authenticationtriggersconnection-stringazureservicebus

How to use DefaultAzureCredentialOptions with ServiceBus triggers?


Is there a way to connect programmatically when using ServiceBus triggers, or are you confined to using the connections string? Or is there a way to specify in the connection string how you want to connect?

We use Managed Identity when deployed, and generally either VS or VS Code creds when running locally. The issue I have is twofold. One is that performance the connection is just not great, and then it produces a lot of noise as it goes through a series of authentication methods until it finds the one that works producing useless logs like this:

DefaultAzureCredentialOptions

I know how to disable the output of these errors, but then I wouldn't get a message if there was actually an error on the credential I need to connect with. If there was just a way to silence these but still get a final error if nothing connects that would be little bit of an improvement.

Even better would be if there was a way I could specify exactly which way I want to connect. If I were making the connection manually I think I could do this with DefaultAzureCredentialOptions but I don't see how to take advantage of this with a trigger that just uses a connection string from configuration which I don't believe allows for specifying any method I would want to use.


Solution

  • The Azure clients and associated credentials are injected into Function apps via dependency injection. You would need to write a Function startup class to participate in the DI configuration. (see: Use dependency injection in .NET Azure Functions)

    Once there, you would use the Azure extensions to override the default credential used with one configured as you'd like. For example, configuring the options for DefaultAzureCredential would look something like:

    using Azure.Identity;
    using Microsoft.Extensions.Azure;
    using Microsoft.Azure.Functions.Extensions.DependencyInjection;
    using Microsoft.Extensions.DependencyInjection;
    
    [assembly: FunctionsStartup(typeof(MyNamespace.Startup))]
    
    namespace MyNamespace;
    
    public class Startup : FunctionsStartup
    {
        public override void Configure(IFunctionsHostBuilder builder)
        {
            builder.Services.AddAzureClients(azureBuilder => 
            {
                var options = new DefaultAzureCredentialOptions
                {
                    ExcludeManagedIdentityCredential = true
                };
    
                // Configure a new credential to be used by default
                // for all clients that require TokenCredential.
    
                azureBuilder.UseCredential(new DefaultAzureCredential(options));
            });
        }
    }
    

    This would also allow you to create a different credential type, such as a chained credential that includes only VS and VSCode for local development scenarios.

    More information and examples for configuring Azure clients in DI can be found in: Dependency injection with the Azure SDK for .NET.