@azure/identity 2.1.0-beta.2 → 2.1.1-alpha.20220803.1

package/dist/index.js

@@ -3,12 +3,12 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var msalNode = require('@azure/msal-node');
-var coreTracing = require('@azure/core-tracing');
 var coreClient = require('@azure/core-client');
 var coreUtil = require('@azure/core-util');
 var coreRestPipeline = require('@azure/core-rest-pipeline');
 var abortController = require('@azure/abort-controller');
-var logger$l = require('@azure/logger');
+var coreTracing = require('@azure/core-tracing');
+var logger$m = require('@azure/logger');
 var msalCommon = require('@azure/msal-common');
 var uuid = require('uuid');
 var fs = require('fs');
@@ -186,6 +186,10 @@ function getIdentityTokenEndpointSuffix(tenantId) {
 
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
+/**
+ * Current version of the `@azure/identity` package.
+ */
+const SDK_VERSION = `2.1.1`;
 /**
  * The default client ID for authentication
  * @internal
@@ -231,49 +235,17 @@ const DefaultAuthorityHost = exports.AzureAuthorityHosts.AzurePublicCloud;
  * Creates a span using the global tracer.
  * @internal
  */
-const createSpan = coreTracing.createSpanFunction({
-    packagePrefix: "",
+const tracingClient = coreTracing.createTracingClient({
     namespace: "Microsoft.AAD",
+    packageName: "@azure/identity",
+    packageVersion: SDK_VERSION,
 });
-/**
- * From: https://github.com/Azure/azure-sdk-for-js/blob/46139daa3317a0d12e8b55b02b9d9cdf1b2e762a/sdk/appconfiguration/app-configuration/src/internal/tracingHelpers.ts
- * Traces an operation and properly handles reporting start, end and errors for a given span
- *
- * @param operationName - Name of a method in the TClient type
- * @param options - An options class, typically derived from \@azure/core-rest-pipeline/RequestOptionsBase
- * @param fn - The function to call with an options class that properly propagates the span context
- *
- * @internal
- */
-async function trace(operationName, options, fn, createSpanFn = createSpan) {
-    const { updatedOptions, span } = createSpanFn(operationName, options);
-    try {
-        // NOTE: we really do need to await on this function here so we can handle any exceptions thrown and properly
-        // close the span.
-        const result = await fn(updatedOptions, span);
-        // otel 0.16+ needs this or else the code ends up being set as UNSET
-        span.setStatus({
-            code: coreTracing.SpanStatusCode.OK,
-        });
-        return result;
-    }
-    catch (err) {
-        span.setStatus({
-            code: coreTracing.SpanStatusCode.ERROR,
-            message: err.message,
-        });
-        throw err;
-    }
-    finally {
-        span.end();
-    }
-}
 
 // Copyright (c) Microsoft Corporation.
 /**
  * The AzureLogger used for all clients within the identity package
  */
-const logger$k = logger$l.createClientLogger("identity");
+const logger$l = logger$m.createClientLogger("identity");
 /**
  * Separates a list of environment variable names into a plain object with two arrays: an array of missing environment variables and another array with assigned environment variables.
  * @param supportedEnvVars - List of environment variable names
@@ -313,7 +285,7 @@ function formatError(scope, error) {
  *   `[title] => [message]`
  *
  */
-function credentialLoggerInstance(title, parent, log = logger$k) {
+function credentialLoggerInstance(title, parent, log = logger$l) {
     const fullTitle = parent ? `${parent.fullTitle} ${title}` : title;
     function info(message) {
         log.info(`${fullTitle} =>`, message);
@@ -338,7 +310,7 @@ function credentialLoggerInstance(title, parent, log = logger$k) {
  *   `[title] => getToken() => [message]`
  *
  */
-function credentialLogger(title, log = logger$k) {
+function credentialLogger(title, log = logger$l) {
     const credLogger = credentialLoggerInstance(title, undefined, log);
     return Object.assign(Object.assign({}, credLogger), { parent: log, getToken: credentialLoggerInstance("=> getToken()", credLogger, log) });
 }
@@ -368,7 +340,7 @@ function getIdentityClientAuthorityHost(options) {
 class IdentityClient extends coreClient.ServiceClient {
     constructor(options) {
         var _a, _b;
-        const packageDetails = `azsdk-js-identity/2.1.0-beta.2`;
+        const packageDetails = `azsdk-js-identity/${SDK_VERSION}`;
         const userAgentPrefix = ((_a = options === null || options === void 0 ? void 0 : options.userAgentOptions) === null || _a === void 0 ? void 0 : _a.userAgentPrefix)
             ? `${options.userAgentOptions.userAgentPrefix} ${packageDetails}`
             : `${packageDetails}`;
@@ -386,7 +358,7 @@ class IdentityClient extends coreClient.ServiceClient {
         this.allowLoggingAccountIdentifiers = (_b = options === null || options === void 0 ? void 0 : options.loggingOptions) === null || _b === void 0 ? void 0 : _b.allowLoggingAccountIdentifiers;
     }
     async sendTokenRequest(request, expiresOnParser) {
-        logger$k.info(`IdentityClient: sending token request to [${request.url}]`);
+        logger$l.info(`IdentityClient: sending token request to [${request.url}]`);
         const response = await this.sendRequest(request);
         expiresOnParser =
             expiresOnParser ||
@@ -406,21 +378,20 @@ class IdentityClient extends coreClient.ServiceClient {
                 },
                 refreshToken: parsedBody.refresh_token,
             };
-            logger$k.info(`IdentityClient: [${request.url}] token acquired, expires on ${token.accessToken.expiresOnTimestamp}`);
+            logger$l.info(`IdentityClient: [${request.url}] token acquired, expires on ${token.accessToken.expiresOnTimestamp}`);
             return token;
         }
         else {
             const error = new AuthenticationError(response.status, response.bodyAsText);
-            logger$k.warning(`IdentityClient: authentication error. HTTP status: ${response.status}, ${error.errorResponse.errorDescription}`);
+            logger$l.warning(`IdentityClient: authentication error. HTTP status: ${response.status}, ${error.errorResponse.errorDescription}`);
             throw error;
         }
     }
-    async refreshAccessToken(tenantId, clientId, scopes, refreshToken, clientSecret, expiresOnParser, options) {
+    async refreshAccessToken(tenantId, clientId, scopes, refreshToken, clientSecret, expiresOnParser, options = {}) {
         if (refreshToken === undefined) {
             return null;
         }
-        logger$k.info(`IdentityClient: refreshing access token with client ID: ${clientId}, scopes: ${scopes} started`);
-        const { span, updatedOptions } = createSpan("IdentityClient-refreshAccessToken", options);
+        logger$l.info(`IdentityClient: refreshing access token with client ID: ${clientId}, scopes: ${scopes} started`);
         const refreshParams = {
             grant_type: "refresh_token",
             client_id: clientId,
@@ -431,48 +402,39 @@ class IdentityClient extends coreClient.ServiceClient {
             refreshParams.client_secret = clientSecret;
         }
         const query = new URLSearchParams(refreshParams);
-        try {
-            const urlSuffix = getIdentityTokenEndpointSuffix(tenantId);
-            const request = coreRestPipeline.createPipelineRequest({
-                url: `${this.authorityHost}/${tenantId}/${urlSuffix}`,
-                method: "POST",
-                body: query.toString(),
-                abortSignal: options && options.abortSignal,
-                headers: coreRestPipeline.createHttpHeaders({
-                    Accept: "application/json",
-                    "Content-Type": "application/x-www-form-urlencoded",
-                }),
-                tracingOptions: updatedOptions === null || updatedOptions === void 0 ? void 0 : updatedOptions.tracingOptions,
-            });
-            const response = await this.sendTokenRequest(request, expiresOnParser);
-            logger$k.info(`IdentityClient: refreshed token for client ID: ${clientId}`);
-            return response;
-        }
-        catch (err) {
-            if (err.name === AuthenticationErrorName &&
-                err.errorResponse.error === "interaction_required") {
-                // It's likely that the refresh token has expired, so
-                // return null so that the credential implementation will
-                // initiate the authentication flow again.
-                logger$k.info(`IdentityClient: interaction required for client ID: ${clientId}`);
-                span.setStatus({
-                    code: coreTracing.SpanStatusCode.ERROR,
-                    message: err.message,
+        return tracingClient.withSpan("IdentityClient.refreshAccessToken", options, async (updatedOptions) => {
+            try {
+                const urlSuffix = getIdentityTokenEndpointSuffix(tenantId);
+                const request = coreRestPipeline.createPipelineRequest({
+                    url: `${this.authorityHost}/${tenantId}/${urlSuffix}`,
+                    method: "POST",
+                    body: query.toString(),
+                    abortSignal: options.abortSignal,
+                    headers: coreRestPipeline.createHttpHeaders({
+                        Accept: "application/json",
+                        "Content-Type": "application/x-www-form-urlencoded",
+                    }),
+                    tracingOptions: updatedOptions.tracingOptions,
                 });
-                return null;
+                const response = await this.sendTokenRequest(request, expiresOnParser);
+                logger$l.info(`IdentityClient: refreshed token for client ID: ${clientId}`);
+                return response;
             }
-            else {
-                logger$k.warning(`IdentityClient: failed refreshing token for client ID: ${clientId}: ${err}`);
-                span.setStatus({
-                    code: coreTracing.SpanStatusCode.ERROR,
-                    message: err.message,
-                });
-                throw err;
+            catch (err) {
+                if (err.name === AuthenticationErrorName &&
+                    err.errorResponse.error === "interaction_required") {
+                    // It's likely that the refresh token has expired, so
+                    // return null so that the credential implementation will
+                    // initiate the authentication flow again.
+                    logger$l.info(`IdentityClient: interaction required for client ID: ${clientId}`);
+                    return null;
+                }
+                else {
+                    logger$l.warning(`IdentityClient: failed refreshing token for client ID: ${clientId}: ${err}`);
+                    throw err;
+                }
             }
-        }
-        finally {
-            span.end();
-        }
+        });
     }
     // Here is a custom layer that allows us to abort requests that go through MSAL,
     // since MSAL doesn't allow us to pass options all the way through.
@@ -570,10 +532,10 @@ class IdentityClient extends coreClient.ServiceClient {
             }
             const base64Metadata = accessToken.split(".")[1];
             const { appid, upn, tid, oid } = JSON.parse(Buffer.from(base64Metadata, "base64").toString("utf8"));
-            logger$k.info(`[Authenticated account] Client ID: ${appid}. Tenant ID: ${tid}. User Principal Name: ${upn || unavailableUpn}. Object ID (user): ${oid}`);
+            logger$l.info(`[Authenticated account] Client ID: ${appid}. Tenant ID: ${tid}. User Principal Name: ${upn || unavailableUpn}. Object ID (user): ${oid}`);
         }
         catch (e) {
-            logger$k.warning("allowLoggingAccountIdentifiers was set, but we couldn't log the account information. Error:", e.message);
+            logger$l.warning("allowLoggingAccountIdentifiers was set, but we couldn't log the account information. Error:", e.message);
         }
     }
 }
@@ -989,6 +951,9 @@ class MsalNode extends MsalBaseUtilities {
         this.msalConfig = this.defaultNodeMsalConfig(options);
         this.tenantId = resolveTenantId(options.logger, options.tenantId, options.clientId);
         this.clientId = this.msalConfig.auth.clientId;
+        if (options === null || options === void 0 ? void 0 : options.getAssertion) {
+            this.getAssertion = options.getAssertion;
+        }
         // If persistence has been configured
         if (persistenceProvider !== undefined && ((_a = options.tokenCachePersistenceOptions) === null || _a === void 0 ? void 0 : _a.enabled)) {
             this.createCachePlugin = () => persistenceProvider(options.tokenCachePersistenceOptions);
@@ -1055,6 +1020,9 @@ class MsalNode extends MsalBaseUtilities {
             };
         }
         this.publicApp = new msalNode__namespace.PublicClientApplication(this.msalConfig);
+        if (this.getAssertion) {
+            this.msalConfig.auth.clientAssertion = await this.getAssertion();
+        }
         // The confidential client requires either a secret, assertion or certificate.
         if (this.msalConfig.auth.clientSecret ||
             this.msalConfig.auth.clientAssertion ||
@@ -1184,7 +1152,7 @@ To work with multiple accounts for the same Client ID and Tenant ID, please prov
 // Copyright (c) Microsoft Corporation.
 const CommonTenantId = "common";
 const AzureAccountClientId = "aebc6443-996d-45c2-90f0-388ff96faa56"; // VSC: 'aebc6443-996d-45c2-90f0-388ff96faa56'
-const logger$j = credentialLogger("VisualStudioCodeCredential");
+const logger$k = credentialLogger("VisualStudioCodeCredential");
 let findCredentials = undefined;
 const vsCodeCredentialControl = {
     setVsCodeCredentialFinder(finder) {
@@ -1237,7 +1205,7 @@ function getPropertyFromVSCode(property) {
         }
     }
     catch (e) {
-        logger$j.info(`Failed to load the Visual Studio Code configuration file. Error: ${e.message}`);
+        logger$k.info(`Failed to load the Visual Studio Code configuration file. Error: ${e.message}`);
         return;
     }
 }
@@ -1265,7 +1233,7 @@ class VisualStudioCodeCredential {
         const authorityHost = mapVSCodeAuthorityHosts[this.cloudName];
         this.identityClient = new IdentityClient(Object.assign({ authorityHost }, options));
         if (options && options.tenantId) {
-            checkTenantId(logger$j, options.tenantId);
+            checkTenantId(logger$k, options.tenantId);
             this.tenantId = options.tenantId;
         }
         else {
@@ -1317,7 +1285,7 @@ class VisualStudioCodeCredential {
         // Check to make sure the scope we get back is a valid scope
         if (!scopeString.match(/^[0-9a-zA-Z-.:/]+$/)) {
             const error = new Error("Invalid scope was specified by the user or calling client");
-            logger$j.getToken.info(formatError(scopes, error));
+            logger$k.getToken.info(formatError(scopes, error));
             throw error;
         }
         if (scopeString.indexOf("offline_access") < 0) {
@@ -1337,18 +1305,18 @@ class VisualStudioCodeCredential {
         if (refreshToken) {
             const tokenResponse = await this.identityClient.refreshAccessToken(tenantId, AzureAccountClientId, scopeString, refreshToken, undefined);
             if (tokenResponse) {
-                logger$j.getToken.info(formatSuccess(scopes));
+                logger$k.getToken.info(formatSuccess(scopes));
                 return tokenResponse.accessToken;
             }
             else {
                 const error = new CredentialUnavailableError("Could not retrieve the token associated with Visual Studio Code. Have you connected using the 'Azure Account' extension recently? To troubleshoot, visit https://aka.ms/azsdk/js/identity/vscodecredential/troubleshoot.");
-                logger$j.getToken.info(formatError(scopes, error));
+                logger$k.getToken.info(formatError(scopes, error));
                 throw error;
             }
         }
         else {
             const error = new CredentialUnavailableError("Could not retrieve the token associated with Visual Studio Code. Did you connect using the 'Azure Account' extension? To troubleshoot, visit https://aka.ms/azsdk/js/identity/vscodecredential/troubleshoot.");
-            logger$j.getToken.info(formatError(scopes, error));
+            logger$k.getToken.info(formatError(scopes, error));
             throw error;
         }
     }
@@ -1399,7 +1367,7 @@ function useIdentityPlugin(plugin) {
 /**
  * @internal
  */
-const logger$i = credentialLogger("ChainedTokenCredential");
+const logger$j = credentialLogger("ChainedTokenCredential");
 /**
  * Enables multiple `TokenCredential` implementations to be tried in order
  * until one of the getToken methods returns an access token.
@@ -1438,42 +1406,38 @@ class ChainedTokenCredential {
      * @param options - The options used to configure any requests this
      *                `TokenCredential` implementation might make.
      */
-    async getToken(scopes, options) {
+    async getToken(scopes, options = {}) {
         let token = null;
         let successfulCredentialName = "";
         const errors = [];
-        const { span, updatedOptions } = createSpan("ChainedTokenCredential.getToken", options);
-        for (let i = 0; i < this._sources.length && token === null; i++) {
-            try {
-                token = await this._sources[i].getToken(scopes, updatedOptions);
-                successfulCredentialName = this._sources[i].constructor.name;
-            }
-            catch (err) {
-                if (err.name === "CredentialUnavailableError" ||
-                    err.name === "AuthenticationRequiredError") {
-                    errors.push(err);
+        return tracingClient.withSpan("ChainedTokenCredential.getToken", options, async (updatedOptions) => {
+            for (let i = 0; i < this._sources.length && token === null; i++) {
+                try {
+                    token = await this._sources[i].getToken(scopes, updatedOptions);
+                    successfulCredentialName = this._sources[i].constructor.name;
                 }
-                else {
-                    logger$i.getToken.info(formatError(scopes, err));
-                    throw err;
+                catch (err) {
+                    if (err.name === "CredentialUnavailableError" ||
+                        err.name === "AuthenticationRequiredError") {
+                        errors.push(err);
+                    }
+                    else {
+                        logger$j.getToken.info(formatError(scopes, err));
+                        throw err;
+                    }
                 }
             }
-        }
-        if (!token && errors.length > 0) {
-            const err = new AggregateAuthenticationError(errors, "ChainedTokenCredential authentication failed.");
-            span.setStatus({
-                code: coreTracing.SpanStatusCode.ERROR,
-                message: err.message,
-            });
-            logger$i.getToken.info(formatError(scopes, err));
-            throw err;
-        }
-        span.end();
-        logger$i.getToken.info(`Result for ${successfulCredentialName}: ${formatSuccess(scopes)}`);
-        if (token === null) {
-            throw new CredentialUnavailableError("Failed to retrieve a valid token");
-        }
-        return token;
+            if (!token && errors.length > 0) {
+                const err = new AggregateAuthenticationError(errors, "ChainedTokenCredential authentication failed.");
+                logger$j.getToken.info(formatError(scopes, err));
+                throw err;
+            }
+            logger$j.getToken.info(`Result for ${successfulCredentialName}: ${formatSuccess(scopes)}`);
+            if (token === null) {
+                throw new CredentialUnavailableError("Failed to retrieve a valid token");
+            }
+            return token;
+        });
     }
 }
 
@@ -1547,7 +1511,7 @@ const cliCredentialInternals = {
         });
     },
 };
-const logger$h = credentialLogger("AzureCliCredential");
+const logger$i = credentialLogger("AzureCliCredential");
 /**
  * This credential will use the currently logged-in user login information
  * via the Azure CLI ('az') commandline tool.
@@ -1574,56 +1538,57 @@ class AzureCliCredential {
      * @param options - The options used to configure any requests this
      *                TokenCredential implementation might make.
      */
-    async getToken(scopes, options) {
+    async getToken(scopes, options = {}) {
         const tenantId = processMultiTenantRequest(this.tenantId, options);
         if (tenantId) {
-            checkTenantId(logger$h, tenantId);
+            checkTenantId(logger$i, tenantId);
         }
         const scope = typeof scopes === "string" ? scopes : scopes[0];
-        logger$h.getToken.info(`Using the scope ${scope}`);
-        ensureValidScope(scope, logger$h);
+        logger$i.getToken.info(`Using the scope ${scope}`);
+        ensureValidScope(scope, logger$i);
         const resource = getScopeResource(scope);
-        let responseData = "";
-        const { span } = createSpan(`${this.constructor.name}.getToken`, options);
-        try {
-            const obj = await cliCredentialInternals.getAzureCliAccessToken(resource, tenantId);
-            if (obj.stderr) {
-                const isLoginError = obj.stderr.match("(.*)az login(.*)");
-                const isNotInstallError = obj.stderr.match("az:(.*)not found") || obj.stderr.startsWith("'az' is not recognized");
+        return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
+            var _a, _b, _c, _d;
+            try {
+                const obj = await cliCredentialInternals.getAzureCliAccessToken(resource, tenantId);
+                const specificScope = (_a = obj.stderr) === null || _a === void 0 ? void 0 : _a.match("(.*)az login --scope(.*)");
+                const isLoginError = ((_b = obj.stderr) === null || _b === void 0 ? void 0 : _b.match("(.*)az login(.*)")) && !specificScope;
+                const isNotInstallError = ((_c = obj.stderr) === null || _c === void 0 ? void 0 : _c.match("az:(.*)not found")) || ((_d = obj.stderr) === null || _d === void 0 ? void 0 : _d.startsWith("'az' is not recognized"));
                 if (isNotInstallError) {
-                    const error = new CredentialUnavailableError("Azure CLI could not be found.  Please visit https://aka.ms/azure-cli for installation instructions and then, once installed, authenticate to your Azure account using 'az login'.");
-                    logger$h.getToken.info(formatError(scopes, error));
+                    const error = new CredentialUnavailableError("Azure CLI could not be found. Please visit https://aka.ms/azure-cli for installation instructions and then, once installed, authenticate to your Azure account using 'az login'.");
+                    logger$i.getToken.info(formatError(scopes, error));
                     throw error;
                 }
-                else if (isLoginError) {
+                if (isLoginError) {
                     const error = new CredentialUnavailableError("Please run 'az login' from a command prompt to authenticate before using this credential.");
-                    logger$h.getToken.info(formatError(scopes, error));
+                    logger$i.getToken.info(formatError(scopes, error));
                     throw error;
                 }
-                const error = new CredentialUnavailableError(obj.stderr);
-                logger$h.getToken.info(formatError(scopes, error));
-                throw error;
+                try {
+                    const responseData = obj.stdout;
+                    const response = JSON.parse(responseData);
+                    logger$i.getToken.info(formatSuccess(scopes));
+                    const returnValue = {
+                        token: response.accessToken,
+                        expiresOnTimestamp: new Date(response.expiresOn).getTime(),
+                    };
+                    return returnValue;
+                }
+                catch (e) {
+                    if (obj.stderr) {
+                        throw new CredentialUnavailableError(obj.stderr);
+                    }
+                    throw e;
+                }
             }
-            else {
-                responseData = obj.stdout;
-                const response = JSON.parse(responseData);
-                logger$h.getToken.info(formatSuccess(scopes));
-                const returnValue = {
-                    token: response.accessToken,
-                    expiresOnTimestamp: new Date(response.expiresOn).getTime(),
-                };
-                return returnValue;
+            catch (err) {
+                const error = err.name === "CredentialUnavailableError"
+                    ? err
+                    : new CredentialUnavailableError(err.message || "Unknown error while trying to retrieve the access token");
+                logger$i.getToken.info(formatError(scopes, error));
+                throw error;
             }
-        }
-        catch (err) {
-            const error = new Error(err.message || "Unknown error while trying to retrieve the access token");
-            span.setStatus({
-                code: coreTracing.SpanStatusCode.ERROR,
-                message: error.message,
-            });
-            logger$h.getToken.info(formatError(scopes, error));
-            throw error;
-        }
+        });
     }
 }
 
@@ -1658,7 +1623,7 @@ const processUtils = {
 };
 
 // Copyright (c) Microsoft Corporation.
-const logger$g = credentialLogger("AzurePowerShellCredential");
+const logger$h = credentialLogger("AzurePowerShellCredential");
 const isWindows = process.platform === "win32";
 /**
  * Returns a platform-appropriate command name by appending ".exe" on Windows.
@@ -1786,18 +1751,18 @@ class AzurePowerShellCredential {
      * @param options - The options used to configure any requests this TokenCredential implementation might make.
      */
     async getToken(scopes, options = {}) {
-        return trace(`${this.constructor.name}.getToken`, options, async () => {
+        return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async () => {
             const tenantId = processMultiTenantRequest(this.tenantId, options);
             if (tenantId) {
-                checkTenantId(logger$g, tenantId);
+                checkTenantId(logger$h, tenantId);
             }
             const scope = typeof scopes === "string" ? scopes : scopes[0];
-            ensureValidScope(scope, logger$g);
-            logger$g.getToken.info(`Using the scope ${scope}`);
+            ensureValidScope(scope, logger$h);
+            logger$h.getToken.info(`Using the scope ${scope}`);
             const resource = getScopeResource(scope);
             try {
                 const response = await this.getAzurePowerShellAccessToken(resource, tenantId);
-                logger$g.getToken.info(formatSuccess(scopes));
+                logger$h.getToken.info(formatSuccess(scopes));
                 return {
                     token: response.Token,
                     expiresOnTimestamp: new Date(response.ExpiresOn).getTime(),
@@ -1806,16 +1771,16 @@ class AzurePowerShellCredential {
             catch (err) {
                 if (isNotInstalledError(err)) {
                     const error = new CredentialUnavailableError(powerShellPublicErrorMessages.installed);
-                    logger$g.getToken.info(formatError(scope, error));
+                    logger$h.getToken.info(formatError(scope, error));
                     throw error;
                 }
                 else if (isLoginError(err)) {
                     const error = new CredentialUnavailableError(powerShellPublicErrorMessages.login);
-                    logger$g.getToken.info(formatError(scope, error));
+                    logger$h.getToken.info(formatError(scope, error));
                     throw error;
                 }
                 const error = new CredentialUnavailableError(`${err}. ${powerShellPublicErrorMessages.troubleshoot}`);
-                logger$g.getToken.info(formatError(scope, error));
+                logger$h.getToken.info(formatError(scope, error));
                 throw error;
             }
         });
@@ -1853,7 +1818,7 @@ class MsalClientSecret extends MsalNode {
 }
 
 // Copyright (c) Microsoft Corporation.
-const logger$f = credentialLogger("ClientSecretCredential");
+const logger$g = credentialLogger("ClientSecretCredential");
 /**
  * Enables authentication to Azure Active Directory using a client secret
  * that was generated for an App Registration. More information on how
@@ -1877,7 +1842,7 @@ class ClientSecretCredential {
         if (!tenantId || !clientId || !clientSecret) {
             throw new Error("ClientSecretCredential: tenantId, clientId, and clientSecret are required parameters. To troubleshoot, visit https://aka.ms/azsdk/js/identity/serviceprincipalauthentication/troubleshoot.");
         }
-        this.msalFlow = new MsalClientSecret(Object.assign(Object.assign({}, options), { logger: logger$f,
+        this.msalFlow = new MsalClientSecret(Object.assign(Object.assign({}, options), { logger: logger$g,
             clientId,
             tenantId,
             clientSecret, tokenCredentialOptions: options }));
@@ -1891,7 +1856,7 @@ class ClientSecretCredential {
      *                TokenCredential implementation might make.
      */
     async getToken(scopes, options = {}) {
-        return trace(`${this.constructor.name}.getToken`, options, async (newOptions) => {
+        return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
             const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
             return this.msalFlow.getToken(arrayScopes, newOptions);
         });
@@ -1953,9 +1918,26 @@ class MsalClientCertificate extends MsalNode {
     async init(options) {
         try {
             const parts = await parseCertificate(this.configuration, this.sendCertificateChain);
+            let privateKey;
+            if (this.configuration.certificatePassword !== undefined) {
+                const privateKeyObject = crypto.createPrivateKey({
+                    key: parts.certificateContents,
+                    passphrase: this.configuration.certificatePassword,
+                    format: "pem",
+                });
+                privateKey = privateKeyObject
+                    .export({
+                    format: "pem",
+                    type: "pkcs8",
+                })
+                    .toString();
+            }
+            else {
+                privateKey = parts.certificateContents;
+            }
             this.msalConfig.auth.clientCertificate = {
                 thumbprint: parts.thumbprint,
-                privateKey: parts.certificateContents,
+                privateKey: privateKey,
                 x5c: parts.x5c,
             };
         }
@@ -1967,13 +1949,14 @@ class MsalClientCertificate extends MsalNode {
     }
     async doGetToken(scopes, options = {}) {
         try {
-            const result = await this.confidentialApp.acquireTokenByClientCredential({
+            const clientCredReq = {
                 scopes,
                 correlationId: options.correlationId,
                 azureRegion: this.azureRegion,
                 authority: options.authority,
                 claims: options.claims,
-            });
+            };
+            const result = await this.confidentialApp.acquireTokenByClientCredential(clientCredReq);
             // Even though we're providing the same default in memory persistence cache that we use for DeviceCodeCredential,
             // The Client Credential flow does not return the account information from the authentication service,
             // so each time getToken gets called, we will have to acquire a new token through the service.
@@ -1987,7 +1970,7 @@ class MsalClientCertificate extends MsalNode {
 
 // Copyright (c) Microsoft Corporation.
 const credentialName$2 = "ClientCertificateCredential";
-const logger$e = credentialLogger(credentialName$2);
+const logger$f = credentialLogger(credentialName$2);
 /**
  * Enables authentication to Azure Active Directory using a PEM-encoded
  * certificate that is assigned to an App Registration. More information
@@ -2016,7 +1999,7 @@ class ClientCertificateCredential {
             throw new Error(`${credentialName$2}: To avoid unexpected behaviors, providing both the contents of a PEM certificate and the path to a PEM certificate is forbidden. To troubleshoot, visit https://aka.ms/azsdk/js/identity/serviceprincipalauthentication/troubleshoot.`);
         }
         this.msalFlow = new MsalClientCertificate(Object.assign(Object.assign({}, options), { configuration,
-            logger: logger$e,
+            logger: logger$f,
             clientId,
             tenantId, sendCertificateChain: options.sendCertificateChain, tokenCredentialOptions: options }));
     }
@@ -2029,7 +2012,7 @@ class ClientCertificateCredential {
      *                TokenCredential implementation might make.
      */
     async getToken(scopes, options = {}) {
-        return trace(`${credentialName$2}.getToken`, options, async (newOptions) => {
+        return tracingClient.withSpan(`${credentialName$2}.getToken`, options, async (newOptions) => {
             const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
             return this.msalFlow.getToken(arrayScopes, newOptions);
         });
@@ -2067,7 +2050,7 @@ class MsalUsernamePassword extends MsalNode {
 }
 
 // Copyright (c) Microsoft Corporation.
-const logger$d = credentialLogger("UsernamePasswordCredential");
+const logger$e = credentialLogger("UsernamePasswordCredential");
 /**
  * Enables authentication to Azure Active Directory with a user's
  * username and password. This credential requires a high degree of
@@ -2090,7 +2073,7 @@ class UsernamePasswordCredential {
         if (!tenantId || !clientId || !username || !password) {
             throw new Error("UsernamePasswordCredential: tenantId, clientId, username and password are required parameters. To troubleshoot, visit https://aka.ms/azsdk/js/identity/usernamepasswordcredential/troubleshoot.");
         }
-        this.msalFlow = new MsalUsernamePassword(Object.assign(Object.assign({}, options), { logger: logger$d,
+        this.msalFlow = new MsalUsernamePassword(Object.assign(Object.assign({}, options), { logger: logger$e,
             clientId,
             tenantId,
             username,
@@ -2109,7 +2092,7 @@ class UsernamePasswordCredential {
      *                TokenCredential implementation might make.
      */
     async getToken(scopes, options = {}) {
-        return trace(`${this.constructor.name}.getToken`, options, async (newOptions) => {
+        return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
             const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
             return this.msalFlow.getToken(arrayScopes, newOptions);
         });
@@ -2129,11 +2112,12 @@ const AllSupportedEnvironmentVariables = [
     "AZURE_CLIENT_ID",
     "AZURE_CLIENT_SECRET",
     "AZURE_CLIENT_CERTIFICATE_PATH",
+    "AZURE_CLIENT_CERTIFICATE_PASSWORD",
     "AZURE_USERNAME",
     "AZURE_PASSWORD",
 ];
 const credentialName$1 = "EnvironmentCredential";
-const logger$c = credentialLogger(credentialName$1);
+const logger$d = credentialLogger(credentialName$1);
 /**
  * Enables authentication to Azure Active Directory using client secret
  * details configured in environment variables
@@ -2149,6 +2133,7 @@ class EnvironmentCredential {
      * Environment variables used for client credential authentication:
      * - `AZURE_CLIENT_SECRET`: A client secret that was generated for the App Registration.
      * - `AZURE_CLIENT_CERTIFICATE_PATH`: The path to a PEM certificate to use during the authentication, instead of the client secret.
+     * - `AZURE_CLIENT_CERTIFICATE_PASSWORD`: (optional) password for the certificate file.
      *
      * Alternatively, users can provide environment variables for username and password authentication:
      * - `AZURE_USERNAME`: Username to authenticate with.
@@ -2163,26 +2148,27 @@ class EnvironmentCredential {
         // Keep track of any missing environment variables for error details
         this._credential = undefined;
         const assigned = processEnvVars(AllSupportedEnvironmentVariables).assigned.join(", ");
-        logger$c.info(`Found the following environment variables: ${assigned}`);
+        logger$d.info(`Found the following environment variables: ${assigned}`);
         const tenantId = process.env.AZURE_TENANT_ID, clientId = process.env.AZURE_CLIENT_ID, clientSecret = process.env.AZURE_CLIENT_SECRET;
         if (tenantId) {
-            checkTenantId(logger$c, tenantId);
+            checkTenantId(logger$d, tenantId);
         }
         if (tenantId && clientId && clientSecret) {
-            logger$c.info(`Invoking ClientSecretCredential with tenant ID: ${tenantId}, clientId: ${clientId} and clientSecret: [REDACTED]`);
+            logger$d.info(`Invoking ClientSecretCredential with tenant ID: ${tenantId}, clientId: ${clientId} and clientSecret: [REDACTED]`);
             this._credential = new ClientSecretCredential(tenantId, clientId, clientSecret, options);
             return;
         }
         const certificatePath = process.env.AZURE_CLIENT_CERTIFICATE_PATH;
+        const certificatePassword = process.env.AZURE_CLIENT_CERTIFICATE_PASSWORD;
         if (tenantId && clientId && certificatePath) {
-            logger$c.info(`Invoking ClientCertificateCredential with tenant ID: ${tenantId}, clientId: ${clientId} and certificatePath: ${certificatePath}`);
-            this._credential = new ClientCertificateCredential(tenantId, clientId, { certificatePath }, options);
+            logger$d.info(`Invoking ClientCertificateCredential with tenant ID: ${tenantId}, clientId: ${clientId} and certificatePath: ${certificatePath}`);
+            this._credential = new ClientCertificateCredential(tenantId, clientId, { certificatePath, certificatePassword }, options);
             return;
         }
         const username = process.env.AZURE_USERNAME;
         const password = process.env.AZURE_PASSWORD;
         if (tenantId && clientId && username && password) {
-            logger$c.info(`Invoking UsernamePasswordCredential with tenant ID: ${tenantId}, clientId: ${clientId} and username: ${username}`);
+            logger$d.info(`Invoking UsernamePasswordCredential with tenant ID: ${tenantId}, clientId: ${clientId} and username: ${username}`);
             this._credential = new UsernamePasswordCredential(tenantId, clientId, username, password, options);
         }
     }
@@ -2193,11 +2179,11 @@ class EnvironmentCredential {
      * @param options - Optional parameters. See {@link GetTokenOptions}.
      */
     async getToken(scopes, options = {}) {
-        return trace(`${credentialName$1}.getToken`, options, async (newOptions) => {
+        return tracingClient.withSpan(`${credentialName$1}.getToken`, options, async (newOptions) => {
             if (this._credential) {
                 try {
                     const result = await this._credential.getToken(scopes, newOptions);
-                    logger$c.getToken.info(formatSuccess(scopes));
+                    logger$d.getToken.info(formatSuccess(scopes));
                     return result;
                 }
                 catch (err) {
@@ -2205,7 +2191,7 @@ class EnvironmentCredential {
                         error: `${credentialName$1} authentication failed. To troubleshoot, visit https://aka.ms/azsdk/js/identity/environmentcredential/troubleshoot.`,
                         error_description: err.message.toString().split("More details:").join(""),
                     });
-                    logger$c.getToken.info(formatError(scopes, authenticationError));
+                    logger$d.getToken.info(formatError(scopes, authenticationError));
                     throw authenticationError;
                 }
             }
@@ -2252,7 +2238,7 @@ function mapScopesToResource(scopes) {
 
 // Copyright (c) Microsoft Corporation.
 const msiName$6 = "ManagedIdentityCredential - AppServiceMSI 2017";
-const logger$b = credentialLogger(msiName$6);
+const logger$c = credentialLogger(msiName$6);
 /**
  * Formats the expiration date of the received token into the number of milliseconds between that date and midnight, January 1, 1970.
  */
@@ -2299,22 +2285,22 @@ const appServiceMsi2017 = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$b.info(`${msiName$6}: Unavailable. Multiple scopes are not supported.`);
+            logger$c.info(`${msiName$6}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const env = process.env;
         const result = Boolean(env.MSI_ENDPOINT && env.MSI_SECRET);
         if (!result) {
-            logger$b.info(`${msiName$6}: Unavailable. The environment variables needed are: MSI_ENDPOINT and MSI_SECRET.`);
+            logger$c.info(`${msiName$6}: Unavailable. The environment variables needed are: MSI_ENDPOINT and MSI_SECRET.`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
         if (resourceId) {
-            logger$b.warning(`${msiName$6}: managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
+            logger$c.warning(`${msiName$6}: managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
         }
-        logger$b.info(`${msiName$6}: Using the endpoint and the secret coming form the environment variables: MSI_ENDPOINT=${process.env.MSI_ENDPOINT} and MSI_SECRET=[REDACTED].`);
+        logger$c.info(`${msiName$6}: Using the endpoint and the secret coming form the environment variables: MSI_ENDPOINT=${process.env.MSI_ENDPOINT} and MSI_SECRET=[REDACTED].`);
         const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$6(scopes, clientId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
@@ -2325,7 +2311,7 @@ const appServiceMsi2017 = {
 
 // Copyright (c) Microsoft Corporation.
 const msiName$5 = "ManagedIdentityCredential - CloudShellMSI";
-const logger$a = credentialLogger(msiName$5);
+const logger$b = credentialLogger(msiName$5);
 /**
  * Generates the options used on the request for an access token.
  */
@@ -2367,24 +2353,24 @@ const cloudShellMsi = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$a.info(`${msiName$5}: Unavailable. Multiple scopes are not supported.`);
+            logger$b.info(`${msiName$5}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const result = Boolean(process.env.MSI_ENDPOINT);
         if (!result) {
-            logger$a.info(`${msiName$5}: Unavailable. The environment variable MSI_ENDPOINT is needed.`);
+            logger$b.info(`${msiName$5}: Unavailable. The environment variable MSI_ENDPOINT is needed.`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
         if (clientId) {
-            logger$a.warning(`${msiName$5}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
+            logger$b.warning(`${msiName$5}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
         }
         if (resourceId) {
-            logger$a.warning(`${msiName$5}: user defined managed Identity by resource Id not supported. The argument resourceId might be ignored by the service.`);
+            logger$b.warning(`${msiName$5}: user defined managed Identity by resource Id not supported. The argument resourceId might be ignored by the service.`);
         }
-        logger$a.info(`${msiName$5}: Using the endpoint coming form the environment variable MSI_ENDPOINT = ${process.env.MSI_ENDPOINT}.`);
+        logger$b.info(`${msiName$5}: Using the endpoint coming form the environment variable MSI_ENDPOINT = ${process.env.MSI_ENDPOINT}.`);
         const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$5(scopes, clientId, resourceId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
@@ -2395,7 +2381,7 @@ const cloudShellMsi = {
 
 // Copyright (c) Microsoft Corporation.
 const msiName$4 = "ManagedIdentityCredential - IMDS";
-const logger$9 = credentialLogger(msiName$4);
+const logger$a = credentialLogger(msiName$4);
 /**
  * Formats the expiration date of the received token into the number of milliseconds between that date and midnight, January 1, 1970.
  */
@@ -2403,13 +2389,13 @@ function expiresOnParser$2(requestBody) {
     if (requestBody.expires_on) {
         // Use the expires_on timestamp if it's available
         const expires = +requestBody.expires_on * 1000;
-        logger$9.info(`${msiName$4}: Using expires_on: ${expires} (original value: ${requestBody.expires_on})`);
+        logger$a.info(`${msiName$4}: Using expires_on: ${expires} (original value: ${requestBody.expires_on})`);
         return expires;
     }
     else {
         // If these aren't possible, use expires_in and calculate a timestamp
         const expires = Date.now() + requestBody.expires_in * 1000;
-        logger$9.info(`${msiName$4}: IMDS using expires_in: ${expires} (original value: ${requestBody.expires_in})`);
+        logger$a.info(`${msiName$4}: IMDS using expires_in: ${expires} (original value: ${requestBody.expires_in})`);
         return expires;
     }
 }
@@ -2466,14 +2452,12 @@ const imdsMsiRetryConfig = {
  * Defines how to determine whether the Azure IMDS MSI is available, and also how to retrieve a token from the Azure IMDS MSI.
  */
 const imdsMsi = {
-    async isAvailable({ scopes, identityClient, clientId, resourceId, getTokenOptions, }) {
-        var _a, _b;
+    async isAvailable({ scopes, identityClient, clientId, resourceId, getTokenOptions = {}, }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$9.info(`${msiName$4}: Unavailable. Multiple scopes are not supported.`);
+            logger$a.info(`${msiName$4}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
-        const { span, updatedOptions: options } = createSpan("ManagedIdentityCredential-pingImdsEndpoint", getTokenOptions);
         // if the PodIdentityEndpoint environment variable was set no need to probe the endpoint, it can be assumed to exist
         if (process.env.AZURE_POD_IDENTITY_AUTHORITY_HOST) {
             return true;
@@ -2485,57 +2469,49 @@ const imdsMsi = {
             skipMetadataHeader: true,
             skipQuery: true,
         });
-        requestOptions.tracingOptions = options.tracingOptions;
-        try {
-            // Create a request with a timeout since we expect that
-            // not having a "Metadata" header should cause an error to be
-            // returned quickly from the endpoint, proving its availability.
-            const request = coreRestPipeline.createPipelineRequest(requestOptions);
-            request.timeout = (_b = (_a = options.requestOptions) === null || _a === void 0 ? void 0 : _a.timeout) !== null && _b !== void 0 ? _b : 300;
-            // This MSI uses the imdsEndpoint to get the token, which only uses http://
-            request.allowInsecureConnection = true;
+        return tracingClient.withSpan("ManagedIdentityCredential-pingImdsEndpoint", getTokenOptions, async (options) => {
+            var _a, _b;
+            requestOptions.tracingOptions = options.tracingOptions;
             try {
-                logger$9.info(`${msiName$4}: Pinging the Azure IMDS endpoint`);
-                await identityClient.sendRequest(request);
+                // Create a request with a timeout since we expect that
+                // not having a "Metadata" header should cause an error to be
+                // returned quickly from the endpoint, proving its availability.
+                const request = coreRestPipeline.createPipelineRequest(requestOptions);
+                request.timeout = (_b = (_a = options.requestOptions) === null || _a === void 0 ? void 0 : _a.timeout) !== null && _b !== void 0 ? _b : 300;
+                // This MSI uses the imdsEndpoint to get the token, which only uses http://
+                request.allowInsecureConnection = true;
+                try {
+                    logger$a.info(`${msiName$4}: Pinging the Azure IMDS endpoint`);
+                    await identityClient.sendRequest(request);
+                }
+                catch (err) {
+                    if ((err.name === "RestError" && err.code === coreRestPipeline.RestError.REQUEST_SEND_ERROR) ||
+                        err.name === "AbortError" ||
+                        err.code === "ENETUNREACH" || // Network unreachable
+                        err.code === "ECONNREFUSED" || // connection refused
+                        err.code === "EHOSTDOWN" // host is down
+                    ) {
+                        // If the request failed, or Node.js was unable to establish a connection,
+                        // or the host was down, we'll assume the IMDS endpoint isn't available.
+                        logger$a.info(`${msiName$4}: The Azure IMDS endpoint is unavailable`);
+                        return false;
+                    }
+                }
+                // If we received any response, the endpoint is available
+                logger$a.info(`${msiName$4}: The Azure IMDS endpoint is available`);
+                return true;
             }
             catch (err) {
-                if ((err.name === "RestError" && err.code === coreRestPipeline.RestError.REQUEST_SEND_ERROR) ||
-                    err.name === "AbortError" ||
-                    err.code === "ENETUNREACH" || // Network unreachable
-                    err.code === "ECONNREFUSED" || // connection refused
-                    err.code === "EHOSTDOWN" // host is down
-                ) {
-                    // If the request failed, or Node.js was unable to establish a connection,
-                    // or the host was down, we'll assume the IMDS endpoint isn't available.
-                    logger$9.info(`${msiName$4}: The Azure IMDS endpoint is unavailable`);
-                    span.setStatus({
-                        code: coreTracing.SpanStatusCode.ERROR,
-                        message: err.message,
-                    });
-                    return false;
-                }
+                // createWebResource failed.
+                // This error should bubble up to the user.
+                logger$a.info(`${msiName$4}: Error when creating the WebResource for the Azure IMDS endpoint: ${err.message}`);
+                throw err;
             }
-            // If we received any response, the endpoint is available
-            logger$9.info(`${msiName$4}: The Azure IMDS endpoint is available`);
-            return true;
-        }
-        catch (err) {
-            // createWebResource failed.
-            // This error should bubble up to the user.
-            logger$9.info(`${msiName$4}: Error when creating the WebResource for the Azure IMDS endpoint: ${err.message}`);
-            span.setStatus({
-                code: coreTracing.SpanStatusCode.ERROR,
-                message: err.message,
-            });
-            throw err;
-        }
-        finally {
-            span.end();
-        }
+        });
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
-        logger$9.info(`${msiName$4}: Using the Azure IMDS endpoint coming from the environment variable MSI_ENDPOINT=${process.env.MSI_ENDPOINT}, and using the cloud shell to proceed with the authentication.`);
+        logger$a.info(`${msiName$4}: Using the Azure IMDS endpoint coming from the environment variable MSI_ENDPOINT=${process.env.MSI_ENDPOINT}, and using the cloud shell to proceed with the authentication.`);
         let nextDelayInMs = imdsMsiRetryConfig.startDelayInMs;
         for (let retries = 0; retries < imdsMsiRetryConfig.maxRetries; retries++) {
             try {
@@ -2558,7 +2534,7 @@ const imdsMsi = {
 
 // Copyright (c) Microsoft Corporation.
 const msiName$3 = "ManagedIdentityCredential - Azure Arc MSI";
-const logger$8 = credentialLogger(msiName$3);
+const logger$9 = credentialLogger(msiName$3);
 /**
  * Generates the options used on the request for an access token.
  */
@@ -2631,12 +2607,12 @@ const arcMsi = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$8.info(`${msiName$3}: Unavailable. Multiple scopes are not supported.`);
+            logger$9.info(`${msiName$3}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const result = Boolean(process.env.IMDS_ENDPOINT && process.env.IDENTITY_ENDPOINT);
         if (!result) {
-            logger$8.info(`${msiName$3}: The environment variables needed are: IMDS_ENDPOINT and IDENTITY_ENDPOINT`);
+            logger$9.info(`${msiName$3}: The environment variables needed are: IMDS_ENDPOINT and IDENTITY_ENDPOINT`);
         }
         return result;
     },
@@ -2644,12 +2620,12 @@ const arcMsi = {
         var _a;
         const { identityClient, scopes, clientId, resourceId } = configuration;
         if (clientId) {
-            logger$8.warning(`${msiName$3}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
+            logger$9.warning(`${msiName$3}: user-assigned identities not supported. The argument clientId might be ignored by the service.`);
         }
         if (resourceId) {
-            logger$8.warning(`${msiName$3}: user defined managed Identity by resource Id is not supported. Argument resourceId will be ignored.`);
+            logger$9.warning(`${msiName$3}: user defined managed Identity by resource Id is not supported. Argument resourceId will be ignored.`);
         }
-        logger$8.info(`${msiName$3}: Authenticating.`);
+        logger$9.info(`${msiName$3}: Authenticating.`);
         const requestOptions = Object.assign(Object.assign({ disableJsonStringifyOnBody: true, deserializationMapper: undefined, abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions$3(scopes, clientId, resourceId)), { allowInsecureConnection: true });
         const filePath = await filePathRequest(identityClient, requestOptions);
         if (!filePath) {
@@ -2667,7 +2643,7 @@ const arcMsi = {
 
 // Copyright (c) Microsoft Corporation.
 const msiName$2 = "ManagedIdentityCredential - Token Exchange";
-const logger$7 = credentialLogger(msiName$2);
+const logger$8 = credentialLogger(msiName$2);
 const readFileAsync = util.promisify(fs__default["default"].readFile);
 /**
  * Generates the options used on the request for an access token.
@@ -2723,13 +2699,13 @@ function tokenExchangeMsi() {
             const env = process.env;
             const result = Boolean((clientId || env.AZURE_CLIENT_ID) && env.AZURE_TENANT_ID && azureFederatedTokenFilePath);
             if (!result) {
-                logger$7.info(`${msiName$2}: Unavailable. The environment variables needed are: AZURE_CLIENT_ID (or the client ID sent through the parameters), AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE`);
+                logger$8.info(`${msiName$2}: Unavailable. The environment variables needed are: AZURE_CLIENT_ID (or the client ID sent through the parameters), AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE`);
             }
             return result;
         },
         async getToken(configuration, getTokenOptions = {}) {
             const { identityClient, scopes, clientId } = configuration;
-            logger$7.info(`${msiName$2}: Using the client assertion coming from environment variables.`);
+            logger$8.info(`${msiName$2}: Using the client assertion coming from environment variables.`);
             let assertion;
             try {
                 assertion = await readAssertion();
@@ -2758,7 +2734,7 @@ function tokenExchangeMsi() {
 //   curl --insecure $IDENTITY_ENDPOINT'?api-version=2019-07-01-preview&resource=https://vault.azure.net/' -H "Secret: $IDENTITY_HEADER"
 //
 const msiName$1 = "ManagedIdentityCredential - Fabric MSI";
-const logger$6 = credentialLogger(msiName$1);
+const logger$7 = credentialLogger(msiName$1);
 /**
  * Formats the expiration date of the received token into the number of milliseconds between that date and midnight, January 1, 1970.
  */
@@ -2808,22 +2784,22 @@ const fabricMsi = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$6.info(`${msiName$1}: Unavailable. Multiple scopes are not supported.`);
+            logger$7.info(`${msiName$1}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const env = process.env;
         const result = Boolean(env.IDENTITY_ENDPOINT && env.IDENTITY_HEADER && env.IDENTITY_SERVER_THUMBPRINT);
         if (!result) {
-            logger$6.info(`${msiName$1}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT, IDENTITY_HEADER and IDENTITY_SERVER_THUMBPRINT`);
+            logger$7.info(`${msiName$1}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT, IDENTITY_HEADER and IDENTITY_SERVER_THUMBPRINT`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { scopes, identityClient, clientId, resourceId } = configuration;
         if (resourceId) {
-            logger$6.warning(`${msiName$1}: user defined managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
+            logger$7.warning(`${msiName$1}: user defined managed Identity by resource Id is not supported. Argument resourceId might be ignored by the service.`);
         }
-        logger$6.info([
+        logger$7.info([
             `${msiName$1}:`,
             "Using the endpoint and the secret coming from the environment variables:",
             `IDENTITY_ENDPOINT=${process.env.IDENTITY_ENDPOINT},`,
@@ -2843,7 +2819,7 @@ const fabricMsi = {
 
 // Copyright (c) Microsoft Corporation.
 const msiName = "ManagedIdentityCredential - AppServiceMSI 2019";
-const logger$5 = credentialLogger(msiName);
+const logger$6 = credentialLogger(msiName);
 /**
  * Formats the expiration date of the received token into the number of milliseconds between that date and midnight, January 1, 1970.
  */
@@ -2893,19 +2869,19 @@ const appServiceMsi2019 = {
     async isAvailable({ scopes }) {
         const resource = mapScopesToResource(scopes);
         if (!resource) {
-            logger$5.info(`${msiName}: Unavailable. Multiple scopes are not supported.`);
+            logger$6.info(`${msiName}: Unavailable. Multiple scopes are not supported.`);
             return false;
         }
         const env = process.env;
         const result = Boolean(env.IDENTITY_ENDPOINT && env.IDENTITY_HEADER);
         if (!result) {
-            logger$5.info(`${msiName}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT and IDENTITY_HEADER.`);
+            logger$6.info(`${msiName}: Unavailable. The environment variables needed are: IDENTITY_ENDPOINT and IDENTITY_HEADER.`);
         }
         return result;
     },
     async getToken(configuration, getTokenOptions = {}) {
         const { identityClient, scopes, clientId, resourceId } = configuration;
-        logger$5.info(`${msiName}: Using the endpoint and the secret coming form the environment variables: IDENTITY_ENDPOINT=${process.env.IDENTITY_ENDPOINT} and IDENTITY_HEADER=[REDACTED].`);
+        logger$6.info(`${msiName}: Using the endpoint and the secret coming form the environment variables: IDENTITY_ENDPOINT=${process.env.IDENTITY_ENDPOINT} and IDENTITY_HEADER=[REDACTED].`);
         const request = coreRestPipeline.createPipelineRequest(Object.assign(Object.assign({ abortSignal: getTokenOptions.abortSignal }, prepareRequestOptions(scopes, clientId, resourceId)), { 
             // Generally, MSI endpoints use the HTTP protocol, without transport layer security (TLS).
             allowInsecureConnection: true }));
@@ -2915,7 +2891,7 @@ const appServiceMsi2019 = {
 };
 
 // Copyright (c) Microsoft Corporation.
-const logger$4 = credentialLogger("ManagedIdentityCredential");
+const logger$5 = credentialLogger("ManagedIdentityCredential");
 /**
  * Attempts authentication using a managed identity available at the deployment environment.
  * This authentication type works in Azure VMs, App Service instances, Azure Functions applications,
@@ -2930,7 +2906,6 @@ class ManagedIdentityCredential {
      * @hidden
      */
     constructor(clientIdOrOptions, options) {
-        var _a, _b;
         this.isEndpointUnavailable = null;
         let _options;
         if (typeof clientIdOrOptions === "string") {
@@ -2938,10 +2913,10 @@ class ManagedIdentityCredential {
             _options = options;
         }
         else {
-            this.clientId = (_a = clientIdOrOptions) === null || _a === void 0 ? void 0 : _a.clientId;
+            this.clientId = clientIdOrOptions === null || clientIdOrOptions === void 0 ? void 0 : clientIdOrOptions.clientId;
             _options = clientIdOrOptions;
         }
-        this.resourceId = (_b = _options) === null || _b === void 0 ? void 0 : _b.resourceId;
+        this.resourceId = _options === null || _options === void 0 ? void 0 : _options.resourceId;
         // For JavaScript users.
         if (this.clientId && this.resourceId) {
             throw new Error(`${ManagedIdentityCredential.name} - Client Id and Resource Id can't be provided at the same time.`);
@@ -2956,11 +2931,11 @@ class ManagedIdentityCredential {
             return this.cachedMSI;
         }
         const MSIs = [
+            arcMsi,
             fabricMsi,
             appServiceMsi2019,
             appServiceMsi2017,
             cloudShellMsi,
-            arcMsi,
             tokenExchangeMsi(),
             imdsMsi,
         ];
@@ -2979,7 +2954,7 @@ class ManagedIdentityCredential {
         throw new CredentialUnavailableError(`${ManagedIdentityCredential.name} - No MSI credential available`);
     }
     async authenticateManagedIdentity(scopes, getTokenOptions) {
-        const { span, updatedOptions } = createSpan(`${ManagedIdentityCredential.name}.authenticateManagedIdentity`, getTokenOptions);
+        const { span, updatedOptions } = tracingClient.startSpan(`${ManagedIdentityCredential.name}.authenticateManagedIdentity`, getTokenOptions);
         try {
             // Determining the available MSI, and avoiding checking for other MSIs while the program is running.
             const availableMSI = await this.cachedAvailableMSI(scopes, updatedOptions);
@@ -2992,8 +2967,8 @@ class ManagedIdentityCredential {
         }
         catch (err) {
             span.setStatus({
-                code: coreTracing.SpanStatusCode.ERROR,
-                message: err.message,
+                status: "error",
+                error: err,
             });
             throw err;
         }
@@ -3012,7 +2987,7 @@ class ManagedIdentityCredential {
      */
     async getToken(scopes, options) {
         let result = null;
-        const { span, updatedOptions } = createSpan(`${ManagedIdentityCredential.name}.getToken`, options);
+        const { span, updatedOptions } = tracingClient.startSpan(`${ManagedIdentityCredential.name}.getToken`, options);
         try {
             // isEndpointAvailable can be true, false, or null,
             // If it's null, it means we don't yet know whether
@@ -3027,7 +3002,7 @@ class ManagedIdentityCredential {
                     // It also means that the endpoint answered with either 200 or 201 (see the sendTokenRequest method),
                     // yet we had no access token. For this reason, we'll throw once with a specific message:
                     const error = new CredentialUnavailableError("The managed identity endpoint was reached, yet no tokens were received.");
-                    logger$4.getToken.info(formatError(scopes, error));
+                    logger$5.getToken.info(formatError(scopes, error));
                     throw error;
                 }
                 // Since `authenticateManagedIdentity` didn't throw, and the result was not null,
@@ -3039,10 +3014,10 @@ class ManagedIdentityCredential {
                 // We've previously determined that the endpoint was unavailable,
                 // either because it was unreachable or permanently unable to authenticate.
                 const error = new CredentialUnavailableError("The managed identity endpoint is not currently available");
-                logger$4.getToken.info(formatError(scopes, error));
+                logger$5.getToken.info(formatError(scopes, error));
                 throw error;
             }
-            logger$4.getToken.info(formatSuccess(scopes));
+            logger$5.getToken.info(formatSuccess(scopes));
             return result;
         }
         catch (err) {
@@ -3057,21 +3032,21 @@ class ManagedIdentityCredential {
             //   if the status code was 400, it means that the endpoint is working,
             //   but no identity is available.
             span.setStatus({
-                code: coreTracing.SpanStatusCode.ERROR,
-                message: err.message,
+                status: "error",
+                error: err,
             });
             // If either the network is unreachable,
             // we can safely assume the credential is unavailable.
             if (err.code === "ENETUNREACH") {
                 const error = new CredentialUnavailableError(`${ManagedIdentityCredential.name}: Unavailable. Network unreachable. Message: ${err.message}`);
-                logger$4.getToken.info(formatError(scopes, error));
+                logger$5.getToken.info(formatError(scopes, error));
                 throw error;
             }
             // If either the host was unreachable,
             // we can safely assume the credential is unavailable.
             if (err.code === "EHOSTUNREACH") {
                 const error = new CredentialUnavailableError(`${ManagedIdentityCredential.name}: Unavailable. No managed identity endpoint found. Message: ${err.message}`);
-                logger$4.getToken.info(formatError(scopes, error));
+                logger$5.getToken.info(formatError(scopes, error));
                 throw error;
             }
             // If err.statusCode has a value of 400, it comes from sendTokenRequest,
@@ -3108,9 +3083,9 @@ class DefaultManagedIdentityCredential extends ManagedIdentityCredential {
     // Constructor overload with just the other default options
     // Last constructor overload with Union of all options not required since the above two constructor overloads have optional properties
     constructor(options) {
-        var _a, _b, _c;
-        const managedIdentityClientId = (_b = (_a = options) === null || _a === void 0 ? void 0 : _a.managedIdentityClientId) !== null && _b !== void 0 ? _b : process.env.AZURE_CLIENT_ID;
-        const managedResourceId = (_c = options) === null || _c === void 0 ? void 0 : _c.managedIdentityResourceId;
+        var _a;
+        const managedIdentityClientId = (_a = options === null || options === void 0 ? void 0 : options.managedIdentityClientId) !== null && _a !== void 0 ? _a : process.env.AZURE_CLIENT_ID;
+        const managedResourceId = options === null || options === void 0 ? void 0 : options.managedIdentityResourceId;
         // ManagedIdentityCredential throws if both the resourceId and the clientId are provided.
         if (managedResourceId) {
             const managedIdentityResourceIdOptions = Object.assign(Object.assign({}, options), { resourceId: managedResourceId });
@@ -3144,6 +3119,86 @@ class DefaultAzureCredential extends ChainedTokenCredential {
     }
 }
 
+// Copyright (c) Microsoft Corporation.
+/**
+ * MSAL client assertion client. Calls to MSAL's confidential application's `acquireTokenByClientCredential` during `doGetToken`.
+ * @internal
+ */
+class MsalClientAssertion extends MsalNode {
+    constructor(options) {
+        super(options);
+        this.requiresConfidential = true;
+        this.getAssertion = options.getAssertion;
+    }
+    async doGetToken(scopes, options = {}) {
+        try {
+            const assertion = await this.getAssertion();
+            const result = await this.confidentialApp.acquireTokenByClientCredential({
+                scopes,
+                correlationId: options.correlationId,
+                azureRegion: this.azureRegion,
+                authority: options.authority,
+                claims: options.claims,
+                clientAssertion: assertion,
+            });
+            // The Client Credential flow does not return an account,
+            // so each time getToken gets called, we will have to acquire a new token through the service.
+            return this.handleResult(scopes, this.clientId, result || undefined);
+        }
+        catch (err) {
+            let err2 = err;
+            if (err === null || err === undefined) {
+                err2 = new Error(JSON.stringify(err));
+            }
+            else {
+                err2 = coreUtil.isError(err) ? err : new Error(String(err));
+            }
+            throw this.handleError(scopes, err2, options);
+        }
+    }
+}
+
+// Copyright (c) Microsoft Corporation.
+const logger$4 = credentialLogger("ClientAssertionCredential");
+/**
+ * Authenticates a service principal with a JWT assertion.
+ */
+class ClientAssertionCredential {
+    /**
+     * Creates an instance of the ClientAssertionCredential with the details
+     * needed to authenticate against Azure Active Directory with a client
+     * assertion provided by the developer through the `getAssertion` function parameter.
+     *
+     * @param tenantId - The Azure Active Directory tenant (directory) ID.
+     * @param clientId - The client (application) ID of an App Registration in the tenant.
+     * @param getAssertion - A function that retrieves the assertion for the credential to use.
+     * @param options - Options for configuring the client which makes the authentication request.
+     */
+    constructor(tenantId, clientId, getAssertion, options = {}) {
+        if (!tenantId || !clientId || !getAssertion) {
+            throw new Error("ClientAssertionCredential: tenantId, clientId, and clientAssertion are required parameters.");
+        }
+        this.tenantId = tenantId;
+        this.clientId = clientId;
+        this.options = options;
+        this.msalFlow = new MsalClientAssertion(Object.assign(Object.assign({}, options), { logger: logger$4, clientId: this.clientId, tenantId: this.tenantId, tokenCredentialOptions: this.options, getAssertion }));
+    }
+    /**
+     * Authenticates with Azure Active Directory and returns an access token if successful.
+     * If authentication fails, a {@link CredentialUnavailableError} will be thrown with the details of the failure.
+     *
+     * @param scopes - The list of scopes for which the token will have access.
+     * @param options - The options used to configure any requests this
+     *                TokenCredential implementation might make.
+     */
+    async getToken(scopes, options = {}) {
+        return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
+            const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
+            return this.msalFlow.getToken(arrayScopes, newOptions);
+        });
+    }
+}
+
 // Copyright (c) Microsoft Corporation.
 /**
  * A call to open(), but mockable
@@ -3295,7 +3350,8 @@ class MsalOpenBrowser extends MsalNode {
         };
         const response = await this.publicApp.getAuthCodeUrl(authCodeUrlParameters);
         try {
-            await interactiveBrowserMockable.open(response, { wait: true });
+            // A new instance on macOS only which allows it to not hang, does not fix the issue on linux
+            await interactiveBrowserMockable.open(response, { wait: true, newInstance: true });
         }
         catch (e) {
             throw new CredentialUnavailableError(`InteractiveBrowserCredential: Could not open a browser window. Error: ${e.message}`);
@@ -3343,7 +3399,7 @@ class InteractiveBrowserCredential {
      *                TokenCredential implementation might make.
      */
     async getToken(scopes, options = {}) {
-        return trace(`${this.constructor.name}.getToken`, options, async (newOptions) => {
+        return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
             const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
             return this.msalFlow.getToken(arrayScopes, Object.assign(Object.assign({}, newOptions), { disableAutomaticAuthentication: this.disableAutomaticAuthentication }));
         });
@@ -3362,7 +3418,7 @@ class InteractiveBrowserCredential {
      *                  TokenCredential implementation might make.
      */
     async authenticate(scopes, options = {}) {
-        return trace(`${this.constructor.name}.authenticate`, options, async (newOptions) => {
+        return tracingClient.withSpan(`${this.constructor.name}.authenticate`, options, async (newOptions) => {
             const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
             await this.msalFlow.getToken(arrayScopes, newOptions);
             return this.msalFlow.getActiveAccount();
@@ -3453,7 +3509,7 @@ class DeviceCodeCredential {
      *                TokenCredential implementation might make.
      */
     async getToken(scopes, options = {}) {
-        return trace(`${this.constructor.name}.getToken`, options, async (newOptions) => {
+        return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
             const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
             return this.msalFlow.getToken(arrayScopes, Object.assign(Object.assign({}, newOptions), { disableAutomaticAuthentication: this.disableAutomaticAuthentication }));
         });
@@ -3469,7 +3525,7 @@ class DeviceCodeCredential {
      *                  TokenCredential implementation might make.
      */
     async authenticate(scopes, options = {}) {
-        return trace(`${this.constructor.name}.authenticate`, options, async (newOptions) => {
+        return tracingClient.withSpan(`${this.constructor.name}.authenticate`, options, async (newOptions) => {
             const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
             await this.msalFlow.getToken(arrayScopes, newOptions);
             return this.msalFlow.getActiveAccount();
@@ -3495,12 +3551,12 @@ class MsalAuthorizationCode extends MsalNode {
     }
     async getAuthCodeUrl(options) {
         await this.init();
-        return this.confidentialApp.getAuthCodeUrl(options);
+        return (this.confidentialApp || this.publicApp).getAuthCodeUrl(options);
     }
     async doGetToken(scopes, options) {
         var _a;
         try {
-            const result = await ((_a = this.confidentialApp) === null || _a === void 0 ? void 0 : _a.acquireTokenByCode({
+            const result = await ((_a = (this.confidentialApp || this.publicApp)) === null || _a === void 0 ? void 0 : _a.acquireTokenByCode({
                 scopes,
                 redirectUri: this.redirectUri,
                 code: this.authorizationCode,
@@ -3549,7 +3605,8 @@ class AuthorizationCodeCredential {
             options = redirectUriOrOptions;
         }
         this.msalFlow = new MsalAuthorizationCode(Object.assign(Object.assign({}, options), { clientSecret,
-            clientId, tokenCredentialOptions: options || {}, logger: logger$1, redirectUri: this.redirectUri, authorizationCode: this.authorizationCode }));
+            clientId,
+            tenantId, tokenCredentialOptions: options || {}, logger: logger$1, redirectUri: this.redirectUri, authorizationCode: this.authorizationCode }));
     }
     /**
      * Authenticates with Azure Active Directory and returns an access token if successful.
@@ -3560,7 +3617,7 @@ class AuthorizationCodeCredential {
      *                TokenCredential implementation might make.
      */
     async getToken(scopes, options = {}) {
-        return trace(`${this.constructor.name}.getToken`, options, async (newOptions) => {
+        return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
             const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
             return this.msalFlow.getToken(arrayScopes, Object.assign(Object.assign({}, newOptions), { disableAutomaticAuthentication: this.disableAutomaticAuthentication }));
         });
@@ -3645,7 +3702,7 @@ class OnBehalfOfCredential {
      * @param options - The options used to configure the underlying network requests.
      */
     async getToken(scopes, options = {}) {
-        return trace(`${credentialName}.getToken`, options, async (newOptions) => {
+        return tracingClient.withSpan(`${credentialName}.getToken`, options, async (newOptions) => {
             const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
             return this.msalFlow.getToken(arrayScopes, newOptions);
         });
@@ -3669,6 +3726,7 @@ exports.AuthorizationCodeCredential = AuthorizationCodeCredential;
 exports.AzureCliCredential = AzureCliCredential;
 exports.AzurePowerShellCredential = AzurePowerShellCredential;
 exports.ChainedTokenCredential = ChainedTokenCredential;
+exports.ClientAssertionCredential = ClientAssertionCredential;
 exports.ClientCertificateCredential = ClientCertificateCredential;
 exports.ClientSecretCredential = ClientSecretCredential;
 exports.CredentialUnavailableError = CredentialUnavailableError;
@@ -3683,7 +3741,7 @@ exports.UsernamePasswordCredential = UsernamePasswordCredential;
 exports.VisualStudioCodeCredential = VisualStudioCodeCredential;
 exports.deserializeAuthenticationRecord = deserializeAuthenticationRecord;
 exports.getDefaultAzureCredential = getDefaultAzureCredential;
-exports.logger = logger$k;
+exports.logger = logger$l;
 exports.serializeAuthenticationRecord = serializeAuthenticationRecord;
 exports.useIdentityPlugin = useIdentityPlugin;
 //# sourceMappingURL=index.js.map