Detect system-assigned managed identities in AzureCredentialHelper

When system-assigned managed identities are enabled the
IDENTITY_ENDPOINT and IDENTITY_HEADER environment variables are defined.
It should be enough to detect the endpoint variable for this purpose.

AZURE_CLIENT_ID is still used by user-managed identities.

Reference:
https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=portal%2Chttp#rest-endpoint-reference

Author: DavidZidar

src/Shared/AzureCredentialHelper.cs

@@ -18,13 +18,22 @@ internal static TokenCredential CreateDefaultAzureCredential()
             return new DefaultAzureCredential(DefaultAzureCredential.DefaultEnvironmentVariableName);
         }
 
-        if (Environment.GetEnvironmentVariable("AZURE_CLIENT_ID") is not null)
+        var azureClientId = Environment.GetEnvironmentVariable("AZURE_CLIENT_ID");
+        var identityEndpoint = Environment.GetEnvironmentVariable("IDENTITY_ENDPOINT");
+
+        if (!string.IsNullOrWhiteSpace(azureClientId) || !string.IsNullOrWhiteSpace(identityEndpoint))
         {
-            // When we don't see DefaultEnvironmentVariableName, but we do see AZURE_CLIENT_ID,
-            // we just use ManagedIdentityCredential because that's the only credential type that
-            // Aspire Hosting enables by default.
+            // When we don't see DefaultEnvironmentVariableName, but we do see AZURE_CLIENT_ID
+            // for a user-assigned managed identity or IDENTITY_ENDPOINT for a system-assigned
+            // managed identity, we use ManagedIdentityCredential because that's the only
+            // credential type that Aspire Hosting enables by default.
             // If this doesn't work for applications, they can override the TokenCredential in their settings.
-            return new ManagedIdentityCredential(new ManagedIdentityCredentialOptions());
+
+            var managedIdentityId = !string.IsNullOrWhiteSpace(azureClientId)
+                ? ManagedIdentityId.FromUserAssignedClientId(azureClientId)
+                : ManagedIdentityId.SystemAssigned;
+
+            return new ManagedIdentityCredential(new ManagedIdentityCredentialOptions(managedIdentityId));
         }
 
         // when we can't detect a known Azure environment, fall back to the development credential