@azure/identity 3.1.0-alpha.20221020.3 → 3.1.0-alpha.20221101.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of @azure/identity might be problematic. Click here for more details.
- package/README.md +86 -80
- package/dist/index.js +7 -2
- package/dist/index.js.map +1 -1
- package/dist-esm/src/credentials/environmentCredential.js +2 -2
- package/dist-esm/src/credentials/environmentCredential.js.map +1 -1
- package/dist-esm/src/credentials/visualStudioCodeCredential.js +5 -0
- package/dist-esm/src/credentials/visualStudioCodeCredential.js.map +1 -1
- package/package.json +1 -1
- package/types/identity.d.ts +7 -2
package/README.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# Azure Identity client library for JavaScript
|
|
2
2
|
|
|
3
|
-
The Azure Identity library provides [Azure Active Directory (Azure AD)](https://
|
|
3
|
+
The Azure Identity library provides [Azure Active Directory (Azure AD)](https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis) token authentication through a set of convenient [TokenCredential](https://learn.microsoft.com/javascript/api/@azure/core-auth/tokencredential) implementations.
|
|
4
4
|
|
|
5
5
|
For examples of various credentials, see the [Azure Identity examples page](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md).
|
|
6
6
|
|
|
@@ -8,8 +8,8 @@ Key links:
|
|
|
8
8
|
|
|
9
9
|
- [Source code](https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/identity/identity)
|
|
10
10
|
- [Package (npm)](https://www.npmjs.com/package/@azure/identity)
|
|
11
|
-
- [API Reference Documentation](https://
|
|
12
|
-
- [
|
|
11
|
+
- [API Reference Documentation](https://learn.microsoft.com/javascript/api/@azure/identity)
|
|
12
|
+
- [Azure AD documentation](https://azure.microsoft.com/services/active-directory/)
|
|
13
13
|
- [Samples](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/v2)
|
|
14
14
|
|
|
15
15
|
## Getting started
|
|
@@ -46,7 +46,7 @@ The credential classes exposed by `@azure/identity` are focused on providing the
|
|
|
46
46
|
|
|
47
47
|
All credential types provided by `@azure/identity` are supported in Node.js. For browsers, `InteractiveBrowserCredential` is the credential type to be used for basic authentication scenarios.
|
|
48
48
|
|
|
49
|
-
Most of the credential types offered by `@azure/identity` use the [Microsoft Authentication Library for JavaScript (MSAL.js)](https://github.com/AzureAD/microsoft-authentication-library-for-js). Specifically, we use the v2 MSAL.js libraries, which use [OAuth 2.0 Authorization Code Flow with PKCE](https://
|
|
49
|
+
Most of the credential types offered by `@azure/identity` use the [Microsoft Authentication Library for JavaScript (MSAL.js)](https://github.com/AzureAD/microsoft-authentication-library-for-js). Specifically, we use the v2 MSAL.js libraries, which use [OAuth 2.0 Authorization Code Flow with PKCE](https://learn.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow) and are [OpenID-compliant](https://learn.microsoft.com/azure/active-directory/develop/v2-protocols-oidc). While `@azure/identity` focuses on simplicity, the MSAL.js libraries, such as [@azure/msal-common](https://www.npmjs.com/package/@azure/msal-common), [@azure/msal-node](https://www.npmjs.com/package/@azure/msal-node), and [@azure/msal-browser](https://www.npmjs.com/package/@azure/msal-browser), are designed to provide robust support for the authentication protocols that Azure supports.
|
|
50
50
|
|
|
51
51
|
#### When to use something else
|
|
52
52
|
|
|
@@ -64,7 +64,7 @@ For advanced authentication workflows in the browser, we have a section where we
|
|
|
64
64
|
|
|
65
65
|
While we recommend using managed identity or service principal authentication in your production application, it is typical for a developer to use their own account for authenticating calls to Azure services when debugging and executing code locally. There are several developer tools which can be used to perform this authentication in your development environment.
|
|
66
66
|
|
|
67
|
-
####
|
|
67
|
+
#### Authenticate via the Azure CLI
|
|
68
68
|
|
|
69
69
|
Applications using the `AzureCliCredential`, whether directly or via the `DefaultAzureCredential`, can use the Azure CLI account to authenticate calls in the application when running locally.
|
|
70
70
|
|
|
@@ -76,7 +76,7 @@ For systems without a default web browser, the `az login` command will use the d
|
|
|
76
76
|
|
|
77
77
|
![Azure CLI Account Device Code Sign In][azureclilogindevicecode_image]
|
|
78
78
|
|
|
79
|
-
####
|
|
79
|
+
#### Authenticate via Azure PowerShell
|
|
80
80
|
|
|
81
81
|
Applications using the `AzurePowerShellCredential`, whether directly or via the `DefaultAzureCredential`, can use the account connected to Azure PowerShell to authenticate calls in the application when running locally.
|
|
82
82
|
|
|
@@ -98,23 +98,23 @@ It's a [known issue](https://github.com/Azure/azure-sdk-for-js/issues/20500) tha
|
|
|
98
98
|
|
|
99
99
|
### Authenticate the client in browsers
|
|
100
100
|
|
|
101
|
-
To authenticate Azure
|
|
101
|
+
To authenticate Azure SDK clients within web browsers, we offer the `InteractiveBrowserCredential`, which can be set to use redirection or popups to complete the authentication flow. It's necessary to [create an Azure App Registration](https://learn.microsoft.com/azure/active-directory/develop/scenario-spa-app-registration) in the Azure portal for your web application first.
|
|
102
102
|
|
|
103
103
|
## Key concepts
|
|
104
104
|
|
|
105
|
-
If this is your first time using `@azure/identity` or the Microsoft
|
|
105
|
+
If this is your first time using `@azure/identity` or the Microsoft Identity platform (Azure AD), read [Using `@azure/identity` with Microsoft Identity Platform](https://github.com/Azure/azure-sdk-for-js/blob/main/documentation/using-azure-identity.md) first. This document provides a deeper understanding of the platform and how to configure your Azure account correctly.
|
|
106
106
|
|
|
107
107
|
### Credentials
|
|
108
108
|
|
|
109
|
-
A credential is a class which contains or can obtain the data needed for a service client to authenticate requests. Service clients across Azure SDK accept credentials when they
|
|
109
|
+
A credential is a class which contains or can obtain the data needed for a service client to authenticate requests. Service clients across the Azure SDK accept credentials when they're constructed. Service clients use those credentials to authenticate requests to the service.
|
|
110
110
|
|
|
111
|
-
The Azure Identity library focuses on OAuth authentication with Azure
|
|
111
|
+
The Azure Identity library focuses on OAuth authentication with Azure AD, and it offers a variety of credential classes capable of acquiring an Azure AD token to authenticate service requests. All of the credential classes in this library are implementations of the [TokenCredential](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-auth/src/tokenCredential.ts) abstract class, and any of them can be used by to construct service clients capable of authenticating with a TokenCredential.
|
|
112
112
|
|
|
113
113
|
See [Credential Classes](#credential-classes).
|
|
114
114
|
|
|
115
115
|
### DefaultAzureCredential
|
|
116
116
|
|
|
117
|
-
The `DefaultAzureCredential` is appropriate for most scenarios where the application is intended to ultimately be run in
|
|
117
|
+
The `DefaultAzureCredential` is appropriate for most scenarios where the application is intended to ultimately be run in Azure. This is because the `DefaultAzureCredential` combines credentials commonly used to authenticate when deployed with credentials used to authenticate in a development environment.
|
|
118
118
|
|
|
119
119
|
> Note: `DefaultAzureCredential` is intended to simplify getting started with the SDK by handling common scenarios with reasonable default behaviors. Developers who want more control or whose scenario isn't served by the default settings should use other credential types.
|
|
120
120
|
|
|
@@ -129,7 +129,7 @@ If used from Node.js, the `DefaultAzureCredential` will attempt to authenticate
|
|
|
129
129
|
|
|
130
130
|
#### Note about `VisualStudioCodeCredential`
|
|
131
131
|
|
|
132
|
-
Due to a [known issue](https://github.com/Azure/azure-sdk-for-js/issues/20500), `VisualStudioCodeCredential` has been removed from the `DefaultAzureCredential` token chain. When the issue is resolved in a future release
|
|
132
|
+
Due to a [known issue](https://github.com/Azure/azure-sdk-for-js/issues/20500), `VisualStudioCodeCredential` has been removed from the `DefaultAzureCredential` token chain. When the issue is resolved in a future release, this change will be reverted.
|
|
133
133
|
|
|
134
134
|
## Plugins
|
|
135
135
|
|
|
@@ -138,41 +138,11 @@ Azure Identity for JavaScript provides a plugin API that allows us to provide ce
|
|
|
138
138
|
- [`@azure/identity-cache-persistence`](https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/identity/identity-cache-persistence), which provides persistent token caching in Node.js using a native secure storage system provided by your operating system. This plugin allows cached `access_token` values to persist across sessions, meaning that an interactive login flow does not need to be repeated as long as a cached token is available.
|
|
139
139
|
- [`@azure/identity-vscode`](https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/identity/identity-vscode), which provides the dependencies of `VisualStudioCodeCredential` and enables it. Without this plugin, the `VisualStudioCodeCredential` in this package will throw a `CredentialUnavailableError`. The plugin provides the underlying implementation of this credential, enabling it for use both on its own and as part of the `DefaultAzureCredential` described above.
|
|
140
140
|
|
|
141
|
-
## Environment Variables
|
|
142
|
-
|
|
143
|
-
`DefaultAzureCredential` and `EnvironmentCredential` can be configured with environment variables. Each type of authentication requires values for specific variables:
|
|
144
|
-
|
|
145
|
-
#### Service principal with secret
|
|
146
|
-
|
|
147
|
-
| variable name | value |
|
|
148
|
-
| --------------------- | ----------------------------------------------------- |
|
|
149
|
-
| `AZURE_CLIENT_ID` | id of an Azure Active Directory application |
|
|
150
|
-
| `AZURE_TENANT_ID` | id of the application's Azure Active Directory tenant |
|
|
151
|
-
| `AZURE_CLIENT_SECRET` | one of the application's client secrets |
|
|
152
|
-
|
|
153
|
-
#### Service principal with certificate
|
|
154
|
-
|
|
155
|
-
| variable name | value |
|
|
156
|
-
| ------------------------------- | ------------------------------------------------------------------------------------------ |
|
|
157
|
-
| `AZURE_CLIENT_ID` | id of an Azure Active Directory application |
|
|
158
|
-
| `AZURE_TENANT_ID` | id of the application's Azure Active Directory tenant |
|
|
159
|
-
| `AZURE_CLIENT_CERTIFICATE_PATH` | path to a PEM-encoded certificate file including private key (without password protection) |
|
|
160
|
-
|
|
161
|
-
#### Username and password
|
|
162
|
-
|
|
163
|
-
| variable name | value |
|
|
164
|
-
| ----------------- | ------------------------------------------- |
|
|
165
|
-
| `AZURE_CLIENT_ID` | id of an Azure Active Directory application |
|
|
166
|
-
| `AZURE_USERNAME` | a username (usually an email address) |
|
|
167
|
-
| `AZURE_PASSWORD` | that user's password |
|
|
168
|
-
|
|
169
|
-
Configuration is attempted in the above order. For example, if values for a client secret and certificate are both present, the client secret will be used.
|
|
170
|
-
|
|
171
141
|
## Examples
|
|
172
142
|
|
|
173
143
|
You can find more examples of using various credentials in [Azure Identity Examples Page](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md)
|
|
174
144
|
|
|
175
|
-
###
|
|
145
|
+
### Authenticate with the `DefaultAzureCredential`
|
|
176
146
|
|
|
177
147
|
This example demonstrates authenticating the `KeyClient` from the [@azure/keyvault-keys](https://www.npmjs.com/package/@azure/keyvault-keys) client library using the `DefaultAzureCredential`.
|
|
178
148
|
|
|
@@ -193,9 +163,9 @@ const credential = new DefaultAzureCredential();
|
|
|
193
163
|
const client = new KeyClient(vaultUrl, credential);
|
|
194
164
|
```
|
|
195
165
|
|
|
196
|
-
###
|
|
166
|
+
### Specify a user-assigned managed identity with the `DefaultAzureCredential`
|
|
197
167
|
|
|
198
|
-
A relatively common scenario involves authenticating using a user
|
|
168
|
+
A relatively common scenario involves authenticating using a user-assigned managed identity for an Azure resource. Explore the [example on Authenticating a user-assigned managed identity with DefaultAzureCredential](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-user-assigned-managed-identity-with-defaultazurecredential) to see how this is made a relatively straightforward task that can be configured using environment variables or in code.
|
|
199
169
|
|
|
200
170
|
### Define a custom authentication flow with the `ChainedTokenCredential`
|
|
201
171
|
|
|
@@ -215,18 +185,19 @@ const { KeyClient } = require("@azure/keyvault-keys");
|
|
|
215
185
|
const client = new KeyClient(vaultUrl, credentialChain);
|
|
216
186
|
```
|
|
217
187
|
|
|
218
|
-
## Managed
|
|
188
|
+
## Managed identity support
|
|
219
189
|
|
|
220
|
-
The [Managed identity authentication](https://
|
|
190
|
+
The [Managed identity authentication](https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview) is supported via either the `DefaultAzureCredential` or the `ManagedIdentityCredential` credential classes directly for the following Azure services:
|
|
221
191
|
|
|
222
|
-
- [Azure
|
|
223
|
-
- [Azure
|
|
224
|
-
- [Azure
|
|
225
|
-
- [Azure
|
|
226
|
-
- [Azure
|
|
227
|
-
- [Azure
|
|
192
|
+
- [Azure App Service and Azure Functions](https://learn.microsoft.com/azure/app-service/overview-managed-identity)
|
|
193
|
+
- [Azure Arc](https://learn.microsoft.com/azure/azure-arc/servers/managed-identity-authentication)
|
|
194
|
+
- [Azure Cloud Shell](https://learn.microsoft.com/azure/cloud-shell/msi-authorization)
|
|
195
|
+
- [Azure Kubernetes Service](https://learn.microsoft.com/azure/aks/use-managed-identity)
|
|
196
|
+
- [Azure Service Fabric](https://learn.microsoft.com/azure/service-fabric/concepts-managed-identity)
|
|
197
|
+
- [Azure Virtual Machines](https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token)
|
|
198
|
+
- [Azure Virtual Machines Scale Sets](https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/qs-configure-powershell-windows-vmss)
|
|
228
199
|
|
|
229
|
-
For examples of how to use managed identity for authentication
|
|
200
|
+
For examples of how to use managed identity for authentication, see [the examples](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-in-azure-with-managed-identity).
|
|
230
201
|
|
|
231
202
|
## Cloud configuration
|
|
232
203
|
|
|
@@ -246,45 +217,78 @@ const credential = new ClientSecretCredential(
|
|
|
246
217
|
|
|
247
218
|
Not all credentials require this configuration. Credentials that authenticate through a development tool, such as `AzureCliCredential`, use that tool's configuration. Similarly, `VisualStudioCodeCredential` accepts an `authorityHost` argument but defaults to the `authorityHost` matching Visual Studio Code's **Azure: Cloud** setting.
|
|
248
219
|
|
|
249
|
-
## Credential
|
|
220
|
+
## Credential classes
|
|
250
221
|
|
|
251
|
-
###
|
|
222
|
+
### Authenticate Azure-hosted applications
|
|
252
223
|
|
|
253
224
|
| Credential | Usage | Example |
|
|
254
225
|
| ----------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
255
|
-
| [`DefaultAzureCredential`](https://
|
|
256
|
-
| [`ChainedTokenCredential`](https://
|
|
257
|
-
| [`EnvironmentCredential`](https://
|
|
258
|
-
| [`ManagedIdentityCredential`](https://
|
|
226
|
+
| [`DefaultAzureCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/defaultazurecredential?view=azure-node-latest) | Provides a simplified authentication experience to quickly start developing applications run in Azure. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-with-defaultazurecredential) |
|
|
227
|
+
| [`ChainedTokenCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/chainedtokencredential?view=azure-node-latest) | Allows users to define custom authentication flows composing multiple credentials. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#chaining-credentials) |
|
|
228
|
+
| [`EnvironmentCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/environmentcredential?view=azure-node-latest) | Authenticates a service principal or user via credential information specified in environment variables. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-service-principal-with-environment-credentials) |
|
|
229
|
+
| [`ManagedIdentityCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/managedidentitycredential?view=azure-node-latest) | Authenticates the managed identity of an Azure resource. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-in-azure-with-managed-identity) |
|
|
259
230
|
|
|
260
|
-
###
|
|
231
|
+
### Authenticate service principals
|
|
261
232
|
|
|
262
233
|
| Credential | Usage | Example | Reference |
|
|
263
234
|
| --------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
|
|
264
|
-
| `ClientAssertionCredential` | Authenticates a service principal using a
|
|
265
|
-
| [`ClientCertificateCredential`](https://
|
|
266
|
-
| [`ClientSecretCredential`](https://
|
|
235
|
+
| [`ClientAssertionCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/clientassertioncredential?view=azure-node-latest) | Authenticates a service principal using a signed client assertion. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-service-principal-with-a-client-assertion) | [Service principal authentication](https://learn.microsoft.com/azure/active-directory/develop/app-objects-and-service-principals) |
|
|
236
|
+
| [`ClientCertificateCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/clientcertificatecredential?view=azure-node-latest) | Authenticates a service principal using a certificate. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-service-principal-with-a-client-certificate) | [Service principal authentication](https://learn.microsoft.com/azure/active-directory/develop/app-objects-and-service-principals) |
|
|
237
|
+
| [`ClientSecretCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/clientsecretcredential?view=azure-node-latest) | Authenticates a service principal using a secret. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-service-principal-with-a-client-secret) | [Service principal authentication](https://learn.microsoft.com/azure/active-directory/develop/app-objects-and-service-principals) |
|
|
267
238
|
|
|
268
|
-
###
|
|
239
|
+
### Authenticate users
|
|
269
240
|
|
|
270
241
|
| Credential | Usage | Example | Reference |
|
|
271
242
|
| ----------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
|
|
272
|
-
| [`AuthorizationCodeCredential`](https://
|
|
273
|
-
| [`DeviceCodeCredential`](https://
|
|
274
|
-
| [`InteractiveBrowserCredential`](https://
|
|
275
|
-
| [`OnBehalfOfCredential`](https://
|
|
276
|
-
| [`UsernamePasswordCredential`](https://
|
|
243
|
+
| [`AuthorizationCodeCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/authorizationcodecredential?view=azure-node-latest) | Authenticates a user with a previously obtained authorization code. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-user-account-with-auth-code-flow) | [OAuth2 authentication code](https://learn.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow) |
|
|
244
|
+
| [`DeviceCodeCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/devicecodecredential?view=azure-node-latest) | Interactively authenticates a user on devices with limited UI. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-user-account-with-device-code-flow) | [Device code authentication](https://learn.microsoft.com/azure/active-directory/develop/v2-oauth2-device-code) |
|
|
245
|
+
| [`InteractiveBrowserCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/interactivebrowsercredential?view=azure-node-latest) | Interactively authenticates a user with the default system browser. Read more about how this happens [here](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/interactive-browser-credential.md). | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-user-account-interactively-in-the-browser) | [OAuth2 authentication code](https://learn.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow) |
|
|
246
|
+
| [`OnBehalfOfCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/onbehalfofcredential?view=azure-node-latest) | Propagates the delegated user identity and permissions through the request chain | | [On-behalf-of authentication](https://learn.microsoft.com/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow)
|
|
247
|
+
| [`UsernamePasswordCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/usernamepasswordcredential?view=azure-node-latest) | Authenticates a user with a username and password. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-user-account-with-username-and-password) | [Username + password authentication](https://learn.microsoft.com/azure/active-directory/develop/v2-oauth-ropc) |
|
|
277
248
|
|
|
278
|
-
###
|
|
249
|
+
### Authenticate via development tools
|
|
279
250
|
|
|
280
251
|
| Credential | Usage | Example | Reference |
|
|
281
252
|
| ----------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
|
|
282
|
-
| [`AzureCliCredential`](https://
|
|
283
|
-
| [`AzurePowerShellCredential`](https://
|
|
253
|
+
| [`AzureCliCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/azureclicredential?view=azure-node-latest) | Authenticate in a development environment with the Azure CLI. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-user-account-with-azure-cli) | [Azure CLI authentication](https://learn.microsoft.com/cli/azure/authenticate-azure-cli) |
|
|
254
|
+
| [`AzurePowerShellCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/azurepowershellcredential?view=azure-node-latest) | Authenticate in a development environment using Azure PowerShell. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-user-account-with-azure-powershell) | [Azure PowerShell authentication](https://learn.microsoft.com/powershell/azure/authenticate-azureps) |
|
|
255
|
+
| [`VisualStudioCodeCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/visualstudiocodecredential?view=azure-node-latest) | Authenticates as the user signed in to the Visual Studio Code Azure Account extension.| | [VS Code Azure Account extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode.azure-account)
|
|
256
|
+
|
|
257
|
+
## Environment variables
|
|
258
|
+
|
|
259
|
+
`DefaultAzureCredential` and `EnvironmentCredential` can be configured with environment variables. Each type of authentication requires values for specific variables.
|
|
260
|
+
|
|
261
|
+
#### Service principal with secret
|
|
262
|
+
|
|
263
|
+
| Variable name | Value |
|
|
264
|
+
| --------------------- | --------------------------------------- |
|
|
265
|
+
| `AZURE_CLIENT_ID` | ID of an Azure AD application |
|
|
266
|
+
| `AZURE_TENANT_ID` | ID of the application's Azure AD tenant |
|
|
267
|
+
| `AZURE_CLIENT_SECRET` | one of the application's client secrets |
|
|
268
|
+
|
|
269
|
+
#### Service principal with certificate
|
|
270
|
+
|
|
271
|
+
| Variable name | Value |
|
|
272
|
+
| ----------------------------------- | ------------------------------------------------------------ |
|
|
273
|
+
| `AZURE_CLIENT_ID` | ID of an Azure AD application |
|
|
274
|
+
| `AZURE_TENANT_ID` | ID of the application's Azure AD tenant |
|
|
275
|
+
| `AZURE_CLIENT_CERTIFICATE_PATH` | path to a PEM-encoded certificate file including private key |
|
|
276
|
+
| `AZURE_CLIENT_CERTIFICATE_PASSWORD` | password of the certificate file, if any |
|
|
277
|
+
|
|
278
|
+
#### Username and password
|
|
279
|
+
|
|
280
|
+
| Variable name | Value |
|
|
281
|
+
| ----------------- | --------------------------------------- |
|
|
282
|
+
| `AZURE_CLIENT_ID` | ID of an Azure AD application |
|
|
283
|
+
| `AZURE_TENANT_ID` | ID of the application's Azure AD tenant |
|
|
284
|
+
| `AZURE_USERNAME` | a username (usually an email address) |
|
|
285
|
+
| `AZURE_PASSWORD` | that user's password |
|
|
286
|
+
|
|
287
|
+
Configuration is attempted in the above order. For example, if values for a client secret and certificate are both present, the client secret will be used.
|
|
284
288
|
|
|
285
289
|
## Troubleshooting
|
|
286
290
|
|
|
287
|
-
### Error
|
|
291
|
+
### Error handling
|
|
288
292
|
|
|
289
293
|
Credentials raise `AuthenticationError` when they fail to authenticate. This class has a `message` field which describes why authentication failed. An `AggregateAuthenticationError` will be raised by `ChainedTokenCredential` with an `errors` field containing an array of errors from each credential in the chain.
|
|
290
294
|
|
|
@@ -338,19 +342,21 @@ For assistance with troubleshooting, see the [troubleshooting guide](https://aka
|
|
|
338
342
|
|
|
339
343
|
### Read the documentation
|
|
340
344
|
|
|
341
|
-
API documentation for this library can be found on our [documentation site](https://
|
|
345
|
+
API documentation for this library can be found on our [documentation site](https://learn.microsoft.com/javascript/api/@azure/identity).
|
|
342
346
|
|
|
343
347
|
### Client library support
|
|
344
348
|
|
|
345
349
|
Client and management libraries listed on the [Azure SDK releases page](https://azure.github.io/azure-sdk/releases/latest/js.html) that support Azure AD authentication accept credentials from this library. Learn more about using these libraries in their documentation, which is linked from the releases page.
|
|
346
350
|
|
|
347
|
-
### Known
|
|
351
|
+
### Known issues
|
|
348
352
|
|
|
349
353
|
#### Azure AD B2C support
|
|
350
354
|
|
|
351
|
-
This library
|
|
355
|
+
This library doesn't support the [Azure AD B2C](https://learn.microsoft.com/azure/active-directory-b2c/overview) service.
|
|
356
|
+
|
|
357
|
+
For other open issues, see the library's [GitHub repository](https://github.com/Azure/azure-sdk-for-js/issues?q=is%3Aopen+is%3Aissue+label%3AAzure.Identity).
|
|
352
358
|
|
|
353
|
-
### Provide
|
|
359
|
+
### Provide feedback
|
|
354
360
|
|
|
355
361
|
If you encounter bugs or have suggestions, please [open an issue](https://github.com/Azure/azure-sdk-for-js/issues).
|
|
356
362
|
|
|
@@ -367,8 +373,8 @@ If you'd like to contribute to this library, please read the [contributing guide
|
|
|
367
373
|
[7]: https://azuresdkdocs.blob.core.windows.net/$web/javascript/azure-identity/1.0.0/classes/authorizationcodecredential.html
|
|
368
374
|
[8]: https://azuresdkdocs.blob.core.windows.net/$web/javascript/azure-identity/1.0.0/classes/interactivebrowsercredential.html
|
|
369
375
|
[9]: https://azuresdkdocs.blob.core.windows.net/$web/javascript/azure-identity/1.0.0/classes/usernamepasswordcredential.html
|
|
370
|
-
[azure_cli]: https://
|
|
371
|
-
[azure_powershell]: https://
|
|
376
|
+
[azure_cli]: https://learn.microsoft.com/cli/azure
|
|
377
|
+
[azure_powershell]: https://learn.microsoft.com/powershell/azure/
|
|
372
378
|
[azureclilogin_image]: https://raw.githubusercontent.com/Azure/azure-sdk-for-js/main/sdk/identity/identity/images/AzureCliLogin.png
|
|
373
379
|
[azureclilogindevicecode_image]: https://raw.githubusercontent.com/Azure/azure-sdk-for-js/main/sdk/identity/identity/images/AzureCliLoginDeviceCode.png
|
|
374
380
|
[azurepowershelllogin_image]: https://raw.githubusercontent.com/Azure/azure-sdk-for-js/main/sdk/identity/identity/images/AzurePowerShellLogin.png
|
package/dist/index.js
CHANGED
|
@@ -1294,6 +1294,11 @@ function getPropertyFromVSCode(property) {
|
|
|
1294
1294
|
* Connects to Azure using the credential provided by the VSCode extension 'Azure Account'.
|
|
1295
1295
|
* Once the user has logged in via the extension, this credential can share the same refresh token
|
|
1296
1296
|
* that is cached by the extension.
|
|
1297
|
+
*
|
|
1298
|
+
* It's a [known issue](https://github.com/Azure/azure-sdk-for-js/issues/20500) that this credential doesn't
|
|
1299
|
+
* work with [Azure Account extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode.azure-account)
|
|
1300
|
+
* versions newer than **0.9.11**. A long-term fix to this problem is in progress. In the meantime, consider
|
|
1301
|
+
* authenticating with {@link AzureCliCredential}.
|
|
1297
1302
|
*/
|
|
1298
1303
|
class VisualStudioCodeCredential {
|
|
1299
1304
|
/**
|
|
@@ -3088,8 +3093,8 @@ function getAdditionallyAllowedTenants() {
|
|
|
3088
3093
|
const credentialName$1 = "EnvironmentCredential";
|
|
3089
3094
|
const logger$5 = credentialLogger(credentialName$1);
|
|
3090
3095
|
/**
|
|
3091
|
-
* Enables authentication to Azure Active Directory using client secret
|
|
3092
|
-
*
|
|
3096
|
+
* Enables authentication to Azure Active Directory using a client secret or certificate, or as a user
|
|
3097
|
+
* with a username and password.
|
|
3093
3098
|
*/
|
|
3094
3099
|
class EnvironmentCredential {
|
|
3095
3100
|
/**
|