vibedata-studio-azure-cred-broker

An Azure TokenCredential that mints downstream Azure / Microsoft Fabric tokens through the VibeData Studio credential broker.

Inside a Studio agent container the backend writes an intent-scoped bearer (vd_iat_*) to a tmpfs file. StudioAzureCredBroker reads that bearer and exchanges it at the broker's POST /token endpoint for a short-lived, audience-bound Azure access token (Fabric SQL, OneLake storage, Key Vault, Fabric API, ARM). The downstream credential is only ever minted by Studio.

Works with anything that speaks the azure-core TokenCredential protocol:

• dbt-fabricspark (authentication: token_credential)
• dlt destinations (OneLake / ADLS)
• Key Vault SecretClient

How it resolves the broker

Broker context comes from the environment and is overridable via constructor kwargs:

The bearer is re-read on every get_token call (the backend rotates it). All four values are required — the credential raises before contacting the broker when any value is missing or invalid.

Scope → audience map

get_token(scope) maps the requested Azure scope to a broker audience:

An unmapped scope raises ScopeNotAllowedError. Override or extend via the audience_map kwarg.

dbt usage (profiles.yml)

my_project:
  outputs:
    ephemeral_dev:
      type: fabricspark
      method: livy
      authentication: token_credential
      credential_class: "vibedata_studio_azure_cred_broker.StudioAzureCredBroker"
      # No credential_kwargs needed — Studio injects the broker context.
      endpoint: https://api.fabric.microsoft.com/v1
      workspaceid: "{{ env_var('EPHEMERAL_WORKSPACE_ID') }}"
      lakehouseid: "{{ env_var('EPHEMERAL_LAKEHOUSE_ID') }}"
      lakehouse:   "{{ env_var('EPHEMERAL_LAKEHOUSE_NAME') }}"
      schema:      "{{ env_var('EPHEMERAL_SCHEMA') }}"
  target: ephemeral_dev

dlt / Key Vault usage

from azure.keyvault.secrets import SecretClient
from vibedata_studio_azure_cred_broker import StudioAzureCredBroker

client = SecretClient(vault_url=vault_url, credential=StudioAzureCredBroker())