in after registration using dependency injection:

public MyApiController(BlobServiceClient blobServiceClient) { _blobServiceClient = blobServiceClient; }
...however this example is the client code. I wonder in the case of using service bus trigger, registering the service bus client like you have mentioned above will also result in service bus trigger using the same client?

Thanks again for any help!

[jsquire]

The trigger uses the registered DI credential implicitly for the clients that perform its operations. There's no difference for what you'd need to do.

[github-actions]

Hi @gaoyp830. Thank you for opening this issue and giving us the opportunity to assist. We believe that this has been addressed. If you feel that further discussion is needed, please add a comment with the text "/unresolve" to remove the "issue-addressed" label and continue the conversation.

[github-actions]

Hi @gaoyp830, since you haven’t asked that we /unresolve the issue, we’ll close this out. If you believe further discussion is needed, please add a comment /unresolve to reopen the issue.