Azure auth for developing on macOS

To authenticate your TypeScript-based app running on macOS with Azure services, you can use the DefaultAzureCredential class from the Azure Identity library. This class is designed to work in local development environments and can discover user credentials from your local tooling or IDE, such as the Azure CLI or Visual Studio Code.

Here are the steps you can follow:

1. Install the Azure Identity Library: Make sure you have the @azure/identity package installed in your project. You can do this by running:

      npm install @azure/identity
   

2. Use DefaultAzureCredential: In your application code, import the DefaultAzureCredential and use it to authenticate your Azure services. Here’s a simple example:

      import { DefaultAzureCredential } from '@azure/identity';
      import { SomeAzureServiceClient } from '@azure/some-azure-sdk';
      
      const credential = new DefaultAzureCredential();
      const client = new SomeAzureServiceClient(credential);
   

3. Authenticate with Azure CLI: Before running your application, ensure you are logged in to your Azure account via the Azure CLI. You can log in by running:

      az login
   

   This will open a browser window for you to authenticate.
4. Check for Permissions: Ensure that your Azure account has the necessary permissions to access the resources you are trying to configure in Azure App Configuration.

While it is true that some features like brokered authentication and Visual Studio Code authentication are not supported on macOS, using DefaultAzureCredential should provide a viable workaround for local development. This approach allows you to authenticate without needing the specific brokered authentication features that are currently limited to Windows and Linux.

If you encounter any issues, consider checking the Azure documentation for more detailed guidance on authentication flows and troubleshooting tips.

References:

• Authenticate Azure-hosted JavaScript apps to Azure resources using a user-assigned managed identity
• Authenticate .NET apps to Azure services during local development using developer accounts

Okay, I figured out what I was doing wrong. Solution below.

First, AI says that brokered authentication is an alternative way to auth and I can instead just auth through either the vs-code library, or more simply with AzureCliCredential from @azure/identity. I went with the latter.

The other mistake I made is that I was passing my AppConfiguration URL to a Key Vault client and not the App Configuration client. It would help if MS would improve the error messaging, because I didn't see this mistake for a while.

Included is my working code. Hope it's helpful for anyone who's getting started with Azure. Note, I'm using Deno.

import { AppConfigurationClient } from '@azure/app-configuration'
import type {
	AzureCliCredential,
	DefaultAzureCredential,
	ManagedIdentityCredential,
} from '@azure/identity'

export async function getConfigAzure({
	serviceName,
	separator='.',
	credential,
}: {
	serviceName: string,
	credential: AzureCliCredential | DefaultAzureCredential | ManagedIdentityCredential,
	separator?: string,
}) {
	const client = new AppConfigurationClient('https://bdp-apps-config.azconfig.io', credential)
	const prefix = ['your', 'prefix', serviceName].join(separator) + separator
	const keyFilter = prefix + '*'
	for await (const setting of client.listConfigurationSettings({ keyFilter })) {
		const key = setting.key.replace(prefix, '')
		console.log('setting:', key, setting.value)
	}
}

import { getConfigAzure } from '@scope/shared'
import { useIdentityPlugin, AzureCliCredential } from '@azure/identity'
import { vsCodePlugin } from '@azure/identity-vscode'

useIdentityPlugin(vsCodePlugin)

try {
	Deno.env.set('AZURE_APP_CONFIG_ENDPOINT', 'https://your-apps-config.azconfig.io')
	const credential = new AzureCliCredential()

	const resp = await getConfigAzure({ serviceName: 'clock', credential })
	console.log(resp)
} catch (err) {
	console.error(err)
}

<DELETED>

[Answer reposted because the website is not working right.]

I've tried to post an answer twice now and the AI moderator keeps censoring me. I'm not doing anything wrong, just trying to show the solution.

Solution was that I don't have to use brokered auth, I can instead use AzureCliCredential.

Good luck. Sorry I can't show you the working code, MS won't allow it.