vibedata-studio-azure-cred-broker

An Azure TokenCredential that mints downstream Azure / Microsoft Fabric tokens through the VibeData Studio credential broker.

Inside a Studio agent container the backend writes an intent-scoped bearer (vd_iat_*) to a tmpfs file. StudioAzureCredBroker reads that bearer and exchanges it at the broker's POST /token endpoint for a short-lived, audience-bound Azure access token (Fabric SQL, OneLake storage, Key Vault, Fabric API, ARM). The downstream credential is only ever minted by Studio.

Works with anything that speaks the azure-core TokenCredential protocol:

• dbt-fabricspark (authentication: token_credential)
• dlt destinations (OneLake / ADLS)
• Key Vault SecretClient

How it resolves the broker

Broker context comes from the environment and is overridable via constructor kwargs:

The bearer is re-read on every get_token call (the backend rotates it).

The broker URL and credential file are always required and are checked when the credential is constructed. The lane and configuration revision are checked when a token is requested. Every persisted Data Platform or Secret Store mint sends its explicit scope, lane, and pinned revision; a missing or invalid value raises before the broker is contacted.

Scope → audience map

get_token(scope) maps the requested Azure scope to a broker audience:

An unmapped scope raises ScopeNotAllowedError. Override or extend via the audience_map kwarg. The dlt Key Vault provider overrides the vault resource with the Secret Store capability key_vault_data_plane; the default vault mapping is the Data Platform capability and is not a compatibility alias.

dbt usage (profiles.yml)

my_project:
  outputs:
    ephemeral_dev:
      type: fabricspark
      method: livy
      authentication: token_credential
      credential_class: "vibedata_studio_azure_cred_broker.StudioAzureCredBroker"
      # No credential_kwargs needed — Studio injects the broker context.
      endpoint: https://api.fabric.microsoft.com/v1
      workspaceid: "{{ env_var('EPHEMERAL_WORKSPACE_ID') }}"
      lakehouseid: "{{ env_var('EPHEMERAL_LAKEHOUSE_ID') }}"
      lakehouse:   "{{ env_var('EPHEMERAL_LAKEHOUSE_NAME') }}"
      schema:      "{{ env_var('EPHEMERAL_SCHEMA') }}"
  target: ephemeral_dev

dlt / Key Vault usage

from azure.keyvault.secrets import SecretClient
from vibedata_studio_azure_cred_broker import StudioAzureCredBroker

client = SecretClient(
    vault_url=vault_url,
    credential=StudioAzureCredBroker(
        audience_map={"https://vault.azure.net": "key_vault_data_plane"}
    ),
)