@azure/identity 2.1.0-alpha.20220315.2 → 2.1.0-alpha.20220322.5

package/dist/index.js

@@ -8,7 +8,7 @@ var coreClient = require('@azure/core-client');
 var coreUtil = require('@azure/core-util');
 var coreRestPipeline = require('@azure/core-rest-pipeline');
 var abortController = require('@azure/abort-controller');
-var logger$k = require('@azure/logger');
+var logger$l = require('@azure/logger');
 var msalCommon = require('@azure/msal-common');
 var uuid = require('uuid');
 var fs = require('fs');
@@ -273,7 +273,7 @@ async function trace(operationName, options, fn, createSpanFn = createSpan) {
 /**
  * The AzureLogger used for all clients within the identity package
  */
-const logger$j = logger$k.createClientLogger("identity");
+const logger$k = logger$l.createClientLogger("identity");
 /**
  * Separates a list of environment variable names into a plain object with two arrays: an array of missing environment variables and another array with assigned environment variables.
  * @param supportedEnvVars - List of environment variable names
@@ -313,7 +313,7 @@ function formatError(scope, error) {
  *   `[title] => [message]`
  *
  */
-function credentialLoggerInstance(title, parent, log = logger$j) {
+function credentialLoggerInstance(title, parent, log = logger$k) {
     const fullTitle = parent ? `${parent.fullTitle} ${title}` : title;
     function info(message) {
         log.info(`${fullTitle} =>`, message);
@@ -338,7 +338,7 @@ function credentialLoggerInstance(title, parent, log = logger$j) {
  *   `[title] => getToken() => [message]`
  *
  */
-function credentialLogger(title, log = logger$j) {
+function credentialLogger(title, log = logger$k) {
     const credLogger = credentialLoggerInstance(title, undefined, log);
     return Object.assign(Object.assign({}, credLogger), { parent: log, getToken: credentialLoggerInstance("=> getToken()", credLogger, log) });
 }
@@ -367,7 +367,7 @@ function getIdentityClientAuthorityHost(options) {
  */
 class IdentityClient extends coreClient.ServiceClient {
     constructor(options) {
-        var _a;
+        var _a, _b;
         const packageDetails = `azsdk-js-identity/2.1.0-beta.2`;
         const userAgentPrefix = ((_a = options === null || options === void 0 ? void 0 : options.userAgentOptions) === null || _a === void 0 ? void 0 : _a.userAgentPrefix)
             ? `${options.userAgentOptions.userAgentPrefix} ${packageDetails}`
@@ -383,9 +383,10 @@ class IdentityClient extends coreClient.ServiceClient {
             }, baseUri }));
         this.authorityHost = baseUri;
         this.abortControllers = new Map();
+        this.allowLoggingAccountIdentifiers = (_b = options === null || options === void 0 ? void 0 : options.loggingOptions) === null || _b === void 0 ? void 0 : _b.allowLoggingAccountIdentifiers;
     }
     async sendTokenRequest(request, expiresOnParser) {
-        logger$j.info(`IdentityClient: sending token request to [${request.url}]`);
+        logger$k.info(`IdentityClient: sending token request to [${request.url}]`);
         const response = await this.sendRequest(request);
         expiresOnParser =
             expiresOnParser ||
@@ -397,6 +398,7 @@ class IdentityClient extends coreClient.ServiceClient {
             if (!parsedBody.access_token) {
                 return null;
             }
+            this.logIdentifiers(response);
             const token = {
                 accessToken: {
                     token: parsedBody.access_token,
@@ -404,12 +406,12 @@ class IdentityClient extends coreClient.ServiceClient {
                 },
                 refreshToken: parsedBody.refresh_token,
             };
-            logger$j.info(`IdentityClient: [${request.url}] token acquired, expires on ${token.accessToken.expiresOnTimestamp}`);
+            logger$k.info(`IdentityClient: [${request.url}] token acquired, expires on ${token.accessToken.expiresOnTimestamp}`);
             return token;
         }
         else {
             const error = new AuthenticationError(response.status, response.bodyAsText);
-            logger$j.warning(`IdentityClient: authentication error. HTTP status: ${response.status}, ${error.errorResponse.errorDescription}`);
+            logger$k.warning(`IdentityClient: authentication error. HTTP status: ${response.status}, ${error.errorResponse.errorDescription}`);
             throw error;
         }
     }
@@ -417,7 +419,7 @@ class IdentityClient extends coreClient.ServiceClient {
         if (refreshToken === undefined) {
             return null;
         }
-        logger$j.info(`IdentityClient: refreshing access token with client ID: ${clientId}, scopes: ${scopes} started`);
+        logger$k.info(`IdentityClient: refreshing access token with client ID: ${clientId}, scopes: ${scopes} started`);
         const { span, updatedOptions } = createSpan("IdentityClient-refreshAccessToken", options);
         const refreshParams = {
             grant_type: "refresh_token",
@@ -443,7 +445,7 @@ class IdentityClient extends coreClient.ServiceClient {
                 tracingOptions: updatedOptions === null || updatedOptions === void 0 ? void 0 : updatedOptions.tracingOptions,
             });
             const response = await this.sendTokenRequest(request, expiresOnParser);
-            logger$j.info(`IdentityClient: refreshed token for client ID: ${clientId}`);
+            logger$k.info(`IdentityClient: refreshed token for client ID: ${clientId}`);
             return response;
         }
         catch (err) {
@@ -452,7 +454,7 @@ class IdentityClient extends coreClient.ServiceClient {
                 // It's likely that the refresh token has expired, so
                 // return null so that the credential implementation will
                 // initiate the authentication flow again.
-                logger$j.info(`IdentityClient: interaction required for client ID: ${clientId}`);
+                logger$k.info(`IdentityClient: interaction required for client ID: ${clientId}`);
                 span.setStatus({
                     code: coreTracing.SpanStatusCode.ERROR,
                     message: err.message,
@@ -460,7 +462,7 @@ class IdentityClient extends coreClient.ServiceClient {
                 return null;
             }
             else {
-                logger$j.warning(`IdentityClient: failed refreshing token for client ID: ${clientId}: ${err}`);
+                logger$k.warning(`IdentityClient: failed refreshing token for client ID: ${clientId}: ${err}`);
                 span.setStatus({
                     code: coreTracing.SpanStatusCode.ERROR,
                     message: err.message,
@@ -518,6 +520,7 @@ class IdentityClient extends coreClient.ServiceClient {
             abortSignal: this.generateAbortSignal(noCorrelationId),
         });
         const response = await this.sendRequest(request);
+        this.logIdentifiers(response);
         return {
             body: response.bodyAsText ? JSON.parse(response.bodyAsText) : undefined,
             headers: response.headers.toJSON(),
@@ -534,12 +537,45 @@ class IdentityClient extends coreClient.ServiceClient {
             abortSignal: this.generateAbortSignal(this.getCorrelationId(options)),
         });
         const response = await this.sendRequest(request);
+        this.logIdentifiers(response);
         return {
             body: response.bodyAsText ? JSON.parse(response.bodyAsText) : undefined,
             headers: response.headers.toJSON(),
             status: response.status,
         };
     }
+    /**
+     * If allowLoggingAccountIdentifiers was set on the constructor options
+     * we try to log the account identifiers by parsing the received access token.
+     *
+     * The account identifiers we try to log are:
+     * - `appid`: The application or Client Identifier.
+     * - `upn`: User Principal Name.
+     *   - It might not be available in some authentication scenarios.
+     *   - If it's not available, we put a placeholder: "No User Principal Name available".
+     * - `tid`: Tenant Identifier.
+     * - `oid`: Object Identifier of the authenticated user.
+     */
+    logIdentifiers(response) {
+        if (!this.allowLoggingAccountIdentifiers || !response.bodyAsText) {
+            return;
+        }
+        const unavailableUpn = "No User Principal Name available";
+        try {
+            const parsed = response.parsedBody || JSON.parse(response.bodyAsText);
+            const accessToken = parsed.access_token;
+            if (!accessToken) {
+                // Without an access token allowLoggingAccountIdentifiers isn't useful.
+                return;
+            }
+            const base64Metadata = accessToken.split(".")[1];
+            const { appid, upn, tid, oid } = JSON.parse(Buffer.from(base64Metadata, "base64").toString("utf8"));
+            logger$k.info(`[Authenticated account] Client ID: ${appid}. Tenant ID: ${tid}. User Principal Name: ${upn || unavailableUpn}. Object ID (user): ${oid}`);
+        }
+        catch (e) {
+            logger$k.warning("allowLoggingAccountIdentifiers was set, but we couldn't log the account information. Error:", e.message);
+        }
+    }
 }
 
 // Copyright (c) Microsoft Corporation.
@@ -978,7 +1014,7 @@ class MsalNode extends MsalBaseUtilities {
         const tenantId = resolveTenantId(options.logger, options.tenantId, options.clientId);
         this.authorityHost = options.authorityHost || process.env.AZURE_AUTHORITY_HOST;
         const authority = getAuthority(tenantId, this.authorityHost);
-        this.identityClient = new IdentityClient(Object.assign(Object.assign({}, options.tokenCredentialOptions), { authorityHost: authority }));
+        this.identityClient = new IdentityClient(Object.assign(Object.assign({}, options.tokenCredentialOptions), { authorityHost: authority, loggingOptions: options.loggingOptions }));
         let clientCapabilities = ["cp1"];
         if (process.env.AZURE_IDENTITY_DISABLE_CP1) {
             clientCapabilities = [];
@@ -1148,7 +1184,7 @@ To work with multiple accounts for the same Client ID and Tenant ID, please prov
 // Copyright (c) Microsoft Corporation.
 const CommonTenantId = "common";
 const AzureAccountClientId = "aebc6443-996d-45c2-90f0-388ff96faa56"; // VSC: 'aebc6443-996d-45c2-90f0-388ff96faa56'
-const logger$i = credentialLogger("VisualStudioCodeCredential");
+const logger$j = credentialLogger("VisualStudioCodeCredential");
 let findCredentials = undefined;
 const vsCodeCredentialControl = {
     setVsCodeCredentialFinder(finder) {
@@ -1201,7 +1237,7 @@ function getPropertyFromVSCode(property) {
         }
     }
     catch (e) {
-        logger$i.info(`Failed to load the Visual Studio Code configuration file. Error: ${e.message}`);
+        logger$j.info(`Failed to load the Visual Studio Code configuration file. Error: ${e.message}`);
         return;
     }
 }
@@ -1229,7 +1265,7 @@ class VisualStudioCodeCredential {
         const authorityHost = mapVSCodeAuthorityHosts[this.cloudName];
         this.identityClient = new IdentityClient(Object.assign({ authorityHost }, options));
         if (options && options.tenantId) {
-            checkTenantId(logger$i, options.tenantId);
+            checkTenantId(logger$j, options.tenantId);
             this.tenantId = options.tenantId;
         }
         else {
@@ -1281,7 +1317,7 @@ class VisualStudioCodeCredential {
         // Check to make sure the scope we get back is a valid scope
         if (!scopeString.match(/^[0-9a-zA-Z-.:/]+$/)) {
             const error = new Error("Invalid scope was specified by the user or calling client");
-            logger$i.getToken.info(formatError(scopes, error));
+            logger$j.getToken.info(formatError(scopes, error));
             throw error;
         }
         if (scopeString.indexOf("offline_access") < 0) {
@@ -1301,18 +1337,18 @@ class VisualStudioCodeCredential {
         if (refreshToken) {
             const tokenResponse = await this.identityClient.refreshAccessToken(tenantId, AzureAccountClientId, scopeString, refreshToken, undefined);
             if (tokenResponse) {
-                logger$i.getToken.info(formatSuccess(scopes));
+                logger$j.getToken.info(formatSuccess(scopes));
                 return tokenResponse.accessToken;
             }
             else {
                 const error = new CredentialUnavailableError("Could not retrieve the token associated with Visual Studio Code. Have you connected using the 'Azure Account' extension recently? To troubleshoot, visit https://aka.ms/azsdk/js/identity/vscodecredential/troubleshoot.");
-                logger$i.getToken.info(formatError(scopes, error));
+                logger$j.getToken.info(formatError(scopes, error));
                 throw error;
             }
         }
         else {
             const error = new CredentialUnavailableError("Could not retrieve the token associated with Visual Studio Code. Did you connect using the 'Azure Account' extension? To troubleshoot, visit https://aka.ms/azsdk/js/identity/vscodecredential/troubleshoot.");
-            logger$i.getToken.info(formatError(scopes, error));
+            logger$j.getToken.info(formatError(scopes, error));
             throw error;
         }
     }
@@ -1363,7 +1399,7 @@ function useIdentityPlugin(plugin) {
 /**
  * @internal
  */
-const logger$h = credentialLogger("ChainedTokenCredential");
+const logger$i = credentialLogger("ChainedTokenCredential");
 /**
  * Enables multiple `TokenCredential` implementations to be tried in order
  * until one of the getToken methods returns an access token.
@@ -1418,7 +1454,7 @@ class ChainedTokenCredential {
                     errors.push(err);
                 }
                 else {
-                    logger$h.getToken.info(formatError(scopes, err));
+                    logger$i.getToken.info(formatError(scopes, err));
                     throw err;
                 }
             }
@@ -1429,11 +1465,11 @@ class ChainedTokenCredential {
                 code: coreTracing.SpanStatusCode.ERROR,
                 message: err.message,
             });
-            logger$h.getToken.info(formatError(scopes, err));
+            logger$i.getToken.info(formatError(scopes, err));
             throw err;
         }
         span.end();
-        logger$h.getToken.info(`Result for ${successfulCredentialName}: ${formatSuccess(scopes)}`);
+        logger$i.getToken.info(`Result for ${successfulCredentialName}: ${formatSuccess(scopes)}`);
         if (token === null) {
             throw new CredentialUnavailableError("Failed to retrieve a valid token");
         }
@@ -1511,7 +1547,7 @@ const cliCredentialInternals = {
         });
     },
 };
-const logger$g = credentialLogger("AzureCliCredential");
+const logger$h = credentialLogger("AzureCliCredential");
 /**
  * This credential will use the currently logged-in user login information
  * via the Azure CLI ('az') commandline tool.
@@ -1541,11 +1577,11 @@ class AzureCliCredential {
     async getToken(scopes, options) {
         const tenantId = processMultiTenantRequest(this.tenantId, options);
         if (tenantId) {
-            checkTenantId(logger$g, tenantId);
+            checkTenantId(logger$h, tenantId);
         }
         const scope = typeof scopes === "string" ? scopes : scopes[0];
-        logger$g.getToken.info(`Using the scope ${scope}`);
-        ensureValidScope(scope, logger$g);
+        logger$h.getToken.info(`Using the scope ${scope}`);
+        ensureValidScope(scope, logger$h);
         const resource = getScopeResource(scope);
         let responseData = "";
         const { span } = createSpan(`${this.constructor.name}.getToken`, options);
@@ -1556,22 +1592,22 @@ class AzureCliCredential {
                 const isNotInstallError = obj.stderr.match("az:(.*)not found") || obj.stderr.startsWith("'az' is not recognized");
                 if (isNotInstallError) {
                     const error = new CredentialUnavailableError("Azure CLI could not be found.  Please visit https://aka.ms/azure-cli for installation instructions and then, once installed, authenticate to your Azure account using 'az login'.");
-                    logger$g.getToken.info(formatError(scopes, error));
+                    logger$h.getToken.info(formatError(scopes, error));
                     throw error;
                 }
                 else if (isLoginError) {
                     const error = new CredentialUnavailableError("Please run 'az login' from a command prompt to authenticate before using this credential.");
-                    logger$g.getToken.info(formatError(scopes, error));
+                    logger$h.getToken.info(formatError(scopes, error));
                     throw error;
                 }
                 const error = new CredentialUnavailableError(obj.stderr);
-                logger$g.getToken.info(formatError(scopes, error));
+                logger$h.getToken.info(formatError(scopes, error));
                 throw error;
             }
             else {
                 responseData = obj.stdout;
                 const response = JSON.parse(responseData);
-                logger$g.getToken.info(formatSuccess(scopes));
+                logger$h.getToken.info(formatSuccess(scopes));
                 const returnValue = {
                     token: response.accessToken,
                     expiresOnTimestamp: new Date(response.expiresOn).getTime(),
@@ -1585,7 +1621,7 @@ class AzureCliCredential {
                 code: coreTracing.SpanStatusCode.ERROR,
                 message: error.message,
             });
-            logger$g.getToken.info(formatError(scopes, error));
+            logger$h.getToken.info(formatError(scopes, error));
             throw error;
         }
     }
@@ -1622,7 +1658,7 @@ const processUtils = {
 };
 
 // Copyright (c) Microsoft Corporation.
-const logger$f = credentialLogger("AzurePowerShellCredential");
+const logger$g = credentialLogger("AzurePowerShellCredential");
 const isWindows = process.platform === "win32";
 /**
  * Returns a platform-appropriate command name by appending ".exe" on Windows.
@@ -1753,15 +1789,15 @@ class AzurePowerShellCredential {
         return trace(`${this.constructor.name}.getToken`, options, async () => {
             const tenantId = processMultiTenantRequest(this.tenantId, options);
             if (tenantId) {
-                checkTenantId(logger$f, tenantId);
+                checkTenantId(logger$g, tenantId);
             }
             const scope = typeof scopes === "string" ? scopes : scopes[0];
-            ensureValidScope(scope, logger$f);
-            logger$f.getToken.info(`Using the scope ${scope}`);
+            ensureValidScope(scope, logger$g);
+            logger$g.getToken.info(`Using the scope ${scope}`);
             const resource = getScopeResource(scope);
             try {
                 const response = await this.getAzurePowerShellAccessToken(resource, tenantId);
-                logger$f.getToken.info(formatSuccess(scopes));
+                logger$g.getToken.info(formatSuccess(scopes));
                 return {
                     token: response.Token,
                     expiresOnTimestamp: new Date(response.ExpiresOn).getTime(),
@@ -1770,16 +1806,16 @@ class AzurePowerShellCredential {
             catch (err) {
                 if (isNotInstalledError(err)) {
                     const error = new CredentialUnavailableError(powerShellPublicErrorMessages.installed);
-                    logger$f.getToken.info(formatError(scope, error));
+                    logger$g.getToken.info(formatError(scope, error));
                     throw error;
                 }
                 else if (isLoginError(err)) {
                     const error = new CredentialUnavailableError(powerShellPublicErrorMessages.login);
-                    logger$f.getToken.info(formatError(scope, error));
+                    logger$g.getToken.info(formatError(scope, error));
                     throw error;
                 }
                 const error = new CredentialUnavailableError(`${err}. ${powerShellPublicErrorMessages.troubleshoot}`);
-                logger$f.getToken.info(formatError(scope, error));
+                logger$g.getToken.info(formatError(scope, error));
                 throw error;
             }
         });
@@ -1817,7 +1853,7 @@ class MsalClientSecret extends MsalNode {
 }
 
 // Copyright (c) Microsoft Corporation.
-const logger$e = credentialLogger("ClientSecretCredential");
+const logger$f = credentialLogger("ClientSecretCredential");
 /**
  * Enables authentication to Azure Active Directory using a client secret
  * that was generated for an App Registration. More information on how
@@ -1841,7 +1877,7 @@ class ClientSecretCredential {
         if (!tenantId || !clientId || !clientSecret) {
             throw new Error("ClientSecretCredential: tenantId, clientId, and clientSecret are required parameters. To troubleshoot, visit https://aka.ms/azsdk/js/identity/serviceprincipalauthentication/troubleshoot.");
         }
-        this.msalFlow = new MsalClientSecret(Object.assign(Object.assign({}, options), { logger: logger$e,
+        this.msalFlow = new MsalClientSecret(Object.assign(Object.assign({}, options), { logger: logger$f,
             clientId,
             tenantId,
             clientSecret, tokenCredentialOptions: options }));
@@ -1874,8 +1910,12 @@ const readFileAsync$2 = util.promisify(fs.readFile);
  */
 async function parseCertificate(configuration, sendCertificateChain) {
     const certificateParts = {};
+    const certificate = configuration
+        .certificate;
+    const certificatePath = configuration
+        .certificatePath;
     certificateParts.certificateContents =
-        configuration.certificate || (await readFileAsync$2(configuration.certificatePath, "utf8"));
+        certificate || (await readFileAsync$2(certificatePath, "utf8"));
     if (sendCertificateChain) {
         certificateParts.x5c = certificateParts.certificateContents;
     }
@@ -1947,7 +1987,7 @@ class MsalClientCertificate extends MsalNode {
 
 // Copyright (c) Microsoft Corporation.
 const credentialName$2 = "ClientCertificateCredential";
-const logger$d = credentialLogger(credentialName$2);
+const logger$e = credentialLogger(credentialName$2);
 /**
  * Enables authentication to Azure Active Directory using a PEM-encoded
  * certificate that is assigned to an App Registration. More information
@@ -1966,14 +2006,17 @@ class ClientCertificateCredential {
                 certificatePath: certificatePathOrConfiguration,
             }
             : certificatePathOrConfiguration));
-        if (!configuration || !(configuration.certificate || configuration.certificatePath)) {
+        const certificate = configuration
+            .certificate;
+        const certificatePath = configuration.certificatePath;
+        if (!configuration || !(certificate || certificatePath)) {
             throw new Error(`${credentialName$2}: Provide either a PEM certificate in string form, or the path to that certificate in the filesystem. To troubleshoot, visit https://aka.ms/azsdk/js/identity/serviceprincipalauthentication/troubleshoot.`);
         }
-        if (configuration.certificate && configuration.certificatePath) {
+        if (certificate && certificatePath) {
             throw new Error(`${credentialName$2}: To avoid unexpected behaviors, providing both the contents of a PEM certificate and the path to a PEM certificate is forbidden. To troubleshoot, visit https://aka.ms/azsdk/js/identity/serviceprincipalauthentication/troubleshoot.`);
         }
         this.msalFlow = new MsalClientCertificate(Object.assign(Object.assign({}, options), { configuration,
-            logger: logger$d,
+            logger: logger$e,
             clientId,
             tenantId, sendCertificateChain: options.sendCertificateChain, tokenCredentialOptions: options }));
     }
@@ -2024,7 +2067,7 @@ class MsalUsernamePassword extends MsalNode {
 }
 
 // Copyright (c) Microsoft Corporation.
-const logger$c = credentialLogger("UsernamePasswordCredential");
+const logger$d = credentialLogger("UsernamePasswordCredential");
 /**
  * Enables authentication to Azure Active Directory with a user's
  * username and password. This credential requires a high degree of
@@ -2047,7 +2090,7 @@ class UsernamePasswordCredential {
         if (!tenantId || !clientId || !username || !password) {
             throw new Error("UsernamePasswordCredential: tenantId, clientId, username and password are required parameters. To troubleshoot, visit https://aka.ms/azsdk/js/identity/usernamepasswordcredential/troubleshoot.");
         }
-        this.msalFlow = new MsalUsernamePassword(Object.assign(Object.assign({}, options), { logger: logger$c,
+        this.msalFlow = new MsalUsernamePassword(Object.assign(Object.assign({}, options), { logger: logger$d,
             clientId,
             tenantId,
             username,
@@ -2090,7 +2133,7 @@ const AllSupportedEnvironmentVariables = [
     "AZURE_PASSWORD",
 ];
 const credentialName$1 = "EnvironmentCredential";
-const logger$b = credentialLogger(credentialName$1);
+const logger$c = credentialLogger(credentialName$1);
 /**
  * Enables authentication to Azure Active Directory using client secret
  * details configured in environment variables
@@ -2120,26 +2163,26 @@ class EnvironmentCredential {
         // Keep track of any missing environment variables for error details
         this._credential = undefined;
         const assigned = processEnvVars(AllSupportedEnvironmentVariables).assigned.join(", ");
-        logger$b.info(`Found the following environment variables: ${assigned}`);
+        logger$c.info(`Found the following environment variables: ${assigned}`);
         const tenantId = process.env.AZURE_TENANT_ID, clientId = process.env.AZURE_CLIENT_ID, clientSecret = process.env.AZURE_CLIENT_SECRET;
         if (tenantId) {
-            checkTenantId(logger$b, tenantId);
+            checkTenantId(logger$c, tenantId);
         }
         if (tenantId && clientId && clientSecret) {
-            logger$b.info(`Invoking ClientSecretCredential with tenant ID: ${tenantId}, clientId: ${clientId} and clientSecret: [REDACTED]`);
+            logger$c.info(`Invoking ClientSecretCredential with tenant ID: ${tenantId}, clientId: ${clientId} and clientSecret: [REDACTED]`);
             this._credential = new ClientSecretCredential(tenantId, clientId, clientSecret, options);
             return;
         }
         const certificatePath = process.env.AZURE_CLIENT_CERTIFICATE_PATH;
         if (tenantId && clientId && certificatePath) {
-            logger$b.info(`Invoking ClientCertificateCredential with tenant ID: ${tenantId}, clientId: ${clientId} and certificatePath: ${certificatePath}`);
+            logger$c.info(`Invoking ClientCertificateCredential with tenant ID: ${tenantId}, clientId: ${clientId} and certificatePath: ${certificatePath}`);
             this._credential = new ClientCertificateCredential(tenantId, clientId, { certificatePath }, options);
             return;
         }
         const username = process.env.AZURE_USERNAME;
         const password = process.env.AZURE_PASSWORD;
         if (tenantId && clientId && username && password) {
-            logger$b.info(`Invoking UsernamePasswordCredential with tenant ID: ${tenantId}, clientId: ${clientId} and username: ${username}`);
+            logger$c.info(`Invoking UsernamePasswordCredential with tenant ID: ${tenantId}, clientId: ${clientId} and username: ${username}`);
             this._credential = new UsernamePasswordCredential(tenantId, clientId, username, password, options);
         }
     }
@@ -2154,7 +2197,7 @@ class EnvironmentCredential {
             if (this._credential) {
                 try {
                     const result = await this._credential.getToken(scopes, newOptions);
-                    logger$b.getToken.info(formatSuccess(scopes));
+                    logger$c.getToken.info(formatSuccess(scopes));
                     return result;
                 }
                 catch (err) {
@@ -2162,7 +2205,7 @@ class EnvironmentCredential {
                         error: `${credentialName$1} authentication failed. To troubleshoot, visit https://aka.ms/azsdk/js/identity/environmentcredential/troubleshoot.`,
                         error_description: err.message.toString().split("More details:").join(""),
                     });
-                    logger$b.getToken.info(formatError(scopes, authenticationError));
+                    logger$c.getToken.info(formatError(scopes, authenticationError));
                     throw authenticationError;
                 }
             }
@@ -2208,22 +2251,22 @@ function mapScopesToResource(scopes) {
 }
 
 // Copyright (c) Microsoft Corporation.
-const msiName$5 = "ManagedIdentityCredential - AppServiceMSI 2017";
-const logger$a = credentialLogger(msiName$5);
+const msiName$6 = "ManagedIdentityCredential - AppServiceMSI 2017";
+const logger$b = credentialLogger(msiName$6);
 /**
  * Formats the expiration date of the received token into the number of milliseconds between that date and midnight, January 1, 1970.
  */
-function expiresOnParser$2(requestBody) {
+function expiresOnParser$3(requestBody) {
     // App Service always returns string expires_on values.
     return Date.parse(requestBody.expires_on);
 }
 /**
  * Generates the options used on the request for an access token.
  */
-function prepareRequestOptions$5(scopes, clientId) {
+function prepareRequestOptions$6(scopes, clientId) {
     const resource = mapScopesToResource(scopes);
     if (!resource) {
-        throw new Error(`${msiName$5}: Multiple scopes are not supported.`);
+        throw new Error(`${msiName$6}: Multiple scopes are not supported.`);
     }
     const queryParameters = {
         resource,
@@ -2235,10 +2278,10 @@ function prepareRequestOptions$5(scopes, clientId) {
     const query = new URLSearchParams(queryParameters);
     // This error should not bubble up, since we verify that this environment variable is defined in the isAvailable() method defined below.
     if (!process.env.MSI_ENDPOINT) {
-        throw new Error(`${msiName$5}: Missing environment variable: MSI_ENDPOINT`);
+        throw new Error(`${msiName$6}: Missing environment variable: MSI_ENDPOINT`);
     }
     if (!process.env.MSI_SECRET) {
-        throw new Error(`${msiName$5}: Missing environment variable: MSI_SECRET`);
+        throw new Error(`${msiName$6}: Missing environment variable: MSI_SECRET`);
     }
     return {
         url: `${process.env.MSI_ENDPOINT}?${query.toString()}`,
@@ -2256,40 +2299,40 @@ const appServiceMsi2017 = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$a.info(`${msiName$5}: Unavailable. Multiple scopes are not supported.`);
+            logger$b.info(`${msiName$6}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const env = process.env;
         const result = Boolean(env.MSI_ENDPOINT && env.MSI_SECRET);
         if (!result) {
-            logger$a.info(`${msiName$5}: Unavailable. The environment variables needed are: MSI_ENDPOINT and MSI_SECRET.`);
+            logger$b.info(`${msiName$6}: Unavailable. The environment variables needed are: MSI_ENDPOINT and MSI_SECRET.`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
         if (resourceId) {
-            logger$a.warning(`${msiName$5}: managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
+            logger$b.warning(`${msiName$6}: managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
         }
-        logger$a.info(`${msiName$5}: Using the endpoint and the secret coming form the environment variables: MSI_ENDPOINT=${process.env.MSI_ENDPOINT} and MSI_SECRET=[REDACTED].`);
-        const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$5(scopes, clientId)), { 
+        logger$b.info(`${msiName$6}: Using the endpoint and the secret coming form the environment variables: MSI_ENDPOINT=${process.env.MSI_ENDPOINT} and MSI_SECRET=[REDACTED].`);
+        const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$6(scopes, clientId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
-        const tokenResponse = await identityClient.sendTokenRequest(request, expiresOnParser$2);
+        const tokenResponse = await identityClient.sendTokenRequest(request, expiresOnParser$3);
         return (tokenResponse && tokenResponse.accessToken) || null;
     },
 };
 
 // Copyright (c) Microsoft Corporation.
-const msiName$4 = "ManagedIdentityCredential - CloudShellMSI";
-const logger$9 = credentialLogger(msiName$4);
+const msiName$5 = "ManagedIdentityCredential - CloudShellMSI";
+const logger$a = credentialLogger(msiName$5);
 /**
  * Generates the options used on the request for an access token.
  */
-function prepareRequestOptions$4(scopes, clientId, resourceId) {
+function prepareRequestOptions$5(scopes, clientId, resourceId) {
     const resource = mapScopesToResource(scopes);
     if (!resource) {
-        throw new Error(`${msiName$4}: Multiple scopes are not supported.`);
+        throw new Error(`${msiName$5}: Multiple scopes are not supported.`);
     }
     const body = {
         resource,
@@ -2302,7 +2345,7 @@ function prepareRequestOptions$4(scopes, clientId, resourceId) {
     }
     // This error should not bubble up, since we verify that this environment variable is defined in the isAvailable() method defined below.
     if (!process.env.MSI_ENDPOINT) {
-        throw new Error(`${msiName$4}: Missing environment variable: MSI_ENDPOINT`);
+        throw new Error(`${msiName$5}: Missing environment variable: MSI_ENDPOINT`);
     }
     const params = new URLSearchParams(body);
     return {
@@ -2324,25 +2367,25 @@ const cloudShellMsi = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$9.info(`${msiName$4}: Unavailable. Multiple scopes are not supported.`);
+            logger$a.info(`${msiName$5}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const result = Boolean(process.env.MSI_ENDPOINT);
         if (!result) {
-            logger$9.info(`${msiName$4}: Unavailable. The environment variable MSI_ENDPOINT is needed.`);
+            logger$a.info(`${msiName$5}: Unavailable. The environment variable MSI_ENDPOINT is needed.`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
         if (clientId) {
-            logger$9.warning(`${msiName$4}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
+            logger$a.warning(`${msiName$5}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
         }
         if (resourceId) {
-            logger$9.warning(`${msiName$4}: user defined managed Identity by resource Id not supported. The argument resourceId might be ignored by the service.`);
+            logger$a.warning(`${msiName$5}: user defined managed Identity by resource Id not supported. The argument resourceId might be ignored by the service.`);
         }
-        logger$9.info(`${msiName$4}: Using the endpoint coming form the environment variable MSI_ENDPOINT = ${process.env.MSI_ENDPOINT}.`);
-        const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$4(scopes, clientId, resourceId)), { 
+        logger$a.info(`${msiName$5}: Using the endpoint coming form the environment variable MSI_ENDPOINT = ${process.env.MSI_ENDPOINT}.`);
+        const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$5(scopes, clientId, resourceId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
         const tokenResponse = await identityClient.sendTokenRequest(request);
@@ -2351,33 +2394,33 @@ const cloudShellMsi = {
 };
 
 // Copyright (c) Microsoft Corporation.
-const msiName$3 = "ManagedIdentityCredential - IMDS";
-const logger$8 = credentialLogger(msiName$3);
+const msiName$4 = "ManagedIdentityCredential - IMDS";
+const logger$9 = credentialLogger(msiName$4);
 /**
  * Formats the expiration date of the received token into the number of milliseconds between that date and midnight, January 1, 1970.
  */
-function expiresOnParser$1(requestBody) {
+function expiresOnParser$2(requestBody) {
     if (requestBody.expires_on) {
         // Use the expires_on timestamp if it's available
         const expires = +requestBody.expires_on * 1000;
-        logger$8.info(`${msiName$3}: Using expires_on: ${expires} (original value: ${requestBody.expires_on})`);
+        logger$9.info(`${msiName$4}: Using expires_on: ${expires} (original value: ${requestBody.expires_on})`);
         return expires;
     }
     else {
         // If these aren't possible, use expires_in and calculate a timestamp
         const expires = Date.now() + requestBody.expires_in * 1000;
-        logger$8.info(`${msiName$3}: IMDS using expires_in: ${expires} (original value: ${requestBody.expires_in})`);
+        logger$9.info(`${msiName$4}: IMDS using expires_in: ${expires} (original value: ${requestBody.expires_in})`);
         return expires;
     }
 }
 /**
  * Generates the options used on the request for an access token.
  */
-function prepareRequestOptions$3(scopes, clientId, resourceId, options) {
+function prepareRequestOptions$4(scopes, clientId, resourceId, options) {
     var _a;
     const resource = mapScopesToResource(scopes);
     if (!resource) {
-        throw new Error(`${msiName$3}: Multiple scopes are not supported.`);
+        throw new Error(`${msiName$4}: Multiple scopes are not supported.`);
     }
     const { skipQuery, skipMetadataHeader } = options || {};
     let query = "";
@@ -2427,7 +2470,7 @@ const imdsMsi = {
         var _a, _b;
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$8.info(`${msiName$3}: Unavailable. Multiple scopes are not supported.`);
+            logger$9.info(`${msiName$4}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const { span, updatedOptions: options } = createSpan("ManagedIdentityCredential-pingImdsEndpoint", getTokenOptions);
@@ -2438,7 +2481,7 @@ const imdsMsi = {
         if (!identityClient) {
             throw new Error("Missing IdentityClient");
         }
-        const requestOptions = prepareRequestOptions$3(resource, clientId, resourceId, {
+        const requestOptions = prepareRequestOptions$4(resource, clientId, resourceId, {
             skipMetadataHeader: true,
             skipQuery: true,
         });
@@ -2452,7 +2495,7 @@ const imdsMsi = {
             // This MSI uses the imdsEndpoint to get the token, which only uses http://
             request.allowInsecureConnection = true;
             try {
-                logger$8.info(`${msiName$3}: Pinging the Azure IMDS endpoint`);
+                logger$9.info(`${msiName$4}: Pinging the Azure IMDS endpoint`);
                 await identityClient.sendRequest(request);
             }
             catch (err) {
@@ -2464,7 +2507,7 @@ const imdsMsi = {
                 ) {
                     // If the request failed, or Node.js was unable to establish a connection,
                     // or the host was down, we'll assume the IMDS endpoint isn't available.
-                    logger$8.info(`${msiName$3}: The Azure IMDS endpoint is unavailable`);
+                    logger$9.info(`${msiName$4}: The Azure IMDS endpoint is unavailable`);
                     span.setStatus({
                         code: coreTracing.SpanStatusCode.ERROR,
                         message: err.message,
@@ -2473,13 +2516,13 @@ const imdsMsi = {
                 }
             }
             // If we received any response, the endpoint is available
-            logger$8.info(`${msiName$3}: The Azure IMDS endpoint is available`);
+            logger$9.info(`${msiName$4}: The Azure IMDS endpoint is available`);
             return true;
         }
         catch (err) {
             // createWebResource failed.
             // This error should bubble up to the user.
-            logger$8.info(`${msiName$3}: Error when creating the WebResource for the Azure IMDS endpoint: ${err.message}`);
+            logger$9.info(`${msiName$4}: Error when creating the WebResource for the Azure IMDS endpoint: ${err.message}`);
             span.setStatus({
                 code: coreTracing.SpanStatusCode.ERROR,
                 message: err.message,
@@ -2492,12 +2535,12 @@ const imdsMsi = {
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
-        logger$8.info(`${msiName$3}: Using the Azure IMDS endpoint coming from the environment variable MSI_ENDPOINT=${process.env.MSI_ENDPOINT}, and using the cloud shell to proceed with the authentication.`);
+        logger$9.info(`${msiName$4}: Using the Azure IMDS endpoint coming from the environment variable MSI_ENDPOINT=${process.env.MSI_ENDPOINT}, and using the cloud shell to proceed with the authentication.`);
         let nextDelayInMs = imdsMsiRetryConfig.startDelayInMs;
         for (let retries = 0; retries < imdsMsiRetryConfig.maxRetries; retries++) {
             try {
-                const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$3(scopes, clientId, resourceId)), { allowInsecureConnection: true }));
-                const tokenResponse = await identityClient.sendTokenRequest(request, expiresOnParser$1);
+                const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$4(scopes, clientId, resourceId)), { allowInsecureConnection: true }));
+                const tokenResponse = await identityClient.sendTokenRequest(request, expiresOnParser$2);
                 return (tokenResponse && tokenResponse.accessToken) || null;
             }
             catch (error) {
@@ -2509,20 +2552,20 @@ const imdsMsi = {
                 throw error;
             }
         }
-        throw new AuthenticationError(404, `${msiName$3}: Failed to retrieve IMDS token after ${imdsMsiRetryConfig.maxRetries} retries.`);
+        throw new AuthenticationError(404, `${msiName$4}: Failed to retrieve IMDS token after ${imdsMsiRetryConfig.maxRetries} retries.`);
     },
 };
 
 // Copyright (c) Microsoft Corporation.
-const msiName$2 = "ManagedIdentityCredential - Azure Arc MSI";
-const logger$7 = credentialLogger(msiName$2);
+const msiName$3 = "ManagedIdentityCredential - Azure Arc MSI";
+const logger$8 = credentialLogger(msiName$3);
 /**
  * Generates the options used on the request for an access token.
  */
-function prepareRequestOptions$2(scopes, clientId, resourceId) {
+function prepareRequestOptions$3(scopes, clientId, resourceId) {
     const resource = mapScopesToResource(scopes);
     if (!resource) {
-        throw new Error(`${msiName$2}: Multiple scopes are not supported.`);
+        throw new Error(`${msiName$3}: Multiple scopes are not supported.`);
     }
     const queryParameters = {
         resource,
@@ -2536,7 +2579,7 @@ function prepareRequestOptions$2(scopes, clientId, resourceId) {
     }
     // This error should not bubble up, since we verify that this environment variable is defined in the isAvailable() method defined below.
     if (!process.env.IDENTITY_ENDPOINT) {
-        throw new Error(`${msiName$2}: Missing environment variable: IDENTITY_ENDPOINT`);
+        throw new Error(`${msiName$3}: Missing environment variable: IDENTITY_ENDPOINT`);
     }
     const query = new URLSearchParams(queryParameters);
     return coreRestPipeline.createPipelineRequest({
@@ -2571,7 +2614,7 @@ async function filePathRequest(identityClient, requestPrepareOptions) {
         if (response.bodyAsText) {
             message = ` Response: ${response.bodyAsText}`;
         }
-        throw new AuthenticationError(response.status, `${msiName$2}: To authenticate with Azure Arc MSI, status code 401 is expected on the first request. ${message}`);
+        throw new AuthenticationError(response.status, `${msiName$3}: To authenticate with Azure Arc MSI, status code 401 is expected on the first request. ${message}`);
     }
     const authHeader = response.headers.get("www-authenticate") || "";
     try {
@@ -2588,12 +2631,12 @@ const arcMsi = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$7.info(`${msiName$2}: Unavailable. Multiple scopes are not supported.`);
+            logger$8.info(`${msiName$3}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const result = Boolean(process.env.IMDS_ENDPOINT && process.env.IDENTITY_ENDPOINT);
         if (!result) {
-            logger$7.info(`${msiName$2}: The environment variables needed are: IMDS_ENDPOINT and IDENTITY_ENDPOINT`);
+            logger$8.info(`${msiName$3}: The environment variables needed are: IMDS_ENDPOINT and IDENTITY_ENDPOINT`);
         }
         return result;
     },
@@ -2601,16 +2644,16 @@ const arcMsi = {
         var _a;
         const { identityClient, scopes, clientId, resourceId } = configuration;
         if (clientId) {
-            logger$7.warning(`${msiName$2}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
+            logger$8.warning(`${msiName$3}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
         }
         if (resourceId) {
-            logger$7.warning(`${msiName$2}: user defined managed Identity by resource Id is not supported. Argument resourceId will be ignored.`);
+            logger$8.warning(`${msiName$3}: user defined managed Identity by resource Id is not supported. Argument resourceId will be ignored.`);
         }
-        logger$7.info(`${msiName$2}: Authenticating.`);
-        const requestOptions = Object.assign(Object.assign({ disableJsonStringifyOnBody: true, deserializationMapper: undefined, abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$2(scopes, clientId, resourceId)), { allowInsecureConnection: true });
+        logger$8.info(`${msiName$3}: Authenticating.`);
+        const requestOptions = Object.assign(Object.assign({ disableJsonStringifyOnBody: true, deserializationMapper: undefined, abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$3(scopes, clientId, resourceId)), { allowInsecureConnection: true });
         const filePath = await filePathRequest(identityClient, requestOptions);
         if (!filePath) {
-            throw new Error(`${msiName$2}: Failed to find the token file.`);
+            throw new Error(`${msiName$3}: Failed to find the token file.`);
         }
         const key = await readFileAsync$1(filePath, { encoding: "utf-8" });
         (_a = requestOptions.headers) === null || _a === void 0 ? void 0 : _a.set("Authorization", `Basic ${key}`);
@@ -2623,13 +2666,13 @@ const arcMsi = {
 };
 
 // Copyright (c) Microsoft Corporation.
-const msiName$1 = "ManagedIdentityCredential - Token Exchange";
-const logger$6 = credentialLogger(msiName$1);
+const msiName$2 = "ManagedIdentityCredential - Token Exchange";
+const logger$7 = credentialLogger(msiName$2);
 const readFileAsync = util.promisify(fs__default["default"].readFile);
 /**
  * Generates the options used on the request for an access token.
  */
-function prepareRequestOptions$1(scopes, clientAssertion, clientId) {
+function prepareRequestOptions$2(scopes, clientAssertion, clientId) {
     var _a;
     const bodyParams = {
         scope: Array.isArray(scopes) ? scopes.join(" ") : scopes,
@@ -2680,21 +2723,21 @@ function tokenExchangeMsi() {
             const env = process.env;
             const result = Boolean((clientId || env.AZURE_CLIENT_ID) && env.AZURE_TENANT_ID && azureFederatedTokenFilePath);
             if (!result) {
-                logger$6.info(`${msiName$1}: Unavailable. The environment variables needed are: AZURE_CLIENT_ID (or the client ID sent through the parameters), AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE`);
+                logger$7.info(`${msiName$2}: Unavailable. The environment variables needed are: AZURE_CLIENT_ID (or the client ID sent through the parameters), AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE`);
             }
             return result;
         },
         async getToken(configuration, getTokenOptions = {}) {
             const { identityClient, scopes, clientId } = configuration;
-            logger$6.info(`${msiName$1}: Using the client assertion coming from environment variables.`);
+            logger$7.info(`${msiName$2}: Using the client assertion coming from environment variables.`);
             let assertion;
             try {
                 assertion = await readAssertion();
             }
             catch (err) {
-                throw new Error(`${msiName$1}: Failed to read ${azureFederatedTokenFilePath}, indicated by the environment variable AZURE_FEDERATED_TOKEN_FILE`);
+                throw new Error(`${msiName$2}: Failed to read ${azureFederatedTokenFilePath}, indicated by the environment variable AZURE_FEDERATED_TOKEN_FILE`);
             }
-            const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$1(scopes, assertion, clientId || process.env.AZURE_CLIENT_ID)), { 
+            const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$2(scopes, assertion, clientId || process.env.AZURE_CLIENT_ID)), { 
                 // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
                 allowInsecureConnection: true }));
             const tokenResponse = await identityClient.sendTokenRequest(request);
@@ -2714,22 +2757,22 @@ function tokenExchangeMsi() {
 //
 //   curl --insecure $IDENTITY_ENDPOINT'?api-version=2019-07-01-preview&resource=https://vault.azure.net/' -H "Secret: $IDENTITY_HEADER"
 //
-const msiName = "ManagedIdentityCredential - Fabric MSI";
-const logger$5 = credentialLogger(msiName);
+const msiName$1 = "ManagedIdentityCredential - Fabric MSI";
+const logger$6 = credentialLogger(msiName$1);
 /**
  * Formats the expiration date of the received token into the number of milliseconds between that date and midnight, January 1, 1970.
  */
-function expiresOnParser(requestBody) {
+function expiresOnParser$1(requestBody) {
     // Parses a string representation of the milliseconds since epoch into a number value
     return Number(requestBody.expires_on);
 }
 /**
  * Generates the options used on the request for an access token.
  */
-function prepareRequestOptions(scopes, clientId, resourceId) {
+function prepareRequestOptions$1(scopes, clientId, resourceId) {
     const resource = mapScopesToResource(scopes);
     if (!resource) {
-        throw new Error(`${msiName}: Multiple scopes are not supported.`);
+        throw new Error(`${msiName$1}: Multiple scopes are not supported.`);
     }
     const queryParameters = {
         resource,
@@ -2765,34 +2808,107 @@ const fabricMsi = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$5.info(`${msiName}: Unavailable. Multiple scopes are not supported.`);
+            logger$6.info(`${msiName$1}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const env = process.env;
         const result = Boolean(env.IDENTITY_ENDPOINT && env.IDENTITY_HEADER && env.IDENTITY_SERVER_THUMBPRINT);
         if (!result) {
-            logger$5.info(`${msiName}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT, IDENTITY_HEADER and IDENTITY_SERVER_THUMBPRINT`);
+            logger$6.info(`${msiName$1}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT, IDENTITY_HEADER and IDENTITY_SERVER_THUMBPRINT`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { scopes, identityClient, clientId, resourceId } = configuration;
         if (resourceId) {
-            logger$5.warning(`${msiName}: user defined managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
+            logger$6.warning(`${msiName$1}: user defined managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
         }
-        logger$5.info([
-            `${msiName}:`,
+        logger$6.info([
+            `${msiName$1}:`,
             "Using the endpoint and the secret coming from the environment variables:",
             `IDENTITY_ENDPOINT=${process.env.IDENTITY_ENDPOINT},`,
             "IDENTITY_HEADER=[REDACTED] and",
             "IDENTITY_SERVER_THUMBPRINT=[REDACTED].",
         ].join(" "));
-        const request = coreRestPipeline.createPipelineRequest(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions(scopes, clientId, resourceId)));
+        const request = coreRestPipeline.createPipelineRequest(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$1(scopes, clientId, resourceId)));
         request.agent = new https__default["default"].Agent({
             // This is necessary because Service Fabric provides a self-signed certificate.
             // The alternative path is to verify the certificate using the IDENTITY_SERVER_THUMBPRINT env variable.
             rejectUnauthorized: false,
         });
+        const tokenResponse = await identityClient.sendTokenRequest(request, expiresOnParser$1);
+        return (tokenResponse && tokenResponse.accessToken) || null;
+    },
+};
+
+// Copyright (c) Microsoft Corporation.
+const msiName = "ManagedIdentityCredential - AppServiceMSI 2019";
+const logger$5 = credentialLogger(msiName);
+/**
+ * Formats the expiration date of the received token into the number of milliseconds between that date and midnight, January 1, 1970.
+ */
+function expiresOnParser(requestBody) {
+    // App Service always returns string expires_on values.
+    return Date.parse(requestBody.expires_on);
+}
+/**
+ * Generates the options used on the request for an access token.
+ */
+function prepareRequestOptions(scopes, clientId, resourceId) {
+    const resource = mapScopesToResource(scopes);
+    if (!resource) {
+        throw new Error(`${msiName}: Multiple scopes are not supported.`);
+    }
+    const queryParameters = {
+        resource,
+        "api-version": "2019-08-01",
+    };
+    if (clientId) {
+        queryParameters.client_id = clientId;
+    }
+    if (resourceId) {
+        queryParameters.mi_res_id = resourceId;
+    }
+    const query = new URLSearchParams(queryParameters);
+    // This error should not bubble up, since we verify that this environment variable is defined in the isAvailable() method defined below.
+    if (!process.env.IDENTITY_ENDPOINT) {
+        throw new Error(`${msiName}: Missing environment variable: IDENTITY_ENDPOINT`);
+    }
+    if (!process.env.IDENTITY_HEADER) {
+        throw new Error(`${msiName}: Missing environment variable: IDENTITY_HEADER`);
+    }
+    return {
+        url: `${process.env.IDENTITY_ENDPOINT}?${query.toString()}`,
+        method: "GET",
+        headers: coreRestPipeline.createHttpHeaders({
+            Accept: "application/json",
+            "X-IDENTITY-HEADER": process.env.IDENTITY_HEADER,
+        }),
+    };
+}
+/**
+ * Defines how to determine whether the Azure App Service MSI is available, and also how to retrieve a token from the Azure App Service MSI.
+ */
+const appServiceMsi2019 = {
+    async isAvailable({ scopes }) {
+        const resource = mapScopesToResource(scopes);
+        if (!resource) {
+            logger$5.info(`${msiName}: Unavailable. Multiple scopes are not supported.`);
+            return false;
+        }
+        const env = process.env;
+        const result = Boolean(env.IDENTITY_ENDPOINT && env.IDENTITY_HEADER);
+        if (!result) {
+            logger$5.info(`${msiName}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT and IDENTITY_HEADER.`);
+        }
+        return result;
+    },
+    async getToken(configuration, getTokenOptions = {}) {
+        const { identityClient, scopes, clientId, resourceId } = configuration;
+        logger$5.info(`${msiName}: Using the endpoint and the secret coming form the environment variables: IDENTITY_ENDPOINT=${process.env.IDENTITY_ENDPOINT} and IDENTITY_HEADER=[REDACTED].`);
+        const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions(scopes, clientId, resourceId)), { 
+            // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
+            allowInsecureConnection: true }));
         const tokenResponse = await identityClient.sendTokenRequest(request, expiresOnParser);
         return (tokenResponse && tokenResponse.accessToken) || null;
     },
@@ -2839,7 +2955,15 @@ class ManagedIdentityCredential {
         if (this.cachedMSI) {
             return this.cachedMSI;
         }
-        const MSIs = [fabricMsi, appServiceMsi2017, cloudShellMsi, arcMsi, tokenExchangeMsi(), imdsMsi];
+        const MSIs = [
+            fabricMsi,
+            appServiceMsi2019,
+            appServiceMsi2017,
+            cloudShellMsi,
+            arcMsi,
+            tokenExchangeMsi(),
+            imdsMsi,
+        ];
         for (const msi of MSIs) {
             if (await msi.isAvailable({
                 scopes,
@@ -2981,13 +3105,24 @@ class ManagedIdentityCredential {
  * @internal
  */
 class DefaultManagedIdentityCredential extends ManagedIdentityCredential {
+    // Constructor overload with just the other default options
+    // Last constructor overload with Union of all options not required since the above two constructor overloads have optional properties
     constructor(options) {
         var _a, _b, _c;
         const managedIdentityClientId = (_b = (_a = options) === null || _a === void 0 ? void 0 : _a.managedIdentityClientId) !== null && _b !== void 0 ? _b : process.env.AZURE_CLIENT_ID;
         const managedResourceId = (_c = options) === null || _c === void 0 ? void 0 : _c.managedIdentityResourceId;
         // ManagedIdentityCredential throws if both the resourceId and the clientId are provided.
-        const managedIdentityOptions = Object.assign({ resourceId: managedResourceId, clientId: managedIdentityClientId }, options);
-        super(managedIdentityOptions);
+        if (managedResourceId) {
+            const managedIdentityResourceIdOptions = Object.assign(Object.assign({}, options), { resourceId: managedResourceId });
+            super(managedIdentityResourceIdOptions);
+        }
+        else if (managedIdentityClientId) {
+            const managedIdentityClientOptions = Object.assign(Object.assign({}, options), { clientId: managedIdentityClientId });
+            super(managedIdentityClientOptions);
+        }
+        else {
+            super(options);
+        }
     }
 }
 const defaultCredentials = [
@@ -3002,30 +3137,6 @@ const defaultCredentials = [
  * work for most applications that use the Azure SDK.
  */
 class DefaultAzureCredential extends ChainedTokenCredential {
-    /**
-     * Creates an instance of the DefaultAzureCredential class.
-     *
-     * This credential provides a default {@link ChainedTokenCredential} configuration that should
-     * work for most applications that use the Azure SDK.
-     *
-     * The following credential types will be tried, in order:
-     *
-     * - {@link EnvironmentCredential}
-     * - {@link ManagedIdentityCredential}
-     * - {@link VisualStudioCodeCredential}
-     * - {@link AzureCliCredential}
-     * - {@link AzurePowerShellCredential}
-     *
-     * Consult the documentation of these credential types for more information
-     * on how they attempt authentication.
-     *
-     * **Note**: `VisualStudioCodeCredential` is provided by a plugin package:
-     * `@azure/identity-vscode`. If this package is not installed and registered
-     * using the plugin API (`useIdentityPlugin`), then authentication using
-     * `VisualStudioCodeCredential` will not be available.
-     *
-     * @param options - Optional parameters. See {@link DefaultAzureCredentialOptions}.
-     */
     constructor(options) {
         super(...defaultCredentials.map((ctor) => new ctor(options)));
         this.UnavailableMessage =
@@ -3516,27 +3627,6 @@ const logger = credentialLogger(credentialName);
  * Enables authentication to Azure Active Directory using the [On Behalf Of flow](https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow).
  */
 class OnBehalfOfCredential {
-    /**
-     * Creates an instance of the {@link OnBehalfOfCredential} with the details
-     * needed to authenticate against Azure Active Directory with a client
-     * secret or a path to a PEM certificate, and an user assertion.
-     *
-     * Example using the `KeyClient` from [\@azure/keyvault-keys](https://www.npmjs.com/package/\@azure/keyvault-keys):
-     *
-     * ```ts
-     * const tokenCredential = new OnBehalfOfCredential({
-     *   tenantId,
-     *   clientId,
-     *   clientSecret, // or `certificatePath: "/path/to/certificate.pem"
-     *   userAssertionToken: "access-token"
-     * });
-     * const client = new KeyClient("vault-url", tokenCredential);
-     *
-     * await client.getKey("key-name");
-     * ```
-     *
-     * @param options - Optional parameters, generally common across credentials.
-     */
     constructor(options) {
         this.options = options;
         const { clientSecret } = options;
@@ -3593,7 +3683,7 @@ exports.UsernamePasswordCredential = UsernamePasswordCredential;
 exports.VisualStudioCodeCredential = VisualStudioCodeCredential;
 exports.deserializeAuthenticationRecord = deserializeAuthenticationRecord;
 exports.getDefaultAzureCredential = getDefaultAzureCredential;
-exports.logger = logger$j;
+exports.logger = logger$k;
 exports.serializeAuthenticationRecord = serializeAuthenticationRecord;
 exports.useIdentityPlugin = useIdentityPlugin;
 //# sourceMappingURL=index.js.map