fix: Replace DefaultAzureCredential with ManagedIdentityCredential for production-safe authentication

[Prasanjeet-Microsoft]

Purpose

This pull request introduces a refactor to replace the usage of DefaultAzureCredential with a new helper function get_azure_credential, which dynamically selects the appropriate credential type based on the application environment (APP_ENV). Additionally, it includes minor fixes and adjustments to environment variable names. Below are the most important changes grouped by theme:

Credential Refactor:

• code/backend/batch/utilities/helpers/azure_credential_utils.py: Added the get_azure_credential and get_azure_credential_async functions to dynamically select between DefaultAzureCredential and ManagedIdentityCredential based on the environment (APP_ENV).
• Updated multiple files across the codebase to replace DefaultAzureCredential with get_azure_credential for consistent credential handling:
  • database_factory.py [1] [2]
  • postgresdbservice.py [1] [2]
  • azure_blob_storage_client.py [1] [2] [3]
  • azure_computer_vision_client.py [1] [2]
  • azure_form_recognizer_helper.py [1] [2]
  • azure_postgres_helper.py [1] [2]
  • azure_search_helper.py [1] [2] [3] [4]
  • env_helper.py [1] [2] [3]
  • llm_helper.py [1] [2]
  • azure_search_datasource.py [1] [2]
  • azure_search_index.py [1] [2]
  • azure_search_indexer.py [1] [2]

Environment Variable Updates:

• .env.sample: Added APP_ENV to specify the application environment (e.g., dev, prod) for dynamic credential selection.
• env_helper.py: Corrected a typo in the environment variable name from SEMENTIC_KERNEL_SYSTEM_PROMPT to SEMANTIC_KERNEL_SYSTEM_PROMPT.

These changes improve the flexibility and maintainability of credential management across the codebase while ensuring consistency in environment variable usage.

Does this introduce a breaking change?

• Yes
• No

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

What to Check

Verify that the following are valid:

• All usages of DefaultAzureCredential replaced
• Authentication logic tested locally or in a dev environment
• Regression tested (i.e., existing functionality relying on authentication continues to work)
• Confirmed no hardcoded secrets or fallback dev credentials remain