Add Azure Authentication for Azure Services #18466

MikeAlhayek · 2025-10-14T18:13:49Z

No description provided.

Piedone · 2025-10-14T19:22:24Z

Related: #16336.

src/docs/reference/modules/Azure/README.md

src/docs/reference/modules/Redis.Azure/README.md

sebastienros · 2025-10-17T17:42:48Z

src/OrchardCore.Modules/OrchardCore.Email.Azure/Services/AzureEmailOptionsConfiguration.cs

            var protector = _dataProtectionProvider.CreateProtector(ProtectorName);

-            options.ConnectionString = protector.Unprotect(settings.ConnectionString);
+            var rawConnectionString = protector.Unprotect(settings.ConnectionString);


Is there a tool/ui to generate the protected value?

sebastienros · 2025-10-17T17:43:38Z

src/OrchardCore/OrchardCore.Azure.Core/ConnectionStringHelper.cs

@@ -0,0 +1,22 @@
+namespace OrchardCore.Azure.Core;
+
+public static class ConnectionStringHelper


Use the standard DBConnectionStringBuilder instead.

sebastienros · 2025-10-17T17:46:04Z

src/OrchardCore.Modules/OrchardCore.Email.Azure/Services/AzureEmailProviderBase.cs

+                }
+                else if (_providerOptions.Endpoint is not null)
+                {
+                    var azureOptions = _optionsMonitor.Get(_providerOptions.CredentialName ?? AzureOptions.DefaultName);


IMO the azure module should provide a helper to get a TokenCredential or a Token from a name, or no name. The fallback and all logic should not be exposed and have to be repeated in all modules.

sebastienros · 2025-10-17T17:47:39Z

src/OrchardCore.Modules/OrchardCore.Redis.Azure/AzureRedisTokenProvider.cs

+    {
+        var redisOptions = _options.Get(_redisOptions.CredentialName ?? AzureOptions.DefaultName);
+
+        var scope = redisOptions.GetProperty<string>("Scope");


This should be in the Azure module, and be configured in the credentials.

I am not follow you here

sebastienros · 2025-10-17T17:49:30Z

src/OrchardCore.Modules/OrchardCore.Redis.Azure/AzureRedisTokenProvider.cs

+
+        var requestContext = new TokenRequestContext([scope]);
+
+        var result = await credential.GetTokenAsync(requestContext, CancellationToken.None);


cf previous comment, this should be in the OC.Azure module.

sebastienros · 2025-10-17T17:57:43Z

src/OrchardCore/OrchardCore.Abstractions/ITokenProvider.cs

@@ -0,0 +1,6 @@
+namespace OrchardCore;
+
+public interface ITokenProvider


I don't recall how it's different than a TokenCredential.

sebastienros · 2025-10-17T17:59:05Z

src/OrchardCore/OrchardCore.Azure.Core/AzureOptions.cs

+                    ClientId = ClientId,
+                }),
+            AzureAuthenticationType.WorkloadIdentity => new WorkloadIdentityCredential(),
+            _ => null, // ApiKey and unsupported types


It should probably have a name too, and just throw if there is no name or an unknown one.

Even if a custom class needs to be created.

sebastienros · 2025-10-17T18:01:24Z

src/docs/reference/modules/Azure/README.md

+          "DeploymentName": "<your-deployment-name>"
+        },
+        "Redis": {
+          "Alias": "my-default" // References another credentials entry (here, "my-default")


Not a fan of alias.

Yeah it can be removed now that we have credentialName in the settings of each service

sebastienros · 2025-10-17T18:01:50Z

src/docs/reference/modules/Azure/README.md

+
+!!! note 
+    The credential named `Default` is a special case:
+     - It is automatically used whenever a service does not explicitly specify a credential name.


Not what I explained, but you might have decided that on purpose.

sebastienros · 2025-10-17T18:05:02Z

src/docs/reference/modules/Redis.Azure/README.md

+* **Azure CLI (`AzureCli`)**
+* **Default credentials (`Default`)**
+
+> **Important:** For this module to work, the credential entry **must be named `Redis`** in your Azure credentials configuration.


Shouldn't have to be. What's the reason? Why can't the options of the module define the name it needs to use?

"MyRedisInStagin"

MikeAlhayek · 2025-10-18T19:43:44Z

@sebastienros I’d like to take this approach a step further by creating a dedicated Security module. This module would handle provider-specific credential management, with a UI similar to what I implemented in the Indexing module.

It would include a unified interface where users can manage their own credentials directly, while app owner can define provider-based credentials at the settings level (e.g., appsettings.json or environment variables)

I believe this approach will be more scalable and efficient. Initially, I’ll focus on Azure provider-based credentials, but the design will allow adding more providers over time.

In the future, we can extend this to include a Connection Strings UI that securely manages connection strings — potentially referencing credentials stored in the same module. For example, SMS or Email providers could use credentials or connection strings managed by the Security module.

This concept is similar to what I built in the AI Suite module, where I centralized connection string management for all providers, so much of that code can be reused here for the UI and data management.

Let me know what you think of this direction. I may leave the current PR as-is and start a new branch to keep the original intent intact and use it as a reference.

sebastienros · 2025-10-21T19:53:53Z

src/docs/reference/modules/Redis.Azure/README.md

+      }
+    }
+  }
+}


"OrchardCore_Redis": { "Credentials": "MyRedisInStaging" }

or

"OrchardCore_Redis": { "Credentials": "CommonAzureCredsInStaging" }

github-actions · 2025-10-24T08:47:32Z

This pull request has merge conflicts. Please resolve those before requesting a review.

MikeAlhayek added 2 commits October 14, 2025 11:13

Add Azure Authentication for Redis

2b26b50

Merge branch 'main' into add-redis-azure

098453a

MikeAlhayek marked this pull request as draft October 14, 2025 18:14

MikeAlhayek added the needs triage label Oct 14, 2025

MikeAlhayek added 7 commits October 14, 2025 16:58

Add OrchardCore.Azure

917e0ad

merge main

0585d82

add new features and docs for the use case

ec4fbd0

cleanup

ba389dc

fix build

2e07d6b

fix docs

a9b9215

update name

83fc68d

sebastienros reviewed Oct 16, 2025

View reviewed changes

src/docs/reference/modules/Azure/README.md Outdated Show resolved Hide resolved

src/docs/reference/modules/Redis.Azure/README.md Show resolved Hide resolved

MikeAlhayek added 2 commits October 16, 2025 13:13

cleanup

179f767

Add Azure Authentication for Storage Account

66a863f

MikeAlhayek changed the title ~~Add Azure Authentication for Redis~~ Add Azure Authentication for Azure Services Oct 17, 2025

MikeAlhayek added 4 commits October 17, 2025 09:52

Add Azure Authentication suipport for Azure Email

a05c811

Add support for Azure ommunication service SMS

51c804b

cleanup docs

127f872

Merge branch 'main' into add-redis-azure

a0d8b4e

sebastienros reviewed Oct 17, 2025

View reviewed changes

MikeAlhayek added 2 commits October 20, 2025 12:18

Merge branch 'main' into add-redis-azure

836ca00

cleanup

f00d54e

sebastienros reviewed Oct 21, 2025

View reviewed changes

github-actions bot added the merge conflict label Oct 24, 2025

		@@ -0,0 +1,22 @@
		namespace OrchardCore.Azure.Core;

		public static class ConnectionStringHelper


		var requestContext = new TokenRequestContext([scope]);

		var result = await credential.GetTokenAsync(requestContext, CancellationToken.None);

		@@ -0,0 +1,6 @@
		namespace OrchardCore;

		public interface ITokenProvider

Add Azure Authentication for Azure Services #18466

Are you sure you want to change the base?

Add Azure Authentication for Azure Services #18466

Conversation

MikeAlhayek commented Oct 14, 2025

Uh oh!

Piedone commented Oct 14, 2025

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MikeAlhayek commented Oct 18, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Oct 24, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants