Usage of CognitiveServicesManagementClient in government clouds

• Package Name: arm-cognitiveservices
• Package Version: 7.2.0
• Operating system:
• nodejs
  • version: LTS
• browser
  • name/version:
• typescript
  • version:
• Is the bug related to documentation in
  • README.md
  • source code documentation
  • SDK API docs on https://docs.microsoft.com

Describe the bug We have the following code to use CognitiveServicesManagementClient.

        const managementEndpoint = getAzureManagementUrl();
        const clientOpts = { endpoint: managementEndpoint } as CognitiveServicesManagementClientOptionalParams;
        const cogSvcClient: CognitiveServicesManagementClient = new CognitiveServicesManagementClient(credential, subscriptionId, clientOpts);

However, it appears this is insufficient to work as expected in government clouds. We get error that the token from the credential has invalid audience https://management.azure.com and should be one of the gov cloud management endpoints. Note that getAzureManagementUrl in the snippet above returns the correct URL for the environment.

Looking the management client implementation, it looks like the credentialScopes property in the options is hard coded to the public azure endpoint if missing.

https://github.com/Azure/azure-sdk-for-js/blob/9f2a8de156d975854be47a6ade17f79bb3ea84cf/sdk/cognitiveservices/arm-cognitiveservices/src/cognitiveServicesManagementClient.ts#L88

It looks like we also need to explicitly specify the credentialScope.

To Reproduce Steps to reproduce the behavior: 1.

Expected behavior The code in the snippet above or some variation of it should be sufficient for the client to work in gov clouds. The user should not have to specify the cloud endpoint in more than one place.

Screenshots If applicable, add screenshots to help explain your problem.

Additional context Add any other context about the problem here.

[xirzec]

I don’t think endpoint and authorityHosts are the same thing. Feel free to correct me if I am wrong @joheredi and @xirzec

Definitely they are different things, though related by the fact that govcloud endpoints necessitate using the right authority host. I don’t think we do any smart detection on the endpoint url itself, though there is a AZURE_AUTHORITY_HOST environment variable that I believe we consult if you don’t specify a host explicitly.

@schaabs do you have some wisdom here? I am not sure what the latest govcloud guidance is as far as the best way to configure everything.

[msftbot[bot]]

Hi, we’re sending this friendly reminder because we haven’t heard back from you in a while. We need more information about this issue to help address it. Please be sure to give us your input within the next 7 days. If we don’t hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!