973 Enhanced Citations Managed Identity Authentication Fix 8c45c6c5

Enhanced Citations Managed Identity Authentication Fix

Version Implemented: 0.229.001

Problem Description

The Enhanced Citations Storage Account configuration only supported connection string authentication, limiting deployment flexibility and security options. Additionally, several authentication and client initialization issues existed across Azure services when using Managed Identity in sovereign cloud environments.

New Feature - Enhanced Citations Managed Identity Support

Problem Statement

Enhanced Citations previously only supported connection string authentication for Azure Storage Account access, which:

• Required storing sensitive connection strings in configuration
• Limited security posture for enterprise deployments
• Prevented use of Azure RBAC for fine-grained access control

Solution Implemented

Added Managed Identity authentication option to Enhanced Citations Storage Account configuration:

New UI Features:

• Dropdown Selection: Authentication method selection between "Connection String" and "Managed Identity"
• Dynamic Form Fields: Form dynamically shows/hides relevant fields based on selected authentication method
• Validation Logic: Appropriate validation for each authentication method

Technical Implementation:

• Updated admin settings to include enhanced_citations_storage_authentication_type field
• Modified storage client initialization to support both authentication methods
• Added proper RBAC documentation for required permissions

Bug Fixes

1. Client Reinitialization on Settings Update

Issue: Clients were not reinitialized when admin settings were updated, requiring application restart to apply new authentication methods or service configurations.

Root Cause: Client instances were cached and not refreshed when settings changed.

Solution:

• Added code to reinitialize clients when admin settings are updated
• Enables changing authentication method of services without restarting application
• Addresses Issue #401

Files Modified:

• route_frontend_admin_settings.py - Added client reinitialization logic

2. Duplicate Logo Version Setting

Issue: Duplicate logo_version setting in line 389 of route_frontend_admin_settings.py causing configuration conflicts.

Solution: Removed duplicate setting declaration.

Files Modified:

• route_frontend_admin_settings.py - Line 389

3. Video Indexer Settings Validation Fix

Issue: Admin Settings Setup Walkthrough required API Key for Video Indexer, but the service now requires ARM authentication via Entra ID and no longer provides API Key authentication option.

Problem Details:

• Step 8 required Location, Account ID, and API Key to proceed
• Video Indexer service now mandates authentication via Entra ID/ARM
• Made completion impossible for new and recent deployments

Solution:

• Changed API Key to optional field
• Updated case statement logic to require Endpoint, Location, and Account ID
• All three fields are required for ARM-based client initialization

Files Modified:

• Admin Settings Setup Walkthrough validation logic

4. Sovereign Cloud Managed Identity Authentication Fixes

Issue: Document Intelligence, Content Safety, and AI Search client initialization failed when using Managed Identity in Government and custom cloud contexts.

Document Intelligence Fixes

Credential Scope Issue:

• Government/custom clouds require custom credential scope specification
• Government credential scope for Cognitive Services: https://cognitiveservices.azure.us/.default

API Version Issue:

• Current code used different packages based on authentication method
• azure-ai-documentintelligence package defaulted to 2023-07-30-preview API version
• Preview API version not available in Government cloud
• Solution: Standardized on 2024-11-30 GA API version for all authentication methods

Package Consistency:

• Unified to use DocumentIntelligenceClient for all clouds and authentication methods
• Updated to comply with latest GA API requirements (JSON/IO[bytes] format, no keyword arguments)

Content Safety Fixes

RBAC Issue:

• Cognitive Services Contributor role insufficient for Content Safety operations
• Missing required data action: Microsoft.CognitiveServices/accounts/ContentSafety/text:analyze/action

Solution:

• Updated RBAC requirements to use Azure AI Developer built-in role
• Provides necessary Microsoft.CognitiveServices/accounts/ContentSafety/* data actions

Credential Scope:

• Added Government cloud credential scope: https://cognitiveservices.azure.us/.default

AI Search Fixes

Authentication Issue:

• Required specific audience/resource manager for Government cloud: https://search.azure.us
• Updated client creation to specify proper audience for sovereign clouds

RBAC Requirements:

• App identity needs Contributor role on the service for ARM token acquisition
• App identity needs Search Index Data Contributor role for index operations

Connection Test Fix:

• _test_azure_ai_search_connection function incorrectly created ContentSafety client
• Updated to create proper Search client for connection testing

Technical Details

Files Modified

• route_frontend_admin_settings.py - Client reinitialization, duplicate setting removal, dropdown UI
• Admin Settings UI templates - Dynamic form rendering based on authentication method
• Document Intelligence client initialization - API version and package standardization
• Content Safety client initialization - Credential scope and RBAC updates
• AI Search client initialization - Audience specification and connection testing
• Setup Walkthrough validation - Video Indexer API Key optional logic

Authentication Method Support

• Connection String: Traditional connection string authentication (existing)
• Managed Identity: Azure RBAC-based authentication (new)

RBAC Requirements Updated

• Enhanced Citations Storage: Storage Blob Data Contributor
• Document Intelligence: Cognitive Services User (with custom credential scope in sovereign clouds)
• Content Safety: Azure AI Developer (updated from Cognitive Services Contributor)
• AI Search: Contributor + Search Index Data Contributor
• Video Indexer: Video Indexer Contributor (documentation updated)

Sovereign Cloud Support

• Government Cloud: Custom credential scopes and audiences implemented
• Custom Cloud: Extensible credential scope configuration
• Commercial Cloud: Maintains existing functionality

Validation

Testing Performed

• Verified Enhanced Citations works with both authentication methods
• Confirmed client reinitialization without application restart
• Validated Video Indexer setup walkthrough completion
• Tested sovereign cloud authentication for all affected services
• Verified RBAC permissions in Government cloud environment

Before/After Comparison

• Before: Connection string authentication only, required app restart for setting changes
• After: Choice of authentication methods, dynamic client reinitialization, sovereign cloud support

Benefits

1. Enhanced Security: Managed Identity eliminates stored secrets for storage authentication
2. Operational Flexibility: Authentication method changes without application restart
3. Sovereign Cloud Support: Proper authentication in Government and custom clouds
4. Simplified Setup: Video Indexer walkthrough matches current service requirements
5. Consistent Experience: Unified authentication patterns across all services

Migration Notes

• Existing Enhanced Citations configurations continue to work unchanged
• New deployments can choose optimal authentication method
• Sovereign cloud deployments now properly support Managed Identity authentication
• Video Indexer setup now aligns with current ARM authentication requirements