Add default auth model provider #1996

hubert123490 · 2025-12-04T15:12:32Z

My solution for default azure auth model provider. Please note that Azure advises to use different authentication method for production https://learn.microsoft.com/en-us/dotnet/api/azure.identity.defaultazurecredential?view=azure-dotnet.

Simplifies authentication while developing apps that deploy to Azure by combining credentials used in Azure hosting environments with credentials used in local development. In production, it's better to use something else. See Usage guidance for DefaultAzureCredential.

However it should be sufficient for development purposes and further collaboration.

Fixes: Support default authentication via Managed Identity / Workload Identity for Azure OpenAI #1995

geoand · 2025-12-04T15:13:51Z

cc @sberyozkin

sberyozkin · 2025-12-04T23:38:41Z

model-providers/openai/openai-common/runtime/pom.xml

            <artifactId>quarkus-langchain4j-core</artifactId>
            <version>${project.version}</version>
        </dependency>
+        <dependency>


Thanks @hubert123490

I'm not sure this dependency belongs at the OpenAI common level... It should be at the Azure OpenAI level and the filter should be shipped there. Somehow it needs to replace the one checked at the OpenAI common level, may be by extending the QuarkusOpenAIClient, or being an Alternative CDI bean, it is a bit tricky but should be doable, thanks

hubert123490 · 2025-12-05T15:25:56Z

@sberyozkin fair point
Im not quite happy abbout configMap, but it seems to work fine overall. There are some issues tho, like quite long token initialization time for the first request. Also it would be great for developer to be able to specify, which credential to use. Currently it gets first available from top to bottom (I think).

sberyozkin · 2025-12-05T15:31:19Z

...ntime/src/main/java/io/quarkiverse/langchain4j/azure/openai/runtime/AzureOpenAiRecorder.java

    }

-    private void throwIfApiKeysNotConfigured(String apiKey, String adToken, boolean authProviderAvailable, String configName) {
-        if ((apiKey != null) == (adToken != null) && !authProviderAvailable) {


Why does this check have to be removed ?

sberyozkin · 2025-12-05T15:34:33Z

...c/main/java/io/quarkiverse/langchain4j/openai/common/DefaultOpenAiRestApiFilterResolver.java

+import io.quarkiverse.langchain4j.auth.ModelAuthProvider;
+import io.quarkus.rest.client.reactive.QuarkusRestClientBuilder;
+
+public class DefaultOpenAiRestApiFilterResolver implements RestApiFilterResolver {


I'm just wondering, AFAIK, so far this filter can only be used with Azure OpenAI, I believe for direct OpenAI calls, OpenAI API Key is not passed as a bearer token, @geoand, is it correct ?

Perhaps we can just move this filter out of OpenAI common ?

Sorry, I'm not following. With vanilla OpenAI, the authentication is a bearer token

Sure, so this filter has to stay

sberyozkin · 2025-12-07T12:52:00Z

...untime/src/main/java/io/quarkiverse/langchain4j/azure/openai/AzureRestApiFilterResolver.java

+import io.quarkiverse.langchain4j.openai.common.RestApiFilterResolver;
+import io.quarkus.rest.client.reactive.QuarkusRestClientBuilder;
+
+public class AzureRestApiFilterResolver implements RestApiFilterResolver {


I believe it has to become a synthetic CDI bean - you can see an example of how such beans are created in AzureOpenAI recorder - and you'd have the config properties available to the function that creates it

sberyozkin · 2025-12-07T12:52:46Z

...mmon/runtime/src/main/java/io/quarkiverse/langchain4j/openai/common/QuarkusOpenAiClient.java

-                            .resolve(builder.configName)
-                            .ifPresent(modelAuthProvider -> restApiBuilder
-                                    .register(new OpenAiRestApi.OpenAIRestAPIFilter(modelAuthProvider)));
+                    Map<String, String> configMap = new HashMap<>();


I think the original code should stay

sberyozkin · 2025-12-07T12:54:15Z

...time/src/main/java/io/quarkiverse/langchain4j/azure/openai/AzureModelAuthProviderFilter.java

+import io.quarkus.arc.InstanceHandle;
+import io.smallrye.mutiny.infrastructure.Infrastructure;
+
+public class AzureModelAuthProviderFilter implements ResteasyReactiveClientRequestFilter {


It should probably extend the Open AI common one

sberyozkin · 2025-12-07T12:56:07Z

...time/src/main/java/io/quarkiverse/langchain4j/azure/openai/AzureModelAuthProviderFilter.java

+    private final ModelAuthProvider authorizer;
+
+    public AzureModelAuthProviderFilter() {
+        this.authorizer = new ApplicationDefaultAuthProvider();


We should make sure it is loaded only when no other custom model auth providers are available, for example, I linked earlier to the demo where an access token acquired after an Entra ID authorization code flow completion is propagated

sberyozkin · 2025-12-07T13:02:12Z

...time/src/main/java/io/quarkiverse/langchain4j/azure/openai/AzureModelAuthProviderFilter.java

+            MultivaluedMap<String, Object> headers) implements ModelAuthProvider.Input {
+    }
+
+    private static class ApplicationDefaultAuthProvider implements ModelAuthProvider {


I wonder if we really need the filter resolver at all, and instead, only have this default model auth provider registered as a synthetic CDI bean in the if neither api or ad tokens or custom mode providers are available (this is the check that this PR removes but it should not)

sberyozkin · 2025-12-07T13:07:45Z

Thanks @hubert123490 for working on this PR, I agree it is quite hard to make it work, IMHO this PR should probably be rewritten, please investigate how you can register the default Azure Open AI model auth provider as the synthetic CDI bean.

Effectively, the PR should only have the code for the default provider, and updates in the AzureOpenAI recorder and build step processor - the recorder is called by the processor to optionally register this default provider as a cdi bean if neither api key or id token or other model auth provider is registered.

hubert123490 · 2025-12-07T15:27:34Z

Thanks @sberyozkin for the great insight! I’ll give it a try.

sberyozkin · 2025-12-08T16:52:45Z

@hubert123490 Np at all, hopefully it will be possible to do something along those lines. You can probably copy and paste one of the functions there in the AzureOpenAI recorder, alongside a matching build step and register your default application model auth provider in a similar fashion.

The only problem that may have to be solved is ensure this registration is done, before the check that this PR attempts to remove is run, i.e, the build step that registers the default model auth provider must run earlier, typically this is achieved by the step that must run earlier producing a custom build item for the next build step to expect it as one of the input parameters, @geoand can also advise. So it should be doable

hubert123490 · 2025-12-11T18:28:04Z

I've tried to add synthetic bean for model auth provider

 @BuildStep
    @Record(ExecutionTime.RUNTIME_INIT)
    public void registerDefaultModelAuthProvider(AzureOpenAiRecorder recorder,
            BuildProducer<SyntheticBeanBuildItem> producer) {
        producer.produce(
                SyntheticBeanBuildItem
                        .configure(ModelAuthProvider.class)
                        .scope(ApplicationScoped.class)
                        .setRuntimeInit()
                        .createWith(recorder.modelAuthProvider())
                        .done());
    }

I added in azure recorder

 public Function<SyntheticCreationalContext<ModelAuthProvider>, ModelAuthProvider> modelAuthProvider() {
        if (runtimeConfig.getValue().defaultConfig().apiKey().isPresent()
                || runtimeConfig.getValue().defaultConfig().adToken().isPresent()) {
            return new Function<>() {
                @Override
                public ModelAuthProvider apply(
                        SyntheticCreationalContext<ModelAuthProvider> modelAuthProviderSyntheticCreationalContext) {
                    return null;
                }
            };
        } else {
            return new Function<>() {
                @Override
                public ModelAuthProvider apply(
                        SyntheticCreationalContext<ModelAuthProvider> modelAuthProviderSyntheticCreationalContext) {
                    return new AzureOpenAiRecorder.ApplicationDefaultAuthProvider();
                }
            };
        }
    }

but that resulted in
Error
"Null contextual instance was produced by a normal scoped synthetic bean: SYNTHETIC bean [class=io.quarkiverse.langchain4j.auth.ModelAuthProvider, id=FIym7E17BGsirk4ooWp8Cr-hKM0]"
when api key or ad token is provided
and no matter what I did, I couldn't create this bean conditionally.

However I was successful with BuildConfig approach, such as I added

quarkus.langchain4j.azure-openai.azure-default-credentials-enabled=true

@ConfigRoot(phase = BUILD_TIME)
@ConfigMapping(prefix = "quarkus.langchain4j.azure-openai")
public interface LangChain4jAzureOpenAiBuildConfig {

    /**
     * Chat model related settings
     */
    ChatModelBuildConfig chatModel();

    /**
     * Embedding model related settings
     */
    EmbeddingModelBuildConfig embeddingModel();

    /**
     * Moderation model related settings
     */
    ModerationModelBuildConfig moderationModel();

    /**
     * Image model related settings
     */
    ImageModelBuildConfig imageModel();

    /**
     * If true, enables the use of Azure Default Credentials for authentication.
     * If not set, the default behavior is disabled.
     */
    @ConfigDocDefault("true")
    Optional<Boolean> azureDefaultCredentialsEnabled();
}

and in processor

    @BuildStep
    @Record(ExecutionTime.RUNTIME_INIT)
    public void registerDefaultModelAuthProvider(AzureOpenAiRecorder recorder,
            BuildProducer<SyntheticBeanBuildItem> producer,
            LangChain4jAzureOpenAiBuildConfig buildConfig) {

        if (buildConfig.azureDefaultCredentialsEnabled().isPresent() &&
                buildConfig.azureDefaultCredentialsEnabled().get()) {
            producer.produce(
                    SyntheticBeanBuildItem
                            .configure(ModelAuthProvider.class)
                            .scope(ApplicationScoped.class)
                            .setRuntimeInit()
                            .createWith(recorder.modelAuthProvider())
                            .done());
        }
    }

And that approach I've already pushed. Since it's default bean it also can be overwritten. Only downside is that even when api-key is provided with quarkus.langchain4j.azure-openai.azure-default-credentials-enabled, the azure model auth provider is used, but maybe it can be handled by warning or exception. Anyways please let me know if it is acceptable one.

quarkus-bot · 2025-12-11T19:02:46Z

Status for workflow `Build (on pull request)`

This is the status report for running Build (on pull request) on commit 7dcda5c.

Failing Jobs

Status	Name	Step	Failures	Logs	Raw logs
✔️	JVM tests - model-providers - Java 17			Logs	Raw logs
✔️	JVM tests - model-providers - Java 21			Logs	Raw logs
❌	JVM tests - model-providers - Java 24	`Set up JDK 24`	⚠️ Check →	Logs	Raw logs
❌	Native tests - multiple-providers	`Setup JBang`	⚠️ Check →	Logs	Raw logs
❌	Native tests - rag	`Setup JBang`	⚠️ Check →	Logs	Raw logs
❌	Native tests - rag-pgvector-flyway	`Setup JBang`	⚠️ Check →	Logs	Raw logs

Add default auth model provider

b122a89

hubert123490 requested a review from a team as a code owner December 4, 2025 15:12

hubert123490 mentioned this pull request Dec 4, 2025

Support default authentication via Managed Identity / Workload Identity for Azure OpenAI #1995

Open

This comment has been minimized.

Sign in to view

sberyozkin reviewed Dec 4, 2025

View reviewed changes

hubert123490 added 2 commits December 5, 2025 14:07

Add rest api filter resolver

8e088d2

Fix azure api key override by azure rest api filter

a6243a9

This comment has been minimized.

Sign in to view

Fix exception thrown by Map.of()

ee233fb

sberyozkin reviewed Dec 5, 2025

View reviewed changes

This comment has been minimized.

Sign in to view

sberyozkin reviewed Dec 7, 2025

View reviewed changes

geoand mentioned this pull request Dec 11, 2025

Support for forced tool calling #2009

Closed

hubert123490 added 2 commits December 11, 2025 19:13

Remove rest api filter related classes

d0c75f4

Register azure model auth provider bean conditionally

7dcda5c

Add default auth model provider #1996

Are you sure you want to change the base?

Add default auth model provider #1996

Conversation

hubert123490 commented Dec 4, 2025 • edited by geoand Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

geoand commented Dec 4, 2025

Uh oh!

This comment has been minimized.

sberyozkin Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

hubert123490 commented Dec 5, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sberyozkin commented Dec 7, 2025

Uh oh!

hubert123490 commented Dec 7, 2025

Uh oh!

sberyozkin commented Dec 8, 2025

Uh oh!

hubert123490 commented Dec 11, 2025

Uh oh!

quarkus-bot bot commented Dec 11, 2025

Status for workflow Build (on pull request)

Failing Jobs

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hubert123490 commented Dec 4, 2025 •

edited by geoand

Loading

sberyozkin Dec 4, 2025 •

edited

Loading

Status for workflow `Build (on pull request)`