Azure Auth support
What variant of Codex are you using?
MCPServer, CLI
What feature would you like to see?
Hi Codex team,
Thank you for the great work on the Codex agent in Rust. This is a very useful effort.
We have been experimenting with the Rust Codex agent from this repo, and it has been working well so far. I would like to contribute several improvements to Codex.
For this pull request, I would like to add support for Azure auth in Codex, including:
1) Developer credentials, so developers can authenticate when running locally.
2) Managed Identity and Workload Identity credentials.
3) Credential caching and renewal.
4) Other optional credential modes.
By depending on the azure_core and azure_identity crates, we should be able to support most of this with minimal custom implementation, it will integrate smoothly with existing Codex auth model.
Thank you,
Oleksii
Additional information
_No response_
5 Comments
@etraut-openai,
This is a different integration from the one flagged as a duplicate. We are not proposing the ADO integration here.
The linked feature request neither mentions support for ManagedIdentity nor WorkloadIdentity.
Could you please re-visit?
Yes, I linked the wrong one. I think this overlaps #8732. If you agree, let's close this one because #8732 already has some upvotes. We generally prioritize features based on upvotes.
There is some overlap, but this is still not completely what we need.
Solving this issue will also resolve https://github.com/openai/codex/issues/8732 and partially resolve https://github.com/openai/codex/issues/10665, because all Azure auth methods will be supported.
Unfortunately, we will not be able to benefit from the CLI authentication solution proposed in https://github.com/openai/codex/issues/8732 via custom model providers. The main problem is that we run Codex as an MCP server in a secure Kubernetes pod/container, and we need to use Workload Identity, which is not a CLI concern.
I would be happy to share more details and open a PR for review. We have been running this custom auth implementation on a Codex fork, so it's validated in prod. Other customers would benefit from this as well.
We generally don't accept external PRs for reasons explained here. As I mentioned, we prioritize our work based on community input (upvotes). We have several hundred feature requests, so we need to focus on those that impact the most users.
My recommendation is for you to add your requirements to the other (overlapping) feature request and close this one. That way, you'll inherit the upvotes of the other one. If you'd prefer to keep this one open, that's fine too, but it makes it less likely that this will get enough upvotes. I regularly close feature requests that don't receive enough upvotes in one or two months.
The issue https://github.com/openai/codex/issues/8732 was closed based on proposal to use a proxy for auth.
I do not believe that changing architecture (e.g. using proxy) only for the sake of using codex is a good solution for everybody.
We still need full Azure Auth support.