Azure-webjobs-sdk: use Managed service identity with service bus

[arajbanshi]

Hi,
I'm trying to use managed service identity with Azure functions with Azure service bus queues as the trigger. However, it looks like Azure functions do not currently support integration with managed system identity.

Repro steps

Provide the steps required to reproduce the problem

1. Create a Function in Azure with Azure service bus as trigger

Expected behavior

Provide a description of the expected behavior.
Expected to see managed service identity to authenticate to azure service bus without having to specify connection string.

Actual behavior

The function requires us to specify namespace and policy then it proceeds to download the connection string. There is no way to specify that we want to use managed service identity instead of connection string

Known workarounds

Use connection strings based authentication

Related information

Provide any related information

• Package version
• Links to source

[chris-rogala]

Another workaround, is to store the connection strings in key vault and use managed service identity to with the key vault. Then you can add a key vault provider to your configuration. Using the new DI pattern, you can create a singleton of the configuration and setup a scheduled trigger to refresh the key vault settings. I actually am finishing up a blog that proves this pattern.

[Sbou]

I’m also interested by this feature but I don’t figure out how you can use a KeyVault with a trigger.
Each trigger has a " connectionstring " attribute and in the source code I didn’t see something about managed identity.

[chris-rogala]

It’s pretty simple. Using the new DI, register a singleton of IConfiguration. Register Key Vault (https://docs.microsoft.com/en-us/aspnet/core/security/key-vault-configuration) as a provider. Store the connection string in your secrets and grant the function access using either managed identity or a certificate.

[Sbou]

Ok. I got it. You inject in the merged configuration the connection string and in the trigger it’s just a reference.

Thank you very much

[arajbanshi]

Is there anything in the roadmap for service bus trigger to support managed identity natively?

[brettsam]

There is a uservoice issue tracking this here: https://feedback.azure.com/forums/355860-azure-functions/suggestions/37907848-support-for-azure-managed-service-identities-in-ev

Also see this comment: https://github.com/MicrosoftDocs/azure-docs/issues/34826#issuecomment-510005304.

This work is not planned yet and we have no ETA.