azureauthextension

README

Azure Authenticator Extension

Status
Stability	beta
Distributions	contrib
Issues
Code coverage
Code Owners	@constanca-m, @dyl10s

This extension can be used in two directions:

• In exporters (outbound): attaches the collector's Azure identity as a bearer token to outgoing requests.
• In receivers (inbound): when wired as an extensionauth.Server (for example, protocols.http.auth.authenticator: azure_auth), validates incoming bearer tokens as OIDC JWTs against a configured issuer and audience. Requires the server block (see Inbound JWT validation).

Security advisory: Versions v0.124.0 through v0.150.0 contain a server-side authentication bypass (GHSA-pjv4-3c63-699f). Do not use azure_auth under a receiver auth: block on those versions. The outbound exporter usage is unaffected.

Additionally, the extension also implements azcore.TokenCredential so that Azure components can get the token by running the function GetToken. If the component supports HTTP client, then this should not be necessary, as the token will be placed in the authorization header.

It supports 4 different types of authentication:

• Managed identity for Azure resources
• Workload identity for Kubernetes
• Service principal with either a client secret or client certificate path for non Azure.
• And the default credentials. This is not recommended for production.

Examples

Managed identity

User based:

extensions:
  azure_auth:
    managed_identity:
      client_id: ${CLIENT_ID}

System based (leave client_id field empty):

extensions:
  azure_auth:
    managed_identity:

Workload identity

extensions:
  azure_auth:
    workload_identity:
      client_id: ${CLIENT_ID}
      federated_token_file: ${FILE}
      tenant_id: ${TENANT_ID}

Service principal

With client secret:

extensions:
  azure_auth:
    service_principal:
      client_id: ${CLIENT_ID}
      tenant_id: ${TENANT_ID}
      client_secret: ${CLIENT_SECRET}

With client certificate path:

extensions:
  azure_auth:
    service_principal:
      client_id: ${CLIENT_ID}
      tenant_id: ${TENANT_ID}
      client_certificate_path: ${CLIENT_CERTIFICATE_PATH}

Default authentication

Not recommended for production.

extensions:
  azure_auth:
    use_default: true

With custom scopes

You can set custom scopes if the audience required in the token does not match the host you are trying to reach. This is useful for Azure Monitor Workspaces since the workspace hostname is specific to your instance whereas the audience required is https://monitor.azure.com/.default

extensions:
  azure_auth:
    scopes:
      - https://monitor.azure.com/.default

Inbound JWT validation

The server block is required only in this specific case:

• A server protocol's auth.authenticator points at azure_auth (for example, receivers.otlp.protocols.http.auth.authenticator: azure_auth). This is the only path that validates inbound bearer tokens.

Do not set server in any other case, including:

• Exporter-only usage.
• A receiver that loads azure_auth as an azcore.TokenCredential to call Azure APIs (for example, a receiver reading from Azure Blob Storage). That path does not validate incoming tokens, so server has no effect.

When set, incoming bearer tokens are validated as OIDC JWTs: signature against the issuer's JWKS, plus iss, aud, exp, and nbf. The audience is pinned from config and never derived from request headers. Requests are rejected on any missing config or failed check.

Fields:

• server.issuer_url: Entra ID tenant discovery URL (https://login.microsoftonline.com/<tenant-id>/v2.0).
• server.audience: aud value required in valid tokens (for example, api://collector-ingest).

extensions:
  azure_auth:
    use_default: true
    server:
      issuer_url: https://login.microsoftonline.com/${TENANT_ID}/v2.0
      audience: api://collector-ingest

receivers:
  otlp:
    protocols:
      http:
        endpoint: 0.0.0.0:4318
        auth:
          authenticator: azure_auth

Documentation

Index

• func NewFactory() extension.Factory
• type Config
  • func (cfg *Config) Validate() error
• type ManagedIdentity
  • func (*ManagedIdentity) Validate() error
• type Server
• type ServicePrincipal
  • func (cfg *ServicePrincipal) Validate() error
• type WorkloadIdentity
  • func (cfg *WorkloadIdentity) Validate() error

Functions

func NewFactory

func NewFactory() extension.Factory

Types

type Config

type Config struct {
	Managed          configoptional.Optional[ManagedIdentity]  `mapstructure:"managed_identity"`
	Workload         configoptional.Optional[WorkloadIdentity] `mapstructure:"workload_identity"`
	ServicePrincipal configoptional.Optional[ServicePrincipal] `mapstructure:"service_principal"`
	Server           configoptional.Optional[Server]           `mapstructure:"server"`
	UseDefault       bool                                      `mapstructure:"use_default"`
	Scopes           []string                                  `mapstructure:"scopes"`
	// contains filtered or unexported fields
}

func (*Config) Validate

func (cfg *Config) Validate() error

type ManagedIdentity

type ManagedIdentity struct {
	// if left empty, then it is system managed
	ClientID string `mapstructure:"client_id"`
	// contains filtered or unexported fields
}

func (*ManagedIdentity) Validate

func (*ManagedIdentity) Validate() error

type Server

type Server struct {
	IssuerURL string `mapstructure:"issuer_url"`
	Audience  string `mapstructure:"audience"`
	// contains filtered or unexported fields
}

type ServicePrincipal

type ServicePrincipal struct {
	TenantID              string `mapstructure:"tenant_id"`
	ClientID              string `mapstructure:"client_id"`
	ClientSecret          string `mapstructure:"client_secret"`
	ClientCertificatePath string `mapstructure:"client_certificate_path"`
	// contains filtered or unexported fields
}

func (*ServicePrincipal) Validate

func (cfg *ServicePrincipal) Validate() error

type WorkloadIdentity

type WorkloadIdentity struct {
	ClientID           string `mapstructure:"client_id"`
	TenantID           string `mapstructure:"tenant_id"`
	FederatedTokenFile string `mapstructure:"federated_token_file"`
	// contains filtered or unexported fields
}

func (*WorkloadIdentity) Validate

func (cfg *WorkloadIdentity) Validate() error