Identity Laravel Package

Getting Started

First Steps

1. Installation Add the package via Composer:

   composer require azure/identity
   

   Register the service provider in config/app.php (if not auto-discovered):

   'providers' => [
       // ...
       Azure\Identity\IdentityServiceProvider::class,
   ],
   

2. Basic Authentication Initialize a credential object (e.g., DefaultAzureCredential for multi-environment auth):

   use Azure\Identity\DefaultAzureCredential;
   
   $credential = new DefaultAzureCredential();
   

3. First Use Case: Authenticating with Azure Storage Use the credential with the Azure SDK for PHP (e.g., azure/storage-blob):

   use Azure\Storage\Blob\BlobServiceClient;
   
   $blobServiceClient = new BlobServiceClient(
       'https://<account-name>.blob.core.windows.net',
       $credential
   );
   

Implementation Patterns

Common Workflows

1. Multi-Environment Authentication Use DefaultAzureCredential to chain multiple authentication methods (e.g., Azure CLI, Managed Identity, Service Principal):

   $credential = new DefaultAzureCredential([
       'excludeEnvironmentVariables' => false,
       'excludeSharedTokenCacheCredential' => false,
       'excludeVisualStudioCodeCredential' => false,
       'excludeManagedIdentityCredential' => false,
   ]);
   

2. Service Principal Authentication For CI/CD or serverless environments:

   use Azure\Identity\ClientSecretCredential;
   
   $credential = new ClientSecretCredential(
       '<tenant-id>',
       '<client-id>',
       '<client-secret>'
   );
   

3. Managed Identity (Azure VM/AKS) Use ManagedIdentityCredential for Azure-hosted resources:

   use Azure\Identity\ManagedIdentityCredential;
   
   $credential = new ManagedIdentityCredential('<resource-id>');
   

Integration Tips

• Laravel Configuration Store Azure credentials in .env and inject them via Laravel’s binding:

  // config/services.php
  'azure' => [
      'tenant_id' => env('AZURE_TENANT_ID'),
      'client_id' => env('AZURE_CLIENT_ID'),
      'client_secret' => env('AZURE_CLIENT_SECRET'),
  ],
  

  Bind the credential in a service provider:

  $this->app->bind(AzureCredential::class, function ($app) {
      return new ClientSecretCredential(
          $app['config']['services.azure.tenant_id'],
          $app['config']['services.azure.client_id'],
          $app['config']['services.azure.client_secret']
      );
  });
  

• Retry Policies Combine with azure/azure-sdk-for-php retry policies for transient failures:

  use Azure\Core\Retry\ExponentialRetryPolicy;
  
  $retryPolicy = new ExponentialRetryPolicy();
  $blobServiceClient = new BlobServiceClient(
      'https://<account>.blob.core.windows.net',
      $credential,
      ['retryPolicy' => $retryPolicy]
  );
  

Gotchas and Tips

Pitfalls

1. Environment-Specific Credentials

   • DefaultAzureCredential may fail silently if no valid source is found. Log or validate:

     try {
         $credential = new DefaultAzureCredential();
     } catch (Exception $e) {
         Log::error('Azure auth failed: ' . $e->getMessage());
         throw $e;
     }
     

2. Token Caching

   • Tokens expire (~1 hour). Use SharedTokenCacheCredential for persistence across requests:

     use Azure\Identity\SharedTokenCacheCredential;
     
     $credential = new SharedTokenCacheCredential(
         new ClientSecretCredential('<tenant>', '<client>', '<secret>')
     );
     

3. Permissions

   • Ensure the service principal has the correct RBAC roles (e.g., Storage Blob Data Contributor).

Debugging

• Enable Logging Set the AZURE_LOG_LEVEL environment variable to debug for detailed logs:

  export AZURE_LOG_LEVEL=debug
  

• Token Inspection Dump the token payload to verify scopes:

  $token = $credential->getToken('https://storage.azure.com/.default');
  dd($token->getToken());
  

Extension Points

1. Custom Credential Classes Extend Azure\Identity\Credential for custom auth logic (e.g., OAuth2 flows).

2. Middleware for Azure SDKs Create Laravel middleware to inject credentials into Azure SDK clients:

   public function handle($request, Closure $next) {
       $request->azureCredential = app(AzureCredential::class);
       return $next($request);
   }
   

3. Testing Mock credentials in tests using Azure\Identity\MockCredential:

   use Azure\Identity\MockCredential;
   
   $mockCredential = new MockCredential();
   $mockCredential->setToken('https://storage.azure.com/.default', 'fake-token');