oauth2 proxy azure workload identity