Add support for Azure Stack HCI IMDS Identity/token endpoint

[bnichms]

Feature Request

My team owns the IMDS endpoint for Azure Stack HCI. Recently, we were working with another Azure team as they tried to implement MSI authentication utilizing our endpoint and it does not seem to be supported.

After that team and I looked through the code we see that support for our endpoint would work if not for the constant definition of the endpoint, and attempting to set environment variables so that the "HIMDS" code flow triggered also fails because of getAzureArcSecret().

The response for our endpoint is the same as Azure IMDS endpoint and contains an access token. And like Arc/HIMDS we also only support system-assigned identities (not user-defined). I am happy to engage in further talks if needed so that support can be brought to the Azure sdk.

[github-actions]

Thank you for your feedback. Tagging and routing to the team member best able to assist.

[chlowell]

Thanks for opening this issue! Azure Arc has a unique protocol for managed identity authentication. If Azure Stack HCI's protocol is truly identical to IMDS's, then you don't want to imitate Arc, only override azidentity's hardcoded IMDS endpoint. That isn't possible today, however it is possible in Azure SDK authentication libraries for other languages and we could implement their solution here.

The way it works for e.g. the Azure SDK for Python is the managed identity client uses the value of environment variable AZURE_POD_IDENTITY_AUTHORITY_HOST as the base IMDS URL. So, you set that variable and when in IMDS mode, the client sends token requests to $AZURE_POD_IDENTITY_AUTHORITY_HOST/metadata/identity/oauth2/token. The variable name is perhaps awkward for your case but the feature seems to do exactly what you want and it's straightforward for us to copy it to azidentity.

That said, I have a couple questions:

1. Setting the variable name aside, would this feature work for Azure Stack HCI? Does its managed identity implementation have any different requirements or behaviors compared to IMDS?
2. If this is the right feature, is AZURE_POD_IDENTITY_AUTHORITY_HOST an acceptable name or a blocker e.g. because users are responsible for setting it?