Use Azure Identity credentials to authenticate in Python

Unfortunately, we do not have that today, but will log it as a feature request. 

Just to specify this even more, I guess the method above could be?

CogniteClient.default_azure_credentials(project, cluster) 

with the client name as optional as in the other factory methods we have (set to your user name by default)

Great!

I would prefer to control the credential creation myself. There are a lot of options and variants that will vary from setup to setup. Sometimes you would want to hard-code AzureCliCredential or EnvironmentCredential, or exclude some methods from AzureDefaultCredential.

CogniteClient.azure_credentials(credential, project, cluster)

The above method would mimic the way Microsofts own SDKs work. 

Example (KeyVault):

https://learn.microsoft.com/en-us/azure/key-vault/secrets/quick-create-python?tabs=azure-cli

We are looking into the option of using ManagedIdentity from Azure Functions to connect to CDF and PowerOps. The idea outlined by Sindre should also work for our usecase, so we also like to encourage finding a solution to this!

@Sindre Tøsse If you have a good solution for this, can you create a PR for the SDK? I will can take over if you set up the first pass on it.

I’m not sure if Sindre has the time to implement a solution for this, but another colleague of mine had an idea of a possible workaround that could have worked using token provider:
 

def _create_client_from_token_provider(
    client_name: str,
    env: Env,
    token_provider: Callable
):
    cdf_client = CogniteClient(
        ClientConfig(
            credentials=Token(token_provider),
            project=COGNITE_PROJECTS[env],
            base_url=f"https://{CDF_CLUSTER}.cognitedata.com",
            client_name=client_name,
        )
    )
    return cdf_client


def create_client_from_azurecredentials(
    env: Env,
    client_name: str,
    credential: DefaultAzureCredential = None
):
    if credential is None:
        credential = DefaultAzureCredential()

    def token_provider():
        return credential.get_token(' '.join(SCOPES)).token

    return _create_client_from_token_provider(client_name, env, token_provider)

 However, this fails due to some missing admin consent or similar, but works when the user log in manually.

We are setting up at lot of ManagedIdentities as we are migrating to new infrastructure with container apps. A solution to this issue would therefore be greatly appreciated.