Azure / ARO-RP / 26426786651

38%

push

github

[ARO-27277] Holmes: use Entra ID token auth for Azure OpenAI (#4852)

* feat: use Entra ID token auth for Holmes Azure OpenAI (ARO-27277)

Replace API key authentication with Entra ID token-based authentication
for the Holmes investigation admin API. The RP's managed identity (prod)
or dev service principal (dev) acquires a short-lived token scoped to
cognitiveservices.azure.com at request time, eliminating the need to
store API keys in Key Vault or environment variables.

This enables setting disableLocalAuth=true on the Azure OpenAI resource,
which the security team requires.

* fix: address Copilot review feedback for deploy script

- Ensure custom subdomain is set on existing AOAI accounts (required
  for Entra token auth)
- Narrow blank line removal to only strip trailing blanks instead of
  all blank lines in secrets/env

* docs: update Holmes documentation for Entra ID token auth

Remove references to HOLMES_AZURE_API_KEY and holmes-azure-api-key
across documentation. Update config loading, Key Vault provisioning,
and dev setup instructions to reflect Entra ID token authentication.

18 of 43 new or added lines in 3 files covered. (41.86%)

29548 of 76845 relevant lines covered (38.45%)

0.44 hits per line