fix: Replace DefaultAzureCredential with ManagedIdentityCredential for production-safe authentication

[Prasanjeet-Microsoft]

Purpose

This pull request introduces a significant refactor to replace the use of DefaultAzureCredential with a new utility function, get_azure_credential, which selects the appropriate Azure credential based on the application environment (dev or prod). Additionally, a new environment variable APP_ENV has been added to .env.sample to support this functionality. Below are the key changes grouped by theme:

Credential Management Refactor:

• Introduced get_azure_credential in azure_credential_utils.py, which dynamically selects between DefaultAzureCredential and ManagedIdentityCredential based on the APP_ENV variable.
• Updated all instances of DefaultAzureCredential across multiple files to use get_azure_credential, ensuring consistent credential management. For example:
  • database_factory.py: Replaced DefaultAzureCredential with get_azure_credential in get_conversation_client.
  • azure_blob_storage_client.py: Updated credential initialization in create_queue_client and the class constructor. [1] [2]
  • azure_computer_vision_client.py: Replaced DefaultAzureCredential with get_azure_credential in token provider setup.

Environment Variable Addition:

• Added APP_ENV to .env.sample to specify the application environment (e.g., dev or prod). This variable is used to determine the credential type in get_azure_credential.

Bug Fix:

• Corrected a typo in env_helper.py by changing SEMENTIC_KERNEL_SYSTEM_PROMPT to SEMANTIC_KERNEL_SYSTEM_PROMPT.

Documentation and Comments:

• Updated comments and docstrings across the codebase to reflect the use of get_azure_credential instead of DefaultAzureCredential. For example, in env_helper.py.

This refactor improves the flexibility and security of credential management by dynamically adapting to different environments, while maintaining backward compatibility for existing functionality.

Does this introduce a breaking change?

• Yes
• No

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

What to Check

Verify that the following are valid:

• All usages of DefaultAzureCredential replaced
• Authentication logic tested locally or in a dev environment
• Regression tested (i.e., existing functionality relying on authentication continues to work)
• Confirmed no hardcoded secrets or fallback dev credentials remain