[Feature Request] Allow user to specify audience for OIDC

[robcao]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

Currently, the OIDC audience is hardcoded to api://AzureADTokenExchange.

In sovereign clouds, Azure is changing the value of the audience. For example, in Azure US Government, the value is now expected to be api://AzureADTokenExchangeUSGov: Azure/login#452.

The current workaround is for users to do the federated token exchange outside of pulumi, and pass in the token via the ARM_OIDC_TOKEN environment variable, but it would be simpler if users could just pass in the audience and not have to know lower level details about how OIDC works, eg ARM_OIDC_AUDIENCE.

I would like an additional optional configuration variable, ARM_OIDC_AUDIENCE to be supported by the azure-native provider. When the value is not set, the audience should continue to default to api://AzureADTokenExchange.

It may also be nice to default the audience to api://AzureADTokenExchangeUSGov when the environment is detected to be AzureUSGovernment, but I suspect that this will be a breaking change for many users that have set up OIDC before the Azure audience default change, so I think this should be opt-in only.

Affected area/feature

Azure Authentication

Implementation

I opened a potential pull request here: #3965

I would be happy to implement this.

[rquitales]

Thanks for reporting this usability issue. I'll flag this to my team for further consideration.