fix: derive OIDC ALLOWED_HOSTS from connection string hostname instead of hardcoded *.azure.com (fixes #639)

src/documentdb/auth/MicrosoftEntraIDAuthHandler.ts

@@ -10,6 +10,7 @@ import { type MongoClientOptions, type OIDCCallbackParams, type OIDCResponse } f
 import { type CachedClusterCredentials } from '../CredentialCache';
 import { DocumentDBConnectionString } from '../utils/DocumentDBConnectionString';
 import { type AuthHandler, type AuthHandlerResponse } from './AuthHandler';
+import { getOidcAllowedHosts } from './oidcAllowedHosts';
 
 /**
  * Handler for Microsoft Entra ID authentication via OIDC
@@ -43,7 +44,7 @@ export class MicrosoftEntraIDAuthHandler implements AuthHandler {
             authMechanism: 'MONGODB-OIDC',
             tls: true,
             authMechanismProperties: {
-                ALLOWED_HOSTS: ['*.azure.com'],
+                ALLOWED_HOSTS: getOidcAllowedHosts(this.clusterCredentials.connectionString),
                 OIDC_CALLBACK: (_params: OIDCCallbackParams): Promise<OIDCResponse> =>
                     Promise.resolve({
                         accessToken: session.accessToken,

src/documentdb/auth/oidcAllowedHosts.ts

@@ -0,0 +1,32 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+import { DocumentDBConnectionString } from '../utils/DocumentDBConnectionString';
+
+const DEFAULT_ALLOWED_HOSTS = ['*.azure.com'];
+
+/**
+ * Resolve the OIDC ALLOWED_HOSTS list from a MongoDB connection string.
+ *
+ * Previously both the auth handler and the playground worker hardcoded
+ * `['*.azure.com']`, which blocked sovereign clouds (*.azure.cn, *.azure.us),
+ * private endpoints, and custom domains. This helper extracts the actual
+ * target hostname(s) so OIDC auth works against any valid endpoint.
+ *
+ * Multi-host connection strings (e.g. replica sets) are supported by
+ * returning a glob per host (`*.hostname`).
+ */
+export function getOidcAllowedHosts(connectionString: string): string[] {
+    try {
+        const parsed = new DocumentDBConnectionString(connectionString);
+        const hosts = parsed.hosts;
+        if (hosts && hosts.length > 0) {
+            return hosts.map((h) => `*.${h}`);
+        }
+    } catch {
+        // Connection string couldn't be parsed — keep the safe default.
+    }
+    return DEFAULT_ALLOWED_HOSTS;
+}

src/documentdb/playground/playgroundWorker.ts

@@ -18,6 +18,7 @@ import { DocumentDBShellRuntime } from '@documentdb-js/shell-runtime';
 import { randomUUID } from 'crypto';
 import { type MongoClientOptions, type MongoClient as MongoClientType } from 'mongodb';
 import { parentPort } from 'worker_threads';
+import { getOidcAllowedHosts } from '../auth/oidcAllowedHosts';
 import { type MainToWorkerMessage, type WorkerToMainMessage } from './workerTypes';
 
 if (!parentPort) {
@@ -119,7 +120,7 @@ async function handleInit(msg: Extract<MainToWorkerMessage, { type: 'init' }>):
         options.authMechanism = 'MONGODB-OIDC';
         options.tls = true;
         options.authMechanismProperties = {
-            ALLOWED_HOSTS: ['*.azure.com'],
+            ALLOWED_HOSTS: getOidcAllowedHosts(msg.connectionString),
             OIDC_CALLBACK: async (): Promise<{ accessToken: string; expiresInSeconds: number }> => {
                 const requestId = randomUUID();
                 const tokenPromise = new Promise<string>((resolve, reject) => {