This nginx.conf
can be used to convert an OAuth2 / OIDC client_credentials
POST request (e.g. from am application) into the form required by Azure Managed Identities tokenss issued by the Azure Instance Metadata Service (IMDS).
IMDS presents a non-standard interface for OAuth - namely:
- It only accepts HTTP GETs, not POSTs as is required for
client_credentials
. - It doesn't require the normal HTTP BASIC credentials presented, but these are safely ignored.
- It requires a static HTTP request header
Metadata=true
.
This config proxies these requests, makes the above changes and forwards to local IMDS on 169.254.169.254:80
.