Support `AzurePipelinesCredential` in Azure Event Hubs for Kafka passwordless connection by rujche · Pull Request #49108 · Azure/azure-sdk-for-java

rujche · 2026-05-08T05:32:26Z

Description

This pull request adds support for using AzurePipelinesCredential to enable passwordless authentication for Azure Event Hubs via Kafka when running in Azure Pipelines. The implementation detects specific Azure DevOps environment variables and, if present, chains the new credential with the existing DefaultAzureCredential. The changes also include a new integration test to verify this behavior and update the changelog accordingly.

Azure Pipelines Credential Support for Kafka Event Hubs

Added support for AzurePipelinesCredential in the KafkaOAuth2AuthenticateCallbackHandler to allow passwordless authentication for Azure Event Hubs for Kafka when running in Azure Pipelines. The credential is used only if all required environment variables are present; otherwise, the system falls back to DefaultAzureCredential. The authority host is set based on the current Azure environment for correct cloud targeting. [1] [2] [3] [4]

Testing Enhancements

Added a test (testCreateChainedTokenCredentialWhenAzurePipelinesEnvVarsPresent) to verify that a ChainedTokenCredential is created when all Azure Pipelines environment variables are set, ensuring the new credential logic is exercised and isolated per test run. [1] [2] [3]

Documentation Updates

Updated the changelog to document the new feature, including the required environment variables and a link to the relevant pull request for more details.

Integration Test Activation

Enabled the EventHubsKafkaBinderOAuthIT integration test, which was previously disabled, to allow validation of OAuth scenarios in CI/CD pipelines. [1] [2]

** Related PR** : #47176

All SDK Contribution checklist:

The pull request does not introduce [breaking changes]
CHANGELOG is updated for new features, bug fixes or other significant changes.
I have read the contribution guidelines.

General Guidelines and Best Practices

Title of the pull request is clear and informative.
There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

Pull request includes test coverage for the included changes.

rujche · 2026-05-08T05:33:58Z

/azp run java - spring - tests

azure-pipelines · 2026-05-08T05:34:26Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

This pull request enables the EventHubsKafkaBinderOAuthIT Spring Cloud Azure integration test so it runs as part of the Event Hubs IT suite (when -DskipSpringITs=false is used in CI), aligning with the intent to validate Event Hubs Kafka OAuth scenarios end-to-end.

Changes:

Removed the @Disabled annotation from EventHubsKafkaBinderOAuthIT.
Removed the now-unused Disabled import.

rujche · 2026-05-14T05:30:33Z

/azp run java - spring - tests

azure-pipelines · 2026-05-14T05:31:02Z

Azure Pipelines successfully started running 1 pipeline(s).

rujche · 2026-05-14T06:06:28Z

/azp run java - spring - tests

azure-pipelines · 2026-05-14T06:06:54Z

Azure Pipelines successfully started running 1 pipeline(s).

Revert the kafka-clients 3.8.1 override (incompatible with spring-kafka 4.x, caused VerifyError in EventHubsKafkaBinderConnectionStringIT) and instead disable the Spring Cloud Stream Kafka binder's topic auto-creation and admin-based health check. Azure Event Hubs for Kafka does not support the Kafka AdminClient API, so the binder must not create one against the Event Hubs endpoint.

rujche · 2026-05-14T07:06:40Z

/azp run java - spring - tests

azure-pipelines · 2026-05-14T07:07:08Z

Azure Pipelines successfully started running 1 pipeline(s).

rujche · 2026-05-14T08:46:08Z

/azp run java - spring - tests

azure-pipelines · 2026-05-14T08:46:35Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

In sovereign clouds (Azure China, US Gov) DefaultAzureCredentialBuilderFactory configures profile.environment.activeDirectoryEndpoint, but the newly added AzurePipelinesCredentialBuilder was created without it and defaulted to the public-cloud authority. Since ChainedTokenCredential only falls through on CredentialUnavailableException, a wrong-authority failure would block the DefaultAzureCredential fallback. Pass AzureProperties into the builder and apply authorityHost when available.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (1)

sdk/spring/spring-cloud-azure-service/src/main/java/com/azure/spring/cloud/service/implementation/kafka/KafkaOAuth2AuthenticateCallbackHandler.java:185

This AzurePipelinesCredentialBuilder is created directly, so unlike the DefaultAzureCredentialBuilderFactory path it does not receive the AzureProperties HTTP client, proxy, logging, retry, or custom pipeline settings. In environments that require those Spring-configured settings (for example an outbound proxy), the Azure Pipelines credential can fail before the configured default credential is usable. Apply the same common credential builder configuration to this builder as the default credential path.

                AzurePipelinesCredentialBuilder builder = new AzurePipelinesCredentialBuilder()
                    .systemAccessToken(systemAccessToken)
                    .clientId(clientId)
                    .tenantId(tenantId)
                    .serviceConnectionId(serviceConnectionId);
                String authorityHost = resolveAuthorityHost(properties);
                if (!isNullOrEmpty(authorityHost)) {
                    builder.authorityHost(authorityHost);

… credential test

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

rujche · 2026-05-15T05:36:13Z

/azp run java - spring - tests

azure-pipelines · 2026-05-15T05:36:40Z

Azure Pipelines successfully started running 1 pipeline(s).

Netyyyy

LGTM.

Try to enable EventHubsKafkaBinderOAuthIT

602a36a

Copilot AI review requested due to automatic review settings May 8, 2026 05:32

rujche requested review from a team, Netyyyy, moarychan and saragluna as code owners May 8, 2026 05:32

github-actions Bot added the azure-spring All azure-spring related issues label May 8, 2026

rujche self-assigned this May 8, 2026

rujche added the azure-spring-eventhubs-kafka Spring event hubs kafka related issues. label May 8, 2026

rujche added this to Spring Cloud Azure May 8, 2026

rujche added this to the 2026-06 milestone May 8, 2026

github-project-automation Bot moved this to Todo in Spring Cloud Azure May 8, 2026

rujche moved this from Todo to In Progress in Spring Cloud Azure May 8, 2026

Copilot started reviewing on behalf of rujche May 8, 2026 05:33 View session

Copilot AI reviewed May 8, 2026

View reviewed changes

Fix Event Hubs Kafka OAuth test compatibility

a597bd9

rujche requested review from JonathanGiles, alzimmermsft, g2vinay and samvaity as code owners May 14, 2026 05:30

Tune Event Hubs Kafka OAuth test compatibility

09f66f4

rujche requested a review from Copilot May 14, 2026 09:28

Copilot started reviewing on behalf of rujche May 14, 2026 09:30 View session

rujche changed the title ~~Try to enable EventHubsKafkaBinderOAuthIT~~ Enable EventHubsKafkaBinderOAuthIT, update KafkaOAuth2AuthenticateCallbackHandler to make test pass May 14, 2026

rujche changed the title ~~Enable EventHubsKafkaBinderOAuthIT, update KafkaOAuth2AuthenticateCallbackHandler to make test pass~~ Enable EventHubsKafkaBinderOAuthIT, update KafkaOAuth2AuthenticateCallbackHandler to make test pass May 14, 2026

Copilot AI reviewed May 14, 2026

View reviewed changes

rujche changed the title ~~Enable EventHubsKafkaBinderOAuthIT, update KafkaOAuth2AuthenticateCallbackHandler to make test pass~~ Support AzurePipelinesCredential in Azure Event Hubs for Kafka passwordless connection May 15, 2026

rujche added 3 commits May 15, 2026 10:03

Update changelog for AzurePipelinesCredential support

cb0dca5

Add unit test for AzurePipelinesCredential fallback

43e784b

rujche requested a review from Copilot May 15, 2026 02:09

Copilot started reviewing on behalf of rujche May 15, 2026 02:13 View session

Copilot AI reviewed May 15, 2026

View reviewed changes

rujche added 2 commits May 15, 2026 10:36

Set SYSTEM_OIDCREQUESTURI and isolate global Configuration in chained…

efe72ab

… credential test

Clarify tryBuildAzurePipelinesCredential Javadoc about build() failures

2efe847

rujche requested review from Copilot and removed request for Copilot May 15, 2026 02:41

Copilot started reviewing on behalf of rujche May 15, 2026 05:30 View session

Copilot AI reviewed May 15, 2026

View reviewed changes

Netyyyy approved these changes May 18, 2026

View reviewed changes

rujche merged commit fbd36dc into main May 18, 2026
96 of 97 checks passed

rujche deleted the rujche/main/try-to-enable-EventHubsKafkaBinderOAuthIT branch May 18, 2026 05:45

github-project-automation Bot moved this from In Progress to Done in Spring Cloud Azure May 18, 2026

Conversation

rujche commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

All SDK Contribution checklist:

General Guidelines and Best Practices

Testing Guidelines

Uh oh!

rujche commented May 8, 2026

Uh oh!

azure-pipelines Bot commented May 8, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

rujche commented May 14, 2026

Uh oh!

azure-pipelines Bot commented May 14, 2026

Uh oh!

rujche commented May 14, 2026

Uh oh!

azure-pipelines Bot commented May 14, 2026

Uh oh!

rujche commented May 14, 2026

Uh oh!

azure-pipelines Bot commented May 14, 2026

Uh oh!

rujche commented May 14, 2026

Uh oh!

azure-pipelines Bot commented May 14, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

rujche commented May 15, 2026

Uh oh!

azure-pipelines Bot commented May 15, 2026

Uh oh!

Netyyyy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rujche commented May 8, 2026 •

edited

Loading