[Feature Request] Allow Service principle login using a certificate for PowerShell

[gadelkareem]

I could not find this command in the code so I guess it is not implemented https://learn.microsoft.com/en-us/powershell/module/az.accounts/connect-azaccount?view=azps-9.7.1#example-9-connect-using-certificate-file

[YanaXu]

Hi Gadelkareem (@gadelkareem) , yes, it's not implemented yet in Azure Login Action. We'll add it to our plan.

[manivannan-p]

Hello Team/ Yan Xu (@YanaXu) , Do we have the capability to use certificate for authentication now?

[YanaXu]

Hello Team/ @YanaXu , Do we have the capability to use certificate for authentication now?

Hi Manivannan Palanisamy (@manivannan-p) , we did consider this login method, but the certificate login method is indeed not as secure as the OIDC login method. So I would like to ask, why would you like to choose the certificate instead of using the existing OIDC method?

[gadelkareem]

Hi Yan Xu (@YanaXu) , TBH, I don’t remember the exact use case for this anymore, but since the docs show it as an option, it’s natural to expect it to be implemented. If it’s truly unsupported, perhaps we should update or remove that part of the documentation to avoid confusion. Thanks!

[YanaXu]

Hi @YanaXu , TBH, I don’t remember the exact use case for this anymore, but since the docs show it as an option, it’s natural to expect it to be implemented. If it’s truly unsupported, perhaps we should update or remove that part of the documentation to avoid confusion. Thanks!

Hi Gadelkareem (@gadelkareem) , do you mean the guide of "Azure PowerShell"?
Azure PowerShell cmdlet Connect-AzAccount supports more login methods than Azure Login Action. However, TBH, Connect-AzAccount and Azure Login Action are suited for different login scenarios. Connect-AzAccount is designed for various environments, so it needs to support flexible and convenient login methods. On the other hand, Azure Login Action operates in an automated environment, mostly in public automation setups. Therefore, when adding login methods to Azure Login Action, we must carefully consider security issues. This is why we have not supported this login method, as from security recommendation perspective, it is better for users to use OIDC login methods in GitHub Actions.

[davidkarlsen]

It makes sense to use a cert in addition to static token/password - slightly more secure - and it is one of the login options.
OIDC is certainly preferable from a security perspective - but not always practically feasible - some GH flavours don't support flexible identity and then the overhead of using OIDC-based login becomes unmanageable. It's not limited/related to powershell though - it's an azure login - no more - no less.