Cosmos: Support AAD RBAC via the ClientSecretCredential

[JeremyLikness]

The Azure Cosmos DB SDK now supports role-based access control (RBAC) via Azure Active Directory (AAD) token credentials.

Instructions: Configure role-based access control for your Azure Cosmos DB account with Azure Active Directory

This more direct support should be recommended over resource tokens.

[jeanpaulsmit]

Great, I hope this will end up high on the priority list!
Not having to store the Cosmos db access keys somewhere, is the best security measure.

[surenderssm]

@ajcvickers - Any high level ETA on this?
We are on a mission of having Zero Secrets in our components by using Azure managed identity.
This is one of our blocker :( !!

[ajcvickers]

@surenderssm As the milestone indicates, this is currently planned for the next release; that is EF Core 7.0, which will be released next November.

[surenderssm]

@ajcvickers - Thank you for the update.
Are there any interim reliable solutions which can help us on this front?

[ajcvickers]

/cc @JeremyLikness

[dmitriyi-affinity]

EF Core and CosmosDb provider are pretty extensible.
Yes now passthrough TokenCredential to the underlying CosmosClient is not supported, but it possible to override ISingletonCosmosClientWrapper and CosmosOptionsExtension to extended/patched versions and add support yourself.