Hi @mostafa, hope you're doing well!
I've raised a PR to allow users to provide an optional scope field to SASLConfig, so we can override the OAuth scope requested for sasl_azure_entra. Currently the scope is always derived from the broker hostname (https://<broker-host>/.default), which doesn't work for setups where the token is tied to an Azure App ID, e.g. api://<app-id>/.default, rather than the broker's connection endpoint. As a result, auth fails with no workaround.
When scope is left empty, the existing hostname-derived behaviour is unchanged.
I've tested this against Azure with our own custom scope and confirmed it works. PR: #411
Hi @mostafa, hope you're doing well!
I've raised a PR to allow users to provide an optional
scopefield toSASLConfig, so we can override the OAuth scope requested forsasl_azure_entra. Currently the scope is always derived from the broker hostname (https://<broker-host>/.default), which doesn't work for setups where the token is tied to an Azure App ID, e.g.api://<app-id>/.default, rather than the broker's connection endpoint. As a result, auth fails with no workaround.When
scopeis left empty, the existing hostname-derived behaviour is unchanged.I've tested this against Azure with our own custom scope and confirmed it works. PR: #411