Skip to content

Commit 3701d1a

Browse files
dlucdluc
authored
Support Azure OpenAI on Sovereign clouds (#944)
Azure OpenAI SDK does not support changing token authority/audience via environment variables. Added new option for Azure OpenAI config, to allow setting the token audience. See: - https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/openai/Azure.AI.OpenAI/README.md - https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/openai/Azure.AI.OpenAI/src/Custom/AzureOpenAIAudience.cs See also #943
1 parent e8ac5fc commit 3701d1a

File tree

37 files changed

+642
-379
lines changed

37 files changed

+642
-379
lines changed

‎Directory.Build.props

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<Project>
33
<PropertyGroup>
44
<!-- Central version prefix - applies to all nuget packages. -->
5-
<Version>0.94.0</Version>
5+
<Version>0.95.0</Version>
66

77
<!-- C# lang version, https://learn.microsoft.com/dotnet/csharp/whats-new -->
88
<LangVersion>12</LangVersion>

‎applications/tests/Evaluation.Tests/appsettings.json

Lines changed: 32 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -14,27 +14,14 @@
1414
},
1515
"KernelMemory": {
1616
"Services": {
17-
"AzureOpenAIText": {
18-
// "ApiKey" or "AzureIdentity"
19-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
20-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
21-
"Auth": "AzureIdentity",
22-
"Endpoint": "https://<...>.openai.azure.com/",
23-
"APIKey": "",
24-
"Deployment": "",
25-
// The max number of tokens supported by model deployed
26-
// See https://learn.microsoft.com/azure/ai-services/openai/concepts/models
27-
"MaxTokenTotal": 16384,
28-
// "ChatCompletion" or "TextCompletion"
29-
"APIType": "ChatCompletion",
30-
// How many times to retry in case of throttling.
31-
"MaxRetries": 10
32-
},
3317
"AzureOpenAIEmbedding": {
3418
// "ApiKey" or "AzureIdentity"
35-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
36-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
19+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
20+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
3721
"Auth": "AzureIdentity",
22+
// When the service is on sovereign clouds the AZURE_AUTHORITY_HOST env var might not work,
23+
// in which case use this to change the client audience.
24+
"AzureOpenAIAudience": null,
3825
"Endpoint": "https://<...>.openai.azure.com/",
3926
"APIKey": "",
4027
"Deployment": "",
@@ -52,19 +39,42 @@
5239
// How many times to retry in case of throttling.
5340
"MaxRetries": 10
5441
},
42+
"AzureOpenAIText": {
43+
// "ApiKey" or "AzureIdentity"
44+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
45+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
46+
"Auth": "AzureIdentity",
47+
// When the service is on sovereign clouds the AZURE_AUTHORITY_HOST env var might not work,
48+
// in which case use this to change the client audience.
49+
"AzureOpenAIAudience": null,
50+
"Endpoint": "https://<...>.openai.azure.com/",
51+
"APIKey": "",
52+
"Deployment": "",
53+
// The max number of tokens supported by model deployed
54+
// See https://learn.microsoft.com/azure/ai-services/openai/concepts/models
55+
"MaxTokenTotal": 16384,
56+
// "ChatCompletion" or "TextCompletion"
57+
"APIType": "ChatCompletion",
58+
// How many times to retry in case of throttling.
59+
"MaxRetries": 10
60+
},
5561
"AzureAIDocIntel": {
5662
// "APIKey" or "AzureIdentity".
57-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
58-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
63+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
64+
// When the service is on sovereign clouds you can use the AZURE_AUTHORITY_HOST env var to
65+
// set the authority host. See https://learn.microsoft.com/dotnet/api/overview/azure/identity-readme
66+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
5967
"Auth": "AzureIdentity",
6068
// Required when Auth == APIKey
6169
"APIKey": "",
6270
"Endpoint": ""
6371
},
6472
"AzureAISearch": {
6573
// "ApiKey" or "AzureIdentity". For other options see <AzureAISearchConfig>.
66-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
67-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
74+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
75+
// When the service is on sovereign clouds you can use the AZURE_AUTHORITY_HOST env var to
76+
// set the authority host. See https://learn.microsoft.com/dotnet/api/overview/azure/identity-readme
77+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
6878
"Auth": "AzureIdentity",
6979
"Endpoint": "https://<...>",
7080
"APIKey": "",

‎examples/001-dotnet-WebClient/file9-settings.json

Lines changed: 25 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -14,32 +14,38 @@
1414
},
1515
"KernelMemory": {
1616
"Services": {
17-
"AzureOpenAIText": {
17+
"AzureOpenAIEmbedding": {
1818
// "ApiKey" or "AzureIdentity"
19-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
20-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
19+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
20+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
2121
"Auth": "AzureIdentity",
22+
// When the service is on sovereign clouds the AZURE_AUTHORITY_HOST env var might not work,
23+
// in which case use this to change the client audience.
24+
"AzureOpenAIAudience": null,
2225
"Endpoint": "https://<...>.openai.azure.com/",
2326
"APIKey": "",
2427
"Deployment": "",
2528
// The max number of tokens supported by model deployed
2629
// See https://learn.microsoft.com/en-us/azure/ai-services/openai/concepts/models
27-
"MaxTokenTotal": 16384,
28-
// "ChatCompletion" or "TextCompletion"
29-
"APIType": "ChatCompletion",
30-
"MaxRetries": 10
30+
"MaxTokenTotal": 8191
3131
},
32-
"AzureOpenAIEmbedding": {
32+
"AzureOpenAIText": {
3333
// "ApiKey" or "AzureIdentity"
34-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
35-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
34+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
35+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
3636
"Auth": "AzureIdentity",
37+
// When the service is on sovereign clouds the AZURE_AUTHORITY_HOST env var might not work,
38+
// in which case use this to change the client audience.
39+
"AzureOpenAIAudience": null,
3740
"Endpoint": "https://<...>.openai.azure.com/",
3841
"APIKey": "",
3942
"Deployment": "",
4043
// The max number of tokens supported by model deployed
4144
// See https://learn.microsoft.com/en-us/azure/ai-services/openai/concepts/models
42-
"MaxTokenTotal": 8191
45+
"MaxTokenTotal": 16384,
46+
// "ChatCompletion" or "TextCompletion"
47+
"APIType": "ChatCompletion",
48+
"MaxRetries": 10
4349
},
4450
"OpenAI": {
4551
// Name of the model used to generate text (text completion or chat completion)
@@ -84,17 +90,21 @@
8490
},
8591
"AzureAIDocIntel": {
8692
// "APIKey" or "AzureIdentity".
87-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
88-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
93+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
94+
// When the service is on sovereign clouds you can use the AZURE_AUTHORITY_HOST env var to
95+
// set the authority host. See https://learn.microsoft.com/dotnet/api/overview/azure/identity-readme
96+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
8997
"Auth": "AzureIdentity",
9098
// Required when Auth == APIKey
9199
"APIKey": "",
92100
"Endpoint": ""
93101
},
94102
"AzureAISearch": {
95103
// "ApiKey" or "AzureIdentity". For other options see <AzureAISearchConfig>.
96-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
97-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
104+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
105+
// When the service is on sovereign clouds you can use the AZURE_AUTHORITY_HOST env var to
106+
// set the authority host. See https://learn.microsoft.com/dotnet/api/overview/azure/identity-readme
107+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
98108
"Auth": "AzureIdentity",
99109
"Endpoint": "https://<...>",
100110
"APIKey": ""

‎examples/002-dotnet-Serverless/appsettings.json

Lines changed: 26 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,10 @@
33
"Services": {
44
"AzureAIContentSafety": {
55
// "ApiKey" or "AzureIdentity". For other options see <AzureAIContentSafetyConfig>.
6-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
7-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
6+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
7+
// When the service is on sovereign clouds you can use the AZURE_AUTHORITY_HOST env var to
8+
// set the authority host. See https://learn.microsoft.com/dotnet/api/overview/azure/identity-readme
9+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
810
"Auth": "AzureIdentity",
911
"Endpoint": "https://<...>",
1012
"APIKey": "",
@@ -13,17 +15,21 @@
1315
},
1416
"AzureAIDocIntel": {
1517
// "APIKey" or "AzureIdentity".
16-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
17-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
18+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
19+
// When the service is on sovereign clouds you can use the AZURE_AUTHORITY_HOST env var to
20+
// set the authority host. See https://learn.microsoft.com/dotnet/api/overview/azure/identity-readme
21+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
1822
"Auth": "AzureIdentity",
1923
// Required when Auth == APIKey
2024
"APIKey": "",
2125
"Endpoint": ""
2226
},
2327
"AzureAISearch": {
2428
// "ApiKey" or "AzureIdentity". For other options see <AzureAISearchConfig>.
25-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
26-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
29+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
30+
// When the service is on sovereign clouds you can use the AZURE_AUTHORITY_HOST env var to
31+
// set the authority host. See https://learn.microsoft.com/dotnet/api/overview/azure/identity-readme
32+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
2733
"Auth": "AzureIdentity",
2834
"Endpoint": "https://<...>",
2935
"APIKey": "",
@@ -44,8 +50,10 @@
4450
},
4551
"AzureBlobs": {
4652
// "ConnectionString" or "AzureIdentity". For other options see <AzureBlobConfig>.
47-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
48-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
53+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
54+
// When the service is on sovereign clouds you can use the AZURE_AUTHORITY_HOST env var to
55+
// set the authority host. See https://learn.microsoft.com/dotnet/api/overview/azure/identity-readme
56+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
4957
"Auth": "AzureIdentity",
5058
// Azure Storage account name, required when using AzureIdentity auth
5159
// Note: you can use an env var 'KernelMemory__Services__AzureBlobs__Account' to set this
@@ -60,9 +68,12 @@
6068
},
6169
"AzureOpenAIEmbedding": {
6270
// "ApiKey" or "AzureIdentity"
63-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
64-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
71+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
72+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
6573
"Auth": "AzureIdentity",
74+
// When the service is on sovereign clouds the AZURE_AUTHORITY_HOST env var might not work,
75+
// in which case use this to change the client audience.
76+
"AzureOpenAIAudience": null,
6677
"Endpoint": "https://<...>.openai.azure.com/",
6778
"APIKey": "",
6879
// Your Azure Deployment name
@@ -92,9 +103,12 @@
92103
},
93104
"AzureOpenAIText": {
94105
// "ApiKey" or "AzureIdentity"
95-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
96-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
106+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
107+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
97108
"Auth": "AzureIdentity",
109+
// When the service is on sovereign clouds the AZURE_AUTHORITY_HOST env var might not work,
110+
// in which case use this to change the client audience.
111+
"AzureOpenAIAudience": null,
98112
"Endpoint": "https://<...>.openai.azure.com/",
99113
"APIKey": "",
100114
"Deployment": "",

‎examples/002-dotnet-Serverless/file9-settings.json

Lines changed: 25 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -14,32 +14,38 @@
1414
},
1515
"KernelMemory": {
1616
"Services": {
17-
"AzureOpenAIText": {
17+
"AzureOpenAIEmbedding": {
1818
// "ApiKey" or "AzureIdentity"
19-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
20-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
19+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
20+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
2121
"Auth": "AzureIdentity",
22+
// When the service is on sovereign clouds the AZURE_AUTHORITY_HOST env var might not work,
23+
// in which case use this to change the client audience.
24+
"AzureOpenAIAudience": null,
2225
"Endpoint": "https://<...>.openai.azure.com/",
2326
"APIKey": "",
2427
"Deployment": "",
2528
// The max number of tokens supported by model deployed
2629
// See https://learn.microsoft.com/en-us/azure/ai-services/openai/concepts/models
27-
"MaxTokenTotal": 16384,
28-
// "ChatCompletion" or "TextCompletion"
29-
"APIType": "ChatCompletion",
30-
"MaxRetries": 10
30+
"MaxTokenTotal": 8191
3131
},
32-
"AzureOpenAIEmbedding": {
32+
"AzureOpenAIText": {
3333
// "ApiKey" or "AzureIdentity"
34-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
35-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
34+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
35+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
3636
"Auth": "AzureIdentity",
37+
// When the service is on sovereign clouds the AZURE_AUTHORITY_HOST env var might not work,
38+
// in which case use this to change the client audience.
39+
"AzureOpenAIAudience": null,
3740
"Endpoint": "https://<...>.openai.azure.com/",
3841
"APIKey": "",
3942
"Deployment": "",
4043
// The max number of tokens supported by model deployed
4144
// See https://learn.microsoft.com/en-us/azure/ai-services/openai/concepts/models
42-
"MaxTokenTotal": 8191
45+
"MaxTokenTotal": 16384,
46+
// "ChatCompletion" or "TextCompletion"
47+
"APIType": "ChatCompletion",
48+
"MaxRetries": 10
4349
},
4450
"OpenAI": {
4551
// Name of the model used to generate text (text completion or chat completion)
@@ -84,17 +90,21 @@
8490
},
8591
"AzureAIDocIntel": {
8692
// "APIKey" or "AzureIdentity".
87-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
88-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
93+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
94+
// When the service is on sovereign clouds you can use the AZURE_AUTHORITY_HOST env var to
95+
// set the authority host. See https://learn.microsoft.com/dotnet/api/overview/azure/identity-readme
96+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
8997
"Auth": "AzureIdentity",
9098
// Required when Auth == APIKey
9199
"APIKey": "",
92100
"Endpoint": ""
93101
},
94102
"AzureAISearch": {
95103
// "ApiKey" or "AzureIdentity". For other options see <AzureAISearchConfig>.
96-
// AzureIdentity: use automatic AAD authentication mechanism. You can test locally
97-
// using the env vars AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET.
104+
// AzureIdentity: use automatic Entra (AAD) authentication mechanism.
105+
// When the service is on sovereign clouds you can use the AZURE_AUTHORITY_HOST env var to
106+
// set the authority host. See https://learn.microsoft.com/dotnet/api/overview/azure/identity-readme
107+
// You can test locally using the AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars.
98108
"Auth": "AzureIdentity",
99109
"Endpoint": "https://<...>",
100110
"APIKey": ""

0 commit comments

Comments
 (0)