Merge pull request microsoft#431 from microsoft/fix/managed-identity-upgrade

fix: replace DefaultAzureCredential with ManagedIdentityCredential

Author: Prajwal-Microsoft

App/backend-api/Microsoft.GS.DPS.Host/AppConfiguration/AppConfiguration.cs

@@ -1,6 +1,7 @@
 using Azure.Identity;
 using Microsoft.Extensions.Azure;
 using Microsoft.GS.DPSHost.AppConfiguration;
+using Microsoft.GS.DPSHost.Helpers;
 
 namespace Microsoft.GS.DPSHost.AppConfiguration
 {
@@ -16,7 +17,7 @@ public static void Config(IHostApplicationBuilder builder)
             //Read AppConfiguration with managed Identity
             builder.Configuration.AddAzureAppConfiguration(options =>
             {
-                options.Connect(new Uri(builder.Configuration["ConnectionStrings:AppConfig"]), new DefaultAzureCredential());
+                options.Connect(new Uri(builder.Configuration["ConnectionStrings:AppConfig"]), AzureCredentialHelper.GetAzureCredential());
             });
 
             //Read ServiceConfiguration

App/backend-api/Microsoft.GS.DPS.Host/Helpers/AzureCredentialHelper.cs

@@ -0,0 +1,34 @@
+using System;
+using System.Threading.Tasks;
+using Azure.Core;
+using Azure.Identity;
+
+namespace Microsoft.GS.DPSHost.Helpers
+{
+    /// <summary>
+    /// The Azure Credential Helper class
+    /// </summary>
+    public static class AzureCredentialHelper
+    {
+        /// <summary>
+        /// Get the Azure Credentials based on the environment type
+        /// </summary>
+        /// <param name="clientId">The client Id in case of User assigned Managed identity</param>
+        /// <returns>The Credential Object</returns>
+        public static TokenCredential GetAzureCredential(string? clientId = null)
+        {
+            var env = Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT") ?? "Production";
+
+            if (string.Equals(env, "Development", StringComparison.OrdinalIgnoreCase))
+            {
+                return new DefaultAzureCredential(); // CodeQL [SM05139] Okay use of DefaultAzureCredential as it is only used in development
+            }
+            else
+            {
+                return clientId != null
+                    ? new ManagedIdentityCredential(clientId)
+                    : new ManagedIdentityCredential();
+            }
+        }
+    }
+}