Support for user assigned identity for App Service MSI

Per https://docs.microsoft.com/en-us/azure/app-service/overview-managed-identity, the Azure App Service token URL, as accessed by MSI_ENDPOINT supports an optional parameter named clientid to select which User-Assigned Identity to use.

The current call to that endpoint does not pass through the clientid parameter for App Service MSI, only for VM IMDS endpoint calls. See: https://github.com/Azure/azure-sdk-for-net/blob/psSdkJson6/src/SdkCommon/AppAuthentication/Azure.Services.AppAuthentication/TokenProviders/MsiAccessTokenProvider.cs#L56

This means that effectively, Microsoft.Azure.Services.AppAuthentication 1.2.0-preview cannot be used to retrieve tokens for user-assigned MSI on Azure App Service / Azure Functions.

I think this is a relatively simple change to add the clientid parameter to the app service MSI call

Would you be open to a PR (with tests, of course) to add this feature?

[nonik0]

FYI this support is added in 1.2.0-preview2.

[michaelwstark]

@noelbundick The workaround should be pretty similar with or without key vault – internally the callback just calls the same method you have referenced in your original comment.

Unfortunately, I can’t answer the question regarding the contribution PR as I don’t own or maintain this repo. I would hope the maintainers would welcome the contribution, but they would have to confirm. I’m just another developer that wanted to use user assigned MSI and ran into this issue.