Seamlessly Integrate Azure OpenAI with EntraID: A Guide to Using Azure SDK and Azure APIM

A Guide to Using Azure SDK and Interactive Browser Credential with EntraID

import os
from azure.identity import InteractiveBrowserCredential, get_bearer_token_provider
from openai import AzureOpenAI

# Load environment variables (if using a .env file)
from dotenv import load_dotenv
load_dotenv()

# Retrieve environment variables
api_version = os.getenv("API_VERSION", "2024-07-01-preview")
endpoint = os.getenv("AZURE_OPENAI_ENDPOINT")


# Set up token provider
token_provider = get_bearer_token_provider(
    InteractiveBrowserCredential(),
    "https://cognitiveservices.azure.com/.default"
)

# Initialize AzureOpenAI client
client = AzureOpenAI(
    api_version=api_version,
    azure_endpoint=endpoint,
    azure_ad_token_provider=token_provider,
)

# Create a chat completion request
response = client.chat.completions.create(
    model="gpt-4o",  # model = "deployment_name".
    messages=[
        {"role": "system", "content": "Assistant is a large language model trained by OpenAI."},
        {"role": "user", "content": "Who were the founders of Microsoft?"}
    ]
)

# Print the response
print(response.model_dump_json(indent=2))
print(response.choices.message.content)

Code Explanation

Importing Modules

import os
from azure.identity import InteractiveBrowserCredential, get_bearer_token_provider
from openai import AzureOpenAI

• os: Used for accessing environment variables.
• azure.identity: Provides authentication methods for Azure.
• openai: The Azure OpenAI client library.

Loading Environment Variables

from dotenv import load_dotenv
load_dotenv()

• dotenv: Loads environment variables from a .env file into the environment.

Retrieving Environment Variables

api_version = os.getenv("API_VERSION", "2024-07-01-preview")
endpoint = os.getenv("AZURE_OPENAI_ENDPOINT")

· os.getenv: Retrieves the value of environment variables. If API_VERSION is not set, it defaults to “2024–07–01-preview”.

Setting Up Token Provider

token_provider = get_bearer_token_provider(
    InteractiveBrowserCredential(),
    "https://cognitiveservices.azure.com/.default"
)

· InteractiveBrowserCredential: Allows users to authenticate via a web browser.

• get_bearer_token_provider: Retrieves a token provider for Azure AD authentication.

Initializing AzureOpenAI Client

client = AzureOpenAI(
    api_version=api_version,
    azure_endpoint=endpoint,
    azure_ad_token_provider=token_provider,
)

• AzureOpenAI: Initializes the client with the specified API version, endpoint, and token provider.

Creating a Chat Completion Request

response = client.chat.completions.create(
    model="gpt-4o",  # model = "deployment_name".
    messages=[
        {"role": "system", "content": "Assistant is a large language model trained by OpenAI."},
        {"role": "user", "content": "Who were the founders of Microsoft?"}
    ]
)

client.chat.completions.create: Sends a request to the Azure OpenAI service to generate a chat completion.

• model: Specifies the model to use.
• messages: A list of messages to provide context for the chat completion.

Printing the Response

print(response.model_dump_json(indent=2))
print(response.choices.message.content)

• response.model_dump_json: Prints the response in a formatted JSON structure.
• response.choices.message.content: Prints the content of the first message in the response.

This code sets up an Azure OpenAI client, sends a chat completion request, and prints the response. It uses environment variables to manage sensitive information securely.

If you face with error due to ssl verification or VPN

You can use the default HTTP client provided by the Azure SDK and configure SSL settings directly

Using Azure SDK’s Default HTTP Client adding SSL Path

The Azure SDK uses requests under the hood, which allows you to configure SSL settings. You can set the REQUESTS_CA_BUNDLE environment variable to specify the path to your SSL certificate.

import os
from azure.identity import InteractiveBrowserCredential, get_bearer_token_provider
from openai import AzureOpenAI

# Load environment variables (if using a .env file)
from dotenv import load_dotenv
load_dotenv()

# Retrieve environment variables
api_version = os.getenv("API_VERSION", "2024-07-01-preview")
endpoint = os.getenv("AZURE_OPENAI_ENDPOINT")
ssl_cert_path = os.getenv("SSL_CERT_PATH")  # Add this line to get the SSL certificate path

# Set the SSL certificate path for requests
os.environ['REQUESTS_CA_BUNDLE'] = ssl_cert_path

# Set up token provider
token_provider = get_bearer_token_provider(
    InteractiveBrowserCredential(),
    "https://cognitiveservices.azure.com/.default"
)

# Initialize AzureOpenAI client
client = AzureOpenAI(
    api_version=api_version,
    azure_endpoint=endpoint,
    azure_ad_token_provider=token_provider,
)

# Create a chat completion request
response = client.chat.completions.create(
    model="gpt-4o",  # model = "deployment_name".
    messages=[
        {"role": "system", "content": "Assistant is a large language model trained by OpenAI."},
        {"role": "user", "content": "Who were the founders of Microsoft?"}
    ]
)

# Print the response
print(response.model_dump_json(indent=2))
print(response.choices.message.content)

Explanation

Add SSL Certificate Path Environment Variable:

• Ensure you have an environment variable for the SSL certificate path, e.g., SSL_CERT_PATH.
• You can set this in your .env file or system environment variables:
• SSL_CERT_PATH=/path/to/your/certificate.pem

Set SSL Certificate Path for Requests:

• Set the REQUESTS_CA_BUNDLE environment variable to the path of your SSL certificate:

Python

os.environ[‘REQUESTS_CA_BUNDLE’] = ssl_cert_path

This approach leverages the default HTTP client used by the Azure SDK and configures SSL verification without needing an additional HTTP client

Using Azure SDK with SSL Verification Disabled

Security Note

Disabling SSL verification (verify=False) can expose your application to man-in-the-middle attacks. It’s recommended to use this approach only for development or troubleshooting purposes. For production, ensure proper SSL certificates are in place.

import os
from azure.identity import InteractiveBrowserCredential, get_bearer_token_provider
from openai import AzureOpenAI
from azure.core.pipeline.transport import RequestsTransport

# Load environment variables (if using a .env file)
from dotenv import load_dotenv
load_dotenv()

# Retrieve environment variables
api_version = os.getenv("API_VERSION", "2024-07-01-preview")
endpoint = os.getenv("AZURE_OPENAI_ENDPOINT")

# Set up token provider
token_provider = get_bearer_token_provider(
    InteractiveBrowserCredential(),
    "https://cognitiveservices.azure.com/.default"
)

# Create a custom transport with SSL verification disabled
transport = RequestsTransport(verify=False)

# Initialize AzureOpenAI client with custom transport
client = AzureOpenAI(
    api_version=api_version,
    azure_endpoint=endpoint,
    azure_ad_token_provider=token_provider,
    transport=transport
)

# Create a chat completion request
response = client.chat.completions.create(
    model="gpt-4o",  # model = "deployment_name".
    messages=[
        {"role": "system", "content": "Assistant is a large language model trained by OpenAI."},
        {"role": "user", "content": "Who were the founders of Microsoft?"}
    ]
)

# Print the response
print(response.model_dump_json(indent=2))
print(response.choices.message.content)

Explanation

Custom Transport:

• Use RequestsTransport from azure.core.pipeline.transport and set verify=False to disable SSL verification.

Initialize AzureOpenAI Client:

• Pass the custom transport to the AzureOpenAI client using the transport parameter.

This approach leverages the Azure SDK’s built-in capabilities to manage SSL settings, making it straightforward and integrated. Remember, disabling SSL verification should only be done for development or troubleshooting purposes and not in a production environment to maintain security.

Interacting with Azure OpenAI with GenAI Gateway Capabilities by APIM

This Jupyter Notebook demonstrates how to connect to Azure OpenAI’s API through the APIM endpoint using Azure Active Directory for authentication. It includes generating a chat completion response based on a prompt.

Requirements

Before running this notebook, ensure that the following Python libraries are installed:

pip install openai azure-identity

In [1]:

#### Import Libraries and Set Up Authentication
#### In this section, we import necessary libraries, set up the Azure AD authentication, and connect to the Azure OpenAI endpoint.
# import necessary libraries
from openai import AzureOpenAI
from azure.identity import InteractiveBrowserCredential, get_bearer_token_provider
# set up Azure AD token provider
token_provider = get_bearer_token_provider(
    InteractiveBrowserCredential(),
    "https://cognitiveservices.azure.com/.default"
)
# initialize AzureOpenAI client
client = AzureOpenAI(
    azure_endpoint="https://azapimdev.yourdomain.com/youropenaiapi/v2",
    azure_ad_token_provider=token_provider,
    api_version="2024-05-01-preview"
)

Explanation:

• InteractiveBrowserCredential(): Prompts an interactive login for the user, ensuring a secure token generation.
• get_bearer_token_provider(): Used to obtain the bearer token, required for Azure OpenAI.
• AzureOpenAI: Connects to the Azure OpenAI service, using the specified APIM URL and API version.

In [5]:

#### Generate Chat Completion
#### In this section, we send a message related to your project and generate a response.
APIM_SUBSCRIPTION_KEY = "insert your APIM subcription key here"
# generate a chat completion response
response = client.chat.completions.create(
    model="gpt-35-turbo-16k",
    messages=[
        {"role": "system", "content": "You are an AI assistant helping with your projects."},
        {"role": "user", "content": "What are some challenges to achieving financial inclusion? ."}
    ],
    extra_headers={'api-key': APIM_SUBSCRIPTION_KEY}
    # extra_headers={'api-key': "insert APIM subscription key"}
)
# print the response
print(response.choices[0].message.content)

Achieving financial inclusion faces several challenges: ...

Explanation:

• Model: We use the gpt-35-turbo-16k model for generating responses.
• Extra Headers: The APIM subscription key is provided as an extra header for authentication.

Output

Running the above code will provide a response from the model, related to financial inclusion.

Troubleshooting Tips:

Authentication Issues:

• Ensure that Azure AD login is successful when prompted.

APIM Key Issues:

• Ensure that a valid APIM subscription key is used.
• Check that the key is associated with the APIM service.

Response Issues:

• If the model fails to generate a response, ensure that the model name and deployment settings are correct.
• Adjust the prompt for better response quality.

Default Azure Credential

DefaultAzureCredential is an opinionated, preconfigured chain of credentials. It’s designed to support many environments, along with the most common authentication flows and developer tools. In graphical form, the underlying chain looks like this:

The order in which DefaultAzureCredential attempts credentials follows.

DefaultAzureCredential

In its simplest form, you can use the parameterless version of DefaultAzureCredential as follows:

from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient

# Acquire a credential object
credential = DefaultAzureCredential()

blob_service_client = BlobServiceClient(
    account_url="https://<my_account_name>.blob.core.windows.net",
    credential=credential
)

By default, interactive authentication is disabled in DefaultAzureCredential and can be enabled with a keyword argument:

DefaultAzureCredential(exclude_interactive_browser_credential=False)

When enabled, DefaultAzureCredential falls back to interactively authenticating via the system's default web browser when no other credential is available.

interactive_browser_client_id argument uses str

The client ID to be used in interactive browser credential. If not specified, users will authenticate to an Azure development application.

How to customize DefaultAzureCredential

DefaultAzureCredential(**kwargs: Any)

The order in which DefaultAzureCredential attempts credentials follows

Keywords Argument List

To remove a credential from DefaultAzureCredential, use the corresponding exclude-prefixed keyword parameter. For example:

credential = DefaultAzureCredential(
    exclude_environment_credential=True, 
    exclude_workload_identity_credential=True,
    managed_identity_client_id=user_assigned_client_id
)

In the preceding code sample, EnvironmentCredential and WorkloadIdentityCredential are removed from the credential chain. As a result, the first credential to be attempted is ManagedIdentityCredential. The modified chain looks like this:

As more exclude-prefixed keyword parameters are set to True (credential exclusions are configured), the advantages of using DefaultAzureCredential diminish. In such cases, ChainedTokenCredential is a better choice and requires less code. To illustrate, these two code samples behave the same way:

credential = DefaultAzureCredential(
    exclude_environment_credential=True,
    exclude_workload_identity_credential=True,
    exclude_shared_token_cache_credential=True,
    exclude_azure_powershell_credential=True,
    exclude_azure_developer_cli_credential=True,
    managed_identity_client_id=user_assigned_client_id
)

credential = ChainedTokenCredential(
    ManagedIdentityCredential(client_id=user_assigned_client_id),
    AzureCliCredential()
)

Python Code for Using Azure OpenAI with API Management with subscription key

This Python code demonstrates how to use the Azure OpenAI SDK to interact with an Azure API Management endpoint. The code snippet below outlines the process of initializing the Azure OpenAI client and making a request to generate a response based on the model deployed in your Azure OpenAI service.

from openai import AzureOpenAI

client = AzureOpenAI(
   azure_endpoint="https://<your_APIM_endpoint>.azure-api.net/<your_api_suffix>", #do not add "/openai" at the end here because this will be automatically added by this SDK
   api_key="<your subscription key>",
   api_version="2023-12-01-preview"
)

response = client.chat.completions.create(
   model="<your_deployment_name>",
   messages=[
      {"role": "system", "content": "You are a helpful assistant."},
      {"role": "user", "content": "Does Azure OpenAI support customer managed keys?"}
   ]
)
print(response)

Execute this script to interact with the Azure OpenAI service through the configured API Management endpoint.

The script sends a predefined message and prints the response from the OpenAI model.

$ python ./azure_openai_sample.py 

and response will be like

ChatCompletion(id=None, choices=None, created=None, model=None, object=None, system_fingerprint=None, usage=None, response='Yes, Azure OpenAI supports customer managed keys. With Azure Key Vault integration, you can securely store and manage your keys using Azure Key Vault and then provide them to OpenAI in a way that is transparent and seamless. This allows you to have control over your keys and ensures that your data and models are protected.')

This sample is intended to be used as a basic example of integrating Azure OpenAI with Azure API Management. Depending on your specific use case and environment setup, additional configuration and error handling may be required.

Python Code for Using Azure OpenAI with API Management with Entra ID (AzureAD)

from openai import AzureOpenAI
from dotenv import load_dotenv
from azure.identity import DefaultAzureCredential, get_bearer_token_provider
import os

load_dotenv()

apim_endpoint = os.getenv("APIM_ENDPOINT")
audience = os.getenv("AZURE_AUDIENCE")+ "/.default"

token_provider = get_bearer_token_provider(DefaultAzureCredential(), audience)     # "https://cognitiveservices.azure.com/.default"

client = AzureOpenAI(
    azure_endpoint=apim_endpoint, #do not add "/openai" at the end here because this will be automatically added by this SDK
    azure_ad_token_provider=token_provider,
    api_version="2023-12-01-preview"
)

response = client.chat.completions.create(
    model="chat",
    messages=[
        {"role": "system", "content": "You are a helpful assistant."},
        {"role": "user", "content": "Does Azure OpenAI support customer managed keys?"}
    ]
)
print(response.choices[0].message.content)

You need to make sure either managed identity of apim or api app registration or your user has at least Cognitive Services OpenAI User permission depending on your apim policy and needs.

Authentication Managed Identity APIM Policy

This policy injects the Azure Managed Identity from your API Management instance as an HTTP header for OpenAI. This method is recommended for ease of API key management.

<authentication-managed-identity resource="https://cognitiveservices.azure.com" output-token-variable-name="msi-access-token" ignore-error="false" />
<set-header name="Authorization" exists-action="override">
    <value>@("Bearer " + (string)context.Variables["msi-access-token"])</value>
</set-header>

Python Code for Using Azure OpenAI with API Management with Entra ID (AzureAD) with Langchain

import os
from azure.identity import DefaultAzureCredential
from langchain_openai import AzureChatOpenAI
from dotenv import load_dotenv

load_dotenv()

apim_endpoint = os.getenv("APIM_ENDPOINT")
audience = os.getenv("AZURE_AUDIENCE")+ "/.default"

# Get the Azure Credential
credential = DefaultAzureCredential()

# Set the API type to `azure_ad`
os.environ["OPENAI_API_TYPE"] = "azure_ad"
os.environ["OPENAI_API_VERSION"] = "2023-12-01-preview"
# Set the API_KEY to the token from the Azure credential
os.environ["OPENAI_API_KEY"] = credential.get_token(audience).token

llm = AzureChatOpenAI(
    deployment_name="chat",
    model_name="gpt-35-turbo",
    azure_endpoint=apim_endpoint,
)

messages = [
   {"role": "system", "content": "You are a helpful assistant."},
   {"role": "user", "content": "Does Azure OpenAI support customer managed keys?"}
]

print( llm.invoke(messages) )

Conclusion

This notebook showcases how to utilize Azure OpenAI with Azure AD authentication to generate chat completions. It covers Azure Identity authentication within the Azure SDK for Python, providing explanations and examples of DefaultAzureCredential and InteractiveBrowserCredential. Additionally, it includes Python code for integrating EntraID (Azure AD) with Azure OpenAI and API Management, featuring sample code for LangChain. You can adjust the prompt and model parameters to suit various use cases.

—— — — — — — -Happy Coding — — — — — — —— — — — — — —