Fix #2274: Honour AZURE_TENANT_ID and caller-supplied subscription_id in azure_rm workload-identity auth

[zunyangc]

SUMMARY

Fix #2274.

The azure_rm modules and the azure_rm inventory plugin did not pick up the environment variables injected by the AKS workload-identity webhook (and used by the azure-identity SDK), so OIDC auth failed out-of-the-box on AKS workloads until the user manually re-exported AZURE_TENANT=$AZURE_TENANT_ID.

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

plugins/module_utils/azure_rm_common.py
plugins/doc_fragments/azure_plugin.py

ADDITIONAL INFORMATION

1. AZURE_TENANT_ID honoured as a fallback for tenant
   • New AZURE_CREDENTIAL_ENV_MAPPING_FALLBACK = {'tenant': 'AZURE_TENANT_ID'}.
   • _get_env() returns the primary env var when set, otherwise the fallback.
   • _get_env_credentials() now routes through _get_env() so the alias applies there too.
   • AZURE_TENANT remains the primary name (back-compat with existing pipelines and ~/.azure/credentials profiles).
2. _get_env_credentials() early-return reordered
   • Caller-supplied subscription_id is merged into env_credentials before the "no subscription return None" check, so a value from an azure_rm.yml inventory config or ~/.azure/credentials profile is honoured under workload identity (where the webhook does not inject AZURE_SUBSCRIPTION_ID).
3. Auto cascade guard against env without auth material
   • _get_env_credentials() now returns None when the env has neither client_id (SP / OIDC paths) nor ad_user (user/password path), even if a caller-supplied subscription_id is present.
   • Without this guard, the change in (2) would cause auth_source=auto to short-circuit on a subscription-only env dict, skipping the documented credential_file -> az-cli fallbacks.
   • The guard preserves the azure_rm: workload identity auth reads AZURE_TENANT but not AZURE_TENANT_ID #2274 fix because the AKS webhook always injects AZURE_CLIENT_ID alongside AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE.

[michielvha]

Hi @zunyangc thanks for the quick turnaround on this, really appreciate it !

i checked out the branch and ran the patched _get_env / _get_env_credentials against the exact env the AKS workload-identity webhook injects (AZURE_CLIENT_ID + AZURE_TENANT_ID + AZURE_FEDERATED_TOKEN_FILE, no AZURE_TENANT and no AZURE_SUBSCRIPTION_ID), passing the subscription the way an azure_rm.yml would. before the fix it returns None so auth fails, after the fix it resolves tenant from AZURE_TENANT_ID and merges the supplied subscription_id, so OIDC goes through.

the extra guard requiring client_id / ad_user before treating env as usable auth looks right too, the webhook always injects AZURE_CLIENT_ID so the WI path stays intact.

this is exactly what I needed downstream, I'd been bridging AZURE_TENANT_ID to AZURE_TENANT and can drop that once it's in a release. thanks again !