Azure OIDC Login Demo

This repo has an Action that tests logging in to Azure using OIDC.

Full write-up here.

For this demo to work, you need 2 SPNs in Azure and 2 environments. The jobs target dev and prod environments.

Update: 11/18

You no longer need the composite workflow, since you no longer have to install the az cli beta. You can just collapse to this:

  - uses: azure/login@v1
    name: Log in using OIDC
    with:
      tenant-id: ${{ secrets.AZURE_TENANT_ID }}
      client-id: ${{ secrets.AZURE_CLIENT_ID }}
      subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

and you'd be good to go from there!

Azure Configuration

Steps:

Create a dev service principal (App Registration) in Azure
On the Certificates and Secrets tab of the App, click Federated credentials
Click + Add credential and enter the org, repo and environment (in this case dev)
On the Overview tab, note the Application (client) ID for this SPN
Give the SPN access to a subscription or Resource Group within the tenant

Repeat these steps for a prod SPN, giving it access to a different subscription or set of resource groups.

GitHub Configuration

Steps:

Create a dev environment in the repo Environments tab under Settings
Add the dev clientID as a secret called AZURE_CLIENT_ID

Repeat for the prod environment, creating the same secret but use the clientID of the prod SPN.

On the repo, configure 2 additional secrets:

AZURE_TENANT_ID - the AAD tenant ID
AZURE_SUBSCRIPTION_ID - the ID of the Azure subscription

Note: If you have different subscriptions for dev and prod, define the AZURE_SUBSCRIPTION_ID at the corresponding environment, rather than sharing a single subscription at the repo level.

Queue the Workflow

Now you can navigate to the Actions tab, click on the OIDC Demo workflow and queue it.

Results