Security Vulnerability: Microsoft Azure Active Directory Authentication Library (ADAL) - End of Life Notification (EOL)

[shwethadec01]

Component(s)

No response

What happened?

Affected Image: otel/opentelemetry-collector-contrib:0.139.0
Component: Microsoft Azure Active Directory Authentication Library (ADAL)
Description: Microsoft has officially ended support for all versions of the Azure Active Directory Authentication Library (ADAL) as of June 30, 2023.
Applications using ADAL remain functional, but no security patches, feature updates, or support will be provided.
Recommendation: Migrate to the Microsoft Authentication Library (MSAL), which is the supported and actively maintained library for Azure authentication.

We had previously reported a similar issue for an earlier version (#39276), but it was closed without a resolution.
Since the dependency persists in version 0.139.0, we kindly request you to revisit this issue and provide a fix or guidance on the planned remediation.

Thanks in advance

Collector version

0.139.0

Environment information

No response

OpenTelemetry Collector configuration

Log output

Additional context

No response

Tip

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.}

[paulojmdias]

/label receiver/azureblob receiver/azureeventhub

[github-actions]

Pinging code owners for receiver/azureblob: @eedorenko @mx-psi. See Adding Labels via Comments if you do not have permissions to add labels yourself. For example, comment '/label priority:p2 -needs-triage' to set the priority and remove the needs-triage label.

[github-actions]

Pinging code owners for receiver/azureeventhub: @atoulme @cparkins @dyl10s. See Adding Labels via Comments if you do not have permissions to add labels yourself. For example, comment '/label priority:p2 -needs-triage' to set the priority and remove the needs-triage label.

[paulojmdias]

Thanks for the issue report @shwethadec01!

For the Azure Event Hub receiver, is there a feature gate that allows users to use the new SDK. See https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/receiver/azureeventhubreceiver/feature_flags.go#L9.
This feature gate is still in Alpha, we could evaluate promoting it to Beta to enable it by default first.

For the Azure Blob Receiver, the migration was not even done yet, so we need to work on it. Are you willing to contribute to it? 🙏

[paulojmdias]

/label -needs-triage

[github-actions]

This issue has been inactive for 60 days. It will be closed in 60 days if there is no activity. To ping code owners by adding a component label, see Adding Labels via Comments, or if you are unsure of which component this issue relates to, please ping @open-telemetry/collector-contrib-triagers. If this issue is still relevant, please ping the code owners or leave a comment explaining why it is still relevant. Otherwise, please close it.

Pinging code owners:

• receiver/azureeventhubreceiver: @atoulme @cparkins @dyl10s
• receiver/azureblobreceiver: @eedorenko @mx-psi

See Adding Labels via Comments if you do not have permissions to add labels yourself.