add custom headers for MSI authorizer

sdk/auth/auth.go

@@ -137,6 +137,7 @@ func NewAuthorizerFromCredentials(ctx context.Context, c Credentials, api enviro
 			ClientId:                        c.ClientID,
 			CustomManagedIdentityEndpoint:   c.CustomManagedIdentityEndpoint,
 			CustomManagedIdentityAPIVersion: c.CustomManagedIdentityAPIVersion,
+			CustomManagedIdentityHeaders:    c.CustomManagedIdentityHeaders,
 		}
 		a, err := NewManagedIdentityAuthorizer(ctx, opts)
 		if err != nil {

sdk/auth/config.go

@@ -49,6 +49,9 @@ type Credentials struct {
 	// CustomManagedIdentityAPIVersion specifies the API version to use for IMDS.
 	CustomManagedIdentityAPIVersion string
 
+	// CustomManagedIdentityHeaders specifies the headers when requesting token
+	CustomManagedIdentityHeaders map[string][]string
+
 	// Enables OIDC authentication (federated client credentials).
 	EnableAuthenticationUsingOIDC bool
 	// OIDCAssertionToken specifies the OIDC Assertion Token to authenticate using Client Credentials.

sdk/auth/managed_identity_authorizer.go

@@ -32,6 +32,10 @@ type ManagedIdentityAuthorizerOptions struct {
 	// CustomManagedIdentityAPIVersion is an optional API version to use when requesting a token.
 	// This is required when using an endpoint that does not support the default API version such as Azure Container Apps.
 	CustomManagedIdentityAPIVersion string
+
+	// CustomManagedIdentityHeaders are optional HTTP headers to use when requesting a token
+	// This is required when requesting from Azure Container App or Service Fabric.
+	CustomManagedIdentityHeaders map[string][]string
 }
 
 // NewManagedIdentityAuthorizer returns an authorizer using a Managed Identity for authentication.
@@ -40,7 +44,7 @@ func NewManagedIdentityAuthorizer(ctx context.Context, options ManagedIdentityAu
 	if err != nil {
 		return nil, fmt.Errorf("determining resource for api %q: %+v", options.Api.Name(), err)
 	}
-	conf, err := newManagedIdentityConfig(*resource, options.ClientId, options.CustomManagedIdentityEndpoint, options.CustomManagedIdentityAPIVersion)
+	conf, err := newManagedIdentityConfig(*resource, options.ClientId, options.CustomManagedIdentityEndpoint, options.CustomManagedIdentityAPIVersion, options.CustomManagedIdentityHeaders)
 	if err != nil {
 		return nil, err
 	}
@@ -76,7 +80,7 @@ func (a *ManagedIdentityAuthorizer) Token(ctx context.Context, _ *http.Request)
 
 	u := fmt.Sprintf("%s?%s", a.conf.MsiEndpoint, query.Encode())
 
-	body, err := azureMetadata(ctx, u)
+	body, err := azureMetadata(ctx, u, a.conf.MsiHeaders)
 	if err != nil {
 		return nil, fmt.Errorf("ManagedIdentityAuthorizer: failed to request token from metadata endpoint: %v", err)
 	}
@@ -133,13 +137,16 @@ type managedIdentityConfig struct {
 	// MsiEndpoint is the endpoint where the metadata service can be found
 	MsiEndpoint string
 
+	// MsiHeaders are headers to add when requesting a token from the metadata service
+	MsiHeaders map[string][]string
+
 	// Resource is the service for which to request an access token
 	Resource string
 }
 
 // newManagedIdentityConfig returns a new managedIdentityConfig with a configured metadata endpoint and resource.
 // clientId and objectId can be left blank when a single managed identity is available
-func newManagedIdentityConfig(resource, clientId, customManagedIdentityEndpoint string, customManagedIdentityAPIVersion string) (*managedIdentityConfig, error) {
+func newManagedIdentityConfig(resource, clientId, customManagedIdentityEndpoint string, customManagedIdentityAPIVersion string, customManagedIdentityHeaders map[string][]string) (*managedIdentityConfig, error) {
 	endpoint := msiDefaultEndpoint
 	if customManagedIdentityEndpoint != "" {
 		endpoint = customManagedIdentityEndpoint
@@ -155,6 +162,7 @@ func newManagedIdentityConfig(resource, clientId, customManagedIdentityEndpoint
 		Resource:      resource,
 		MsiApiVersion: apiVersion,
 		MsiEndpoint:   endpoint,
+		MsiHeaders:    customManagedIdentityHeaders,
 	}, nil
 }
 
@@ -165,14 +173,22 @@ func (c *managedIdentityConfig) TokenSource(_ context.Context) (Authorizer, erro
 	})
 }
 
-func azureMetadata(ctx context.Context, url string) (body []byte, err error) {
+func azureMetadata(ctx context.Context, url string, headers map[string][]string) (body []byte, err error) {
 	var req *http.Request
 	req, err = http.NewRequestWithContext(ctx, http.MethodGet, url, http.NoBody)
 	if err != nil {
 		return
 	}
-	req.Header = http.Header{
-		"Metadata": []string{"true"},
+
+	if headers != nil {
+		if _, ok := headers["Metadata"]; !ok {
+			headers["Metadata"] = []string{"true"}
+		}
+		req.Header = headers
+	} else {
+		req.Header = http.Header{
+			"Metadata": []string{"true"},
+		}
 	}
 
 	var resp *http.Response