Dulmar

Enterprise Key Management (EKM) waxay OpenAI u oggolaanaysaa inay xogta ku sirayso fure weyn oo aad adigu maamusho. Si OpenAI ay ugu yeeri karto hawlgallada siraynta/ka-saarista sirta ee Key Vault-kaaga, waxaan u baahan doonaa in nala siiyo gelitaan. Dukumeentigani wuxuu muujinayaa sida loo dejiyo akoonkaaga Azure si OpenAI ay u qaadato door leh oggolaansho Key Vault.

Azure EKM flow where OpenAI EKM uses Microsoft Entra ID to access your Key Vault and master KEK

Tallaabooyinka

1. U samee service principal OpenAI akoonkaaga

Hel token gelitaan

az account get-access-token --resource https://graph.microsoft.com
--tenant YOUR_TENANT_ID

Abuur service principal-ka - appId ee codsiga hoose waa aqoonsiga client-ka codsiga OpenAI. Tani waxay abuuri doontaa principal leh magaca muuqda “EKM - OpenAI Azure” - tan xusuuso tallaabooyinka dambe.

Tilmaamaha Isku-xirka OpenAI / Azure EKM - Abuur service principal

curl -X POST https://graph.microsoft.com/v1.0/servicePrincipals \
-H "Authorization: Bearer $TOKEN_FROM_ABOVE" \
-H "Content-Type: application/json" \
–d '{"appId": "20a14814-5ab7-4612-a671-1382b412bf93"}'

2. Abuur door gaar ah oo loogu talagalay gelitaanka KMS ee xaddidan

Tag Subscriptions -> Access Control (IAM)
Hoosta liiska hoos-u-dhaca + Add, dooro Add custom role
Tag tab-ka JSON, guji Edit, kuna dar kuwa soo socda:
1. Magac door kasta - xusuuso magaca aad dooratay
2. Oggolaanshaha soo socda ee ku jira dataActions:
  1. Microsoft.KeyVault/vaults/keys/encrypt/action
  2. Microsoft.KeyVault/vaults/keys/decrypt/action
  3. Microsoft.KeyVault/vaults/keys/read

OpenAI / Azure EKM Integration Instructions Custom Role

3. Abuur Key Vault + Fure

Haddii aadan hore u haysan, ku abuur Key Vault cusub gudaha isla subscription-ka aad hadda ku abuurtay doorkaaga gaarka ah.

Key Vault-kaas gudihiisa, ku abuur Fure cusub:

Tag Key Vault -> Objects -> Keys, kadibna guji Generate/Import
Hoosta Options dooro Generate

Azure Key Vault Keys page with Generate/Import highlighted to add a key

Dooro RSA oo ah algorithm-ka siraynta.
Waxaad dooran kartaa cabbir kasta oo fure RSA ah
Bixi magac fure leh qaabkan: <org-xxx>--<any_name>, halka org-xxx uu yahay aqoonsiga ururkaaga OpenAI oo aad ka heli karto https://platform.openai.com/settings/organization/general

Azure Key Vault key generation form with RSA selected and key name org-abcdefg--test-keyvault-key

Haddii aadan awoodin inaad aragto ama abuurto fure, hubi inaad leedahay doorka Key Vault Administrator. Tani waa loo baahan yahay xitaa haddii aad leedahay doorka Owner. Si laguu qoondeeyo doorka:

Tag Key Vault -> Access Control (IAM)
Guji Add -> Add role assignment

Azure Key Vault Access control (IAM) page with Add menu open to Add role assignment

4. U samee meelayn door service principal-ka OpenAI + KMS gaar ah oo cusub + fure cusub

Tag Key Vault -> Objects -> Keys, kadibna guji safka furaha aad abuurtay
Tag Access control (IAM) ee furaha aad hadda gujisay (ma aha key vault-kaaga).
Hoosta liiska hoos-u-dhaca + Add, dooro Add role assignment

Tab-ka Role, dooro magaca doorka gaarka ah ee aad hadda abuurtay.

Azure role list filtered for openai- with the openai-azure-kms-role entry

Tab-ka Members:
1. Guji “+ Select members”
2. Ku qor “ekm -” barta raadinta, kadib service principal-ka OpenAI ee aad ku abuurtay Tallaabada 1 waa inuu soo muuqdaa

Azure role assignment Members step with EKM - OpenAI Azure Application selected as a member

5. Ku dabaq xaddidaad kasta oo dheeraad ah si waafaqsan hab-dhaqannadaada amniga

Kor ku xusan waa macluumaadka ugu yar ee OpenAI u baahan tahay si ay EKM u dejiso. Waxaad xor u tahay inaad dabaqdo siyaasado fure ama xaddidaado dheeraad ah oo waafaqsan hab-dhaqannadaada amniga gudaha, ilaa iyo inta OpenAI ay awood u leedahay inay ugu yeerto hawlgallada siraynta iyo ka-saarista sirta KMS-kaaga. Markaad wacdo bar-dhammaadka diiwaangelinta furaha ee OpenAI ee hoos lagu sharaxay, waxaan xaqiijin doonaa dejintaada.

Kadib markaad dhamayso tallaabooyinka kor ku xusan

ChatGPT Enterprise

Fadlan la xiriir qofkaaga OpenAI oo la wadaag kuwa soo socda:

"tenant_id": "<YOUR_AZURE_TENANT_UUID>"

"vault_uri": "https://<YOUR_KEYVAULT_NAME>.vault.azure.net/"

"key_name": "<YOUR_KEY_NAME>"

Magaca furaha ugu weyn ee Azure Key Vault ee aad maamusho
Magaca furuhu waa inuu lahaadaa qaabka <org-xxx>--<any_name>, halka org-xxx uu yahay aqoonsiga ururkaaga OpenAI oo aad ka heli karto https://platform.openai.com/settings/organization/general

Waxaan EKM u hawlgelin doonaa ururka/goobta shaqada ChatGPT-kaaga.

API

Ka diiwaangeli furahaaga dibadeed OpenAI

Raac tilmaamaha ku jira tixraacan API External Keys in the Management API

Marka hore, ka diiwaangeli furahaaga dibadeed heerka ururka OpenAI, taas oo soo saari doonta aqoonsi fure dibadeed oo qaabkiisu yahay extkey_xxx
Tallaabadan, waxaan xaqiijin doonaa in gelintaadu sax tahay iyo inaan ka xaqiijin karno KMS-kaaga.
Tani weli EKM kuma dari doonto mashruucaaga OpenAI.

# This generates an external key ID of the form extkey_xxx
curl -X POST \
-H "Content-type: application/json" \
-H "Authorization: Bearer $TOKEN" \
"https://api.openai.com/v1/organization/external_keys" \
-d '{
  "type": "azure",
  "name": "<ANY_FRIENDLY_NAME>",
  "tenant_id": "<YOUR_AZURE_TENANT_UUID>",
  "vault_uri": "https://<YOUR_KEYVAULT_NAME>.vault.azure.net/",
  "key_name": "<YOUR_KEY_NAME>"
}'

Kadib, abuur mashruuc OpenAI oo ku xiran furaha dibadeed. Kadib tan, EKM waxaa laga hawlgelinayaa mashruucaaga.
Jirka jawaabta ee wicitaankan API wuxuu ku siin doonaa aqoonsiga mashruuca (proj_xxx)

curl -X POST \
-H "Content-type: application/json" \
-H "Authorization: Bearer $TOKEN" \
"https://api.openai.com/v1/organization/projects" \
-d '{
   "name": "Some Project",
   "external_key_id": "extkey_xxxx"
}'

Tilmaamaha Isku-darka OpenAI / Azure EKM