Azure Native Authentication Method

[dangtony98]

Description 📣

This PR adds the new Azure authentication method to Identities.

With this method, Azure resources like Azure VMs avoid secret zero by not needing to store an additional token to authenticate with Infisical. Instead, they can use their managed identity access tokens to prove their identity to Infisical — this works by relaying the managed identity access token through Infisical to be verified against the public key at the Azure AD OpenID configuration endpoint; if successful and certain allow conditions are met, then the entity is considered authenticated and an access token granting access to the Infisical API is returned.

Workflow:

1. The operator sets up the Azure authentication method in Infisical. As part of the setup, they specify what Service Principal IDs can be trusted. They also specify the Tenant ID and (optional) Audience param included in the managed identity access tokens as part of the authentication method configuration.
2. The operator programs the client application in Azure to retrieve its managed identity access tokens and send it to the /api/v1/auth/azure-auth/login endpoint containing the identityId that they are authenticating as and the jwt as params (in practice this would likely be done via SDK or other client but it can also be done manually).
3. Infisical verifies the JWT token using the public key obtained from the Azure AD OpenID configuration endpoint.
4. If successful, then Infisical checks the returned identity service principal ID (referred to as oid field on the JWT payload) against Allowed Service Principal IDs defined in step 1.
5. If successful, then Infisical returns an identity access token (similar to in Universal Auth).

Note: The Azure authentication method will require additional engineering work for clients like Infisical Agent and SDKs to support it.

Type ✨

• Bug fix
• New feature
• Breaking change
• Documentation

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[DanielHougaard]

Looks great, I've left out any nits and only commented on important things.

[DanielHougaard]

One last comment!