@azure/identity 3.1.0-beta.1 → 3.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of @azure/identity might be problematic. Click here for more details.
- package/README.md +86 -80
- package/dist/index.js +88 -81
- package/dist/index.js.map +1 -1
- package/dist-esm/src/constants.js +1 -1
- package/dist-esm/src/constants.js.map +1 -1
- package/dist-esm/src/credentials/environmentCredential.js +2 -2
- package/dist-esm/src/credentials/environmentCredential.js.map +1 -1
- package/dist-esm/src/credentials/interactiveBrowserCredential.browser.js +1 -1
- package/dist-esm/src/credentials/interactiveBrowserCredential.browser.js.map +1 -1
- package/dist-esm/src/credentials/managedIdentityCredential/arcMsi.js.map +1 -1
- package/dist-esm/src/credentials/visualStudioCodeCredential.js +5 -0
- package/dist-esm/src/credentials/visualStudioCodeCredential.js.map +1 -1
- package/dist-esm/src/msal/browserFlows/msalBrowserCommon.js +5 -2
- package/dist-esm/src/msal/browserFlows/msalBrowserCommon.js.map +1 -1
- package/dist-esm/src/msal/nodeFlows/msalNodeCommon.js +8 -6
- package/dist-esm/src/msal/nodeFlows/msalNodeCommon.js.map +1 -1
- package/dist-esm/src/msal/nodeFlows/msalOpenBrowser.js +1 -1
- package/dist-esm/src/msal/nodeFlows/msalOpenBrowser.js.map +1 -1
- package/dist-esm/src/util/processMultiTenantRequest.browser.js.map +1 -1
- package/dist-esm/src/util/processMultiTenantRequest.js.map +1 -1
- package/package.json +5 -5
- package/types/identity.d.ts +7 -2
package/README.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# Azure Identity client library for JavaScript
|
|
2
2
|
|
|
3
|
-
The Azure Identity library provides [Azure Active Directory (Azure AD)](https://
|
|
3
|
+
The Azure Identity library provides [Azure Active Directory (Azure AD)](https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis) token authentication through a set of convenient [TokenCredential](https://learn.microsoft.com/javascript/api/@azure/core-auth/tokencredential) implementations.
|
|
4
4
|
|
|
5
5
|
For examples of various credentials, see the [Azure Identity examples page](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md).
|
|
6
6
|
|
|
@@ -8,8 +8,8 @@ Key links:
|
|
|
8
8
|
|
|
9
9
|
- [Source code](https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/identity/identity)
|
|
10
10
|
- [Package (npm)](https://www.npmjs.com/package/@azure/identity)
|
|
11
|
-
- [API Reference Documentation](https://
|
|
12
|
-
- [
|
|
11
|
+
- [API Reference Documentation](https://learn.microsoft.com/javascript/api/@azure/identity)
|
|
12
|
+
- [Azure AD documentation](https://azure.microsoft.com/services/active-directory/)
|
|
13
13
|
- [Samples](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/v2)
|
|
14
14
|
|
|
15
15
|
## Getting started
|
|
@@ -46,7 +46,7 @@ The credential classes exposed by `@azure/identity` are focused on providing the
|
|
|
46
46
|
|
|
47
47
|
All credential types provided by `@azure/identity` are supported in Node.js. For browsers, `InteractiveBrowserCredential` is the credential type to be used for basic authentication scenarios.
|
|
48
48
|
|
|
49
|
-
Most of the credential types offered by `@azure/identity` use the [Microsoft Authentication Library for JavaScript (MSAL.js)](https://github.com/AzureAD/microsoft-authentication-library-for-js). Specifically, we use the v2 MSAL.js libraries, which use [OAuth 2.0 Authorization Code Flow with PKCE](https://
|
|
49
|
+
Most of the credential types offered by `@azure/identity` use the [Microsoft Authentication Library for JavaScript (MSAL.js)](https://github.com/AzureAD/microsoft-authentication-library-for-js). Specifically, we use the v2 MSAL.js libraries, which use [OAuth 2.0 Authorization Code Flow with PKCE](https://learn.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow) and are [OpenID-compliant](https://learn.microsoft.com/azure/active-directory/develop/v2-protocols-oidc). While `@azure/identity` focuses on simplicity, the MSAL.js libraries, such as [@azure/msal-common](https://www.npmjs.com/package/@azure/msal-common), [@azure/msal-node](https://www.npmjs.com/package/@azure/msal-node), and [@azure/msal-browser](https://www.npmjs.com/package/@azure/msal-browser), are designed to provide robust support for the authentication protocols that Azure supports.
|
|
50
50
|
|
|
51
51
|
#### When to use something else
|
|
52
52
|
|
|
@@ -64,7 +64,7 @@ For advanced authentication workflows in the browser, we have a section where we
|
|
|
64
64
|
|
|
65
65
|
While we recommend using managed identity or service principal authentication in your production application, it is typical for a developer to use their own account for authenticating calls to Azure services when debugging and executing code locally. There are several developer tools which can be used to perform this authentication in your development environment.
|
|
66
66
|
|
|
67
|
-
####
|
|
67
|
+
#### Authenticate via the Azure CLI
|
|
68
68
|
|
|
69
69
|
Applications using the `AzureCliCredential`, whether directly or via the `DefaultAzureCredential`, can use the Azure CLI account to authenticate calls in the application when running locally.
|
|
70
70
|
|
|
@@ -76,7 +76,7 @@ For systems without a default web browser, the `az login` command will use the d
|
|
|
76
76
|
|
|
77
77
|
![Azure CLI Account Device Code Sign In][azureclilogindevicecode_image]
|
|
78
78
|
|
|
79
|
-
####
|
|
79
|
+
#### Authenticate via Azure PowerShell
|
|
80
80
|
|
|
81
81
|
Applications using the `AzurePowerShellCredential`, whether directly or via the `DefaultAzureCredential`, can use the account connected to Azure PowerShell to authenticate calls in the application when running locally.
|
|
82
82
|
|
|
@@ -98,23 +98,23 @@ It's a [known issue](https://github.com/Azure/azure-sdk-for-js/issues/20500) tha
|
|
|
98
98
|
|
|
99
99
|
### Authenticate the client in browsers
|
|
100
100
|
|
|
101
|
-
To authenticate Azure
|
|
101
|
+
To authenticate Azure SDK clients within web browsers, we offer the `InteractiveBrowserCredential`, which can be set to use redirection or popups to complete the authentication flow. It's necessary to [create an Azure App Registration](https://learn.microsoft.com/azure/active-directory/develop/scenario-spa-app-registration) in the Azure portal for your web application first.
|
|
102
102
|
|
|
103
103
|
## Key concepts
|
|
104
104
|
|
|
105
|
-
If this is your first time using `@azure/identity` or the Microsoft
|
|
105
|
+
If this is your first time using `@azure/identity` or the Microsoft Identity platform (Azure AD), read [Using `@azure/identity` with Microsoft Identity Platform](https://github.com/Azure/azure-sdk-for-js/blob/main/documentation/using-azure-identity.md) first. This document provides a deeper understanding of the platform and how to configure your Azure account correctly.
|
|
106
106
|
|
|
107
107
|
### Credentials
|
|
108
108
|
|
|
109
|
-
A credential is a class which contains or can obtain the data needed for a service client to authenticate requests. Service clients across Azure SDK accept credentials when they
|
|
109
|
+
A credential is a class which contains or can obtain the data needed for a service client to authenticate requests. Service clients across the Azure SDK accept credentials when they're constructed. Service clients use those credentials to authenticate requests to the service.
|
|
110
110
|
|
|
111
|
-
The Azure Identity library focuses on OAuth authentication with Azure
|
|
111
|
+
The Azure Identity library focuses on OAuth authentication with Azure AD, and it offers a variety of credential classes capable of acquiring an Azure AD token to authenticate service requests. All of the credential classes in this library are implementations of the [TokenCredential](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-auth/src/tokenCredential.ts) abstract class, and any of them can be used by to construct service clients capable of authenticating with a TokenCredential.
|
|
112
112
|
|
|
113
113
|
See [Credential Classes](#credential-classes).
|
|
114
114
|
|
|
115
115
|
### DefaultAzureCredential
|
|
116
116
|
|
|
117
|
-
The `DefaultAzureCredential` is appropriate for most scenarios where the application is intended to ultimately be run in
|
|
117
|
+
The `DefaultAzureCredential` is appropriate for most scenarios where the application is intended to ultimately be run in Azure. This is because the `DefaultAzureCredential` combines credentials commonly used to authenticate when deployed with credentials used to authenticate in a development environment.
|
|
118
118
|
|
|
119
119
|
> Note: `DefaultAzureCredential` is intended to simplify getting started with the SDK by handling common scenarios with reasonable default behaviors. Developers who want more control or whose scenario isn't served by the default settings should use other credential types.
|
|
120
120
|
|
|
@@ -129,7 +129,7 @@ If used from Node.js, the `DefaultAzureCredential` will attempt to authenticate
|
|
|
129
129
|
|
|
130
130
|
#### Note about `VisualStudioCodeCredential`
|
|
131
131
|
|
|
132
|
-
Due to a [known issue](https://github.com/Azure/azure-sdk-for-js/issues/20500), `VisualStudioCodeCredential` has been removed from the `DefaultAzureCredential` token chain. When the issue is resolved in a future release
|
|
132
|
+
Due to a [known issue](https://github.com/Azure/azure-sdk-for-js/issues/20500), `VisualStudioCodeCredential` has been removed from the `DefaultAzureCredential` token chain. When the issue is resolved in a future release, this change will be reverted.
|
|
133
133
|
|
|
134
134
|
## Plugins
|
|
135
135
|
|
|
@@ -138,41 +138,11 @@ Azure Identity for JavaScript provides a plugin API that allows us to provide ce
|
|
|
138
138
|
- [`@azure/identity-cache-persistence`](https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/identity/identity-cache-persistence), which provides persistent token caching in Node.js using a native secure storage system provided by your operating system. This plugin allows cached `access_token` values to persist across sessions, meaning that an interactive login flow does not need to be repeated as long as a cached token is available.
|
|
139
139
|
- [`@azure/identity-vscode`](https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/identity/identity-vscode), which provides the dependencies of `VisualStudioCodeCredential` and enables it. Without this plugin, the `VisualStudioCodeCredential` in this package will throw a `CredentialUnavailableError`. The plugin provides the underlying implementation of this credential, enabling it for use both on its own and as part of the `DefaultAzureCredential` described above.
|
|
140
140
|
|
|
141
|
-
## Environment Variables
|
|
142
|
-
|
|
143
|
-
`DefaultAzureCredential` and `EnvironmentCredential` can be configured with environment variables. Each type of authentication requires values for specific variables:
|
|
144
|
-
|
|
145
|
-
#### Service principal with secret
|
|
146
|
-
|
|
147
|
-
| variable name | value |
|
|
148
|
-
| --------------------- | ----------------------------------------------------- |
|
|
149
|
-
| `AZURE_CLIENT_ID` | id of an Azure Active Directory application |
|
|
150
|
-
| `AZURE_TENANT_ID` | id of the application's Azure Active Directory tenant |
|
|
151
|
-
| `AZURE_CLIENT_SECRET` | one of the application's client secrets |
|
|
152
|
-
|
|
153
|
-
#### Service principal with certificate
|
|
154
|
-
|
|
155
|
-
| variable name | value |
|
|
156
|
-
| ------------------------------- | ------------------------------------------------------------------------------------------ |
|
|
157
|
-
| `AZURE_CLIENT_ID` | id of an Azure Active Directory application |
|
|
158
|
-
| `AZURE_TENANT_ID` | id of the application's Azure Active Directory tenant |
|
|
159
|
-
| `AZURE_CLIENT_CERTIFICATE_PATH` | path to a PEM-encoded certificate file including private key (without password protection) |
|
|
160
|
-
|
|
161
|
-
#### Username and password
|
|
162
|
-
|
|
163
|
-
| variable name | value |
|
|
164
|
-
| ----------------- | ------------------------------------------- |
|
|
165
|
-
| `AZURE_CLIENT_ID` | id of an Azure Active Directory application |
|
|
166
|
-
| `AZURE_USERNAME` | a username (usually an email address) |
|
|
167
|
-
| `AZURE_PASSWORD` | that user's password |
|
|
168
|
-
|
|
169
|
-
Configuration is attempted in the above order. For example, if values for a client secret and certificate are both present, the client secret will be used.
|
|
170
|
-
|
|
171
141
|
## Examples
|
|
172
142
|
|
|
173
143
|
You can find more examples of using various credentials in [Azure Identity Examples Page](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md)
|
|
174
144
|
|
|
175
|
-
###
|
|
145
|
+
### Authenticate with the `DefaultAzureCredential`
|
|
176
146
|
|
|
177
147
|
This example demonstrates authenticating the `KeyClient` from the [@azure/keyvault-keys](https://www.npmjs.com/package/@azure/keyvault-keys) client library using the `DefaultAzureCredential`.
|
|
178
148
|
|
|
@@ -193,9 +163,9 @@ const credential = new DefaultAzureCredential();
|
|
|
193
163
|
const client = new KeyClient(vaultUrl, credential);
|
|
194
164
|
```
|
|
195
165
|
|
|
196
|
-
###
|
|
166
|
+
### Specify a user-assigned managed identity with the `DefaultAzureCredential`
|
|
197
167
|
|
|
198
|
-
A relatively common scenario involves authenticating using a user
|
|
168
|
+
A relatively common scenario involves authenticating using a user-assigned managed identity for an Azure resource. Explore the [example on Authenticating a user-assigned managed identity with DefaultAzureCredential](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-user-assigned-managed-identity-with-defaultazurecredential) to see how this is made a relatively straightforward task that can be configured using environment variables or in code.
|
|
199
169
|
|
|
200
170
|
### Define a custom authentication flow with the `ChainedTokenCredential`
|
|
201
171
|
|
|
@@ -215,18 +185,19 @@ const { KeyClient } = require("@azure/keyvault-keys");
|
|
|
215
185
|
const client = new KeyClient(vaultUrl, credentialChain);
|
|
216
186
|
```
|
|
217
187
|
|
|
218
|
-
## Managed
|
|
188
|
+
## Managed identity support
|
|
219
189
|
|
|
220
|
-
The [Managed identity authentication](https://
|
|
190
|
+
The [Managed identity authentication](https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview) is supported via either the `DefaultAzureCredential` or the `ManagedIdentityCredential` credential classes directly for the following Azure services:
|
|
221
191
|
|
|
222
|
-
- [Azure
|
|
223
|
-
- [Azure
|
|
224
|
-
- [Azure
|
|
225
|
-
- [Azure
|
|
226
|
-
- [Azure
|
|
227
|
-
- [Azure
|
|
192
|
+
- [Azure App Service and Azure Functions](https://learn.microsoft.com/azure/app-service/overview-managed-identity)
|
|
193
|
+
- [Azure Arc](https://learn.microsoft.com/azure/azure-arc/servers/managed-identity-authentication)
|
|
194
|
+
- [Azure Cloud Shell](https://learn.microsoft.com/azure/cloud-shell/msi-authorization)
|
|
195
|
+
- [Azure Kubernetes Service](https://learn.microsoft.com/azure/aks/use-managed-identity)
|
|
196
|
+
- [Azure Service Fabric](https://learn.microsoft.com/azure/service-fabric/concepts-managed-identity)
|
|
197
|
+
- [Azure Virtual Machines](https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token)
|
|
198
|
+
- [Azure Virtual Machines Scale Sets](https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/qs-configure-powershell-windows-vmss)
|
|
228
199
|
|
|
229
|
-
For examples of how to use managed identity for authentication
|
|
200
|
+
For examples of how to use managed identity for authentication, see [the examples](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-in-azure-with-managed-identity).
|
|
230
201
|
|
|
231
202
|
## Cloud configuration
|
|
232
203
|
|
|
@@ -246,45 +217,78 @@ const credential = new ClientSecretCredential(
|
|
|
246
217
|
|
|
247
218
|
Not all credentials require this configuration. Credentials that authenticate through a development tool, such as `AzureCliCredential`, use that tool's configuration. Similarly, `VisualStudioCodeCredential` accepts an `authorityHost` argument but defaults to the `authorityHost` matching Visual Studio Code's **Azure: Cloud** setting.
|
|
248
219
|
|
|
249
|
-
## Credential
|
|
220
|
+
## Credential classes
|
|
250
221
|
|
|
251
|
-
###
|
|
222
|
+
### Authenticate Azure-hosted applications
|
|
252
223
|
|
|
253
224
|
| Credential | Usage | Example |
|
|
254
225
|
| ----------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
255
|
-
| [`DefaultAzureCredential`](https://
|
|
256
|
-
| [`ChainedTokenCredential`](https://
|
|
257
|
-
| [`EnvironmentCredential`](https://
|
|
258
|
-
| [`ManagedIdentityCredential`](https://
|
|
226
|
+
| [`DefaultAzureCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/defaultazurecredential?view=azure-node-latest) | Provides a simplified authentication experience to quickly start developing applications run in Azure. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-with-defaultazurecredential) |
|
|
227
|
+
| [`ChainedTokenCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/chainedtokencredential?view=azure-node-latest) | Allows users to define custom authentication flows composing multiple credentials. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#chaining-credentials) |
|
|
228
|
+
| [`EnvironmentCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/environmentcredential?view=azure-node-latest) | Authenticates a service principal or user via credential information specified in environment variables. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-service-principal-with-environment-credentials) |
|
|
229
|
+
| [`ManagedIdentityCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/managedidentitycredential?view=azure-node-latest) | Authenticates the managed identity of an Azure resource. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-in-azure-with-managed-identity) |
|
|
259
230
|
|
|
260
|
-
###
|
|
231
|
+
### Authenticate service principals
|
|
261
232
|
|
|
262
233
|
| Credential | Usage | Example | Reference |
|
|
263
234
|
| --------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
|
|
264
|
-
| `ClientAssertionCredential` | Authenticates a service principal using a
|
|
265
|
-
| [`ClientCertificateCredential`](https://
|
|
266
|
-
| [`ClientSecretCredential`](https://
|
|
235
|
+
| [`ClientAssertionCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/clientassertioncredential?view=azure-node-latest) | Authenticates a service principal using a signed client assertion. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-service-principal-with-a-client-assertion) | [Service principal authentication](https://learn.microsoft.com/azure/active-directory/develop/app-objects-and-service-principals) |
|
|
236
|
+
| [`ClientCertificateCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/clientcertificatecredential?view=azure-node-latest) | Authenticates a service principal using a certificate. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-service-principal-with-a-client-certificate) | [Service principal authentication](https://learn.microsoft.com/azure/active-directory/develop/app-objects-and-service-principals) |
|
|
237
|
+
| [`ClientSecretCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/clientsecretcredential?view=azure-node-latest) | Authenticates a service principal using a secret. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-service-principal-with-a-client-secret) | [Service principal authentication](https://learn.microsoft.com/azure/active-directory/develop/app-objects-and-service-principals) |
|
|
267
238
|
|
|
268
|
-
###
|
|
239
|
+
### Authenticate users
|
|
269
240
|
|
|
270
241
|
| Credential | Usage | Example | Reference |
|
|
271
242
|
| ----------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
|
|
272
|
-
| [`AuthorizationCodeCredential`](https://
|
|
273
|
-
| [`DeviceCodeCredential`](https://
|
|
274
|
-
| [`InteractiveBrowserCredential`](https://
|
|
275
|
-
| [`OnBehalfOfCredential`](https://
|
|
276
|
-
| [`UsernamePasswordCredential`](https://
|
|
243
|
+
| [`AuthorizationCodeCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/authorizationcodecredential?view=azure-node-latest) | Authenticates a user with a previously obtained authorization code. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-user-account-with-auth-code-flow) | [OAuth2 authentication code](https://learn.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow) |
|
|
244
|
+
| [`DeviceCodeCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/devicecodecredential?view=azure-node-latest) | Interactively authenticates a user on devices with limited UI. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-user-account-with-device-code-flow) | [Device code authentication](https://learn.microsoft.com/azure/active-directory/develop/v2-oauth2-device-code) |
|
|
245
|
+
| [`InteractiveBrowserCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/interactivebrowsercredential?view=azure-node-latest) | Interactively authenticates a user with the default system browser. Read more about how this happens [here](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/interactive-browser-credential.md). | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-user-account-interactively-in-the-browser) | [OAuth2 authentication code](https://learn.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow) |
|
|
246
|
+
| [`OnBehalfOfCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/onbehalfofcredential?view=azure-node-latest) | Propagates the delegated user identity and permissions through the request chain | | [On-behalf-of authentication](https://learn.microsoft.com/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow)
|
|
247
|
+
| [`UsernamePasswordCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/usernamepasswordcredential?view=azure-node-latest) | Authenticates a user with a username and password. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-user-account-with-username-and-password) | [Username + password authentication](https://learn.microsoft.com/azure/active-directory/develop/v2-oauth-ropc) |
|
|
277
248
|
|
|
278
|
-
###
|
|
249
|
+
### Authenticate via development tools
|
|
279
250
|
|
|
280
251
|
| Credential | Usage | Example | Reference |
|
|
281
252
|
| ----------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
|
|
282
|
-
| [`AzureCliCredential`](https://
|
|
283
|
-
| [`AzurePowerShellCredential`](https://
|
|
253
|
+
| [`AzureCliCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/azureclicredential?view=azure-node-latest) | Authenticate in a development environment with the Azure CLI. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-user-account-with-azure-cli) | [Azure CLI authentication](https://learn.microsoft.com/cli/azure/authenticate-azure-cli) |
|
|
254
|
+
| [`AzurePowerShellCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/azurepowershellcredential?view=azure-node-latest) | Authenticate in a development environment using Azure PowerShell. | [example](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/samples/AzureIdentityExamples.md#authenticating-a-user-account-with-azure-powershell) | [Azure PowerShell authentication](https://learn.microsoft.com/powershell/azure/authenticate-azureps) |
|
|
255
|
+
| [`VisualStudioCodeCredential`](https://learn.microsoft.com/javascript/api/@azure/identity/visualstudiocodecredential?view=azure-node-latest) | Authenticates as the user signed in to the Visual Studio Code Azure Account extension.| | [VS Code Azure Account extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode.azure-account)
|
|
256
|
+
|
|
257
|
+
## Environment variables
|
|
258
|
+
|
|
259
|
+
`DefaultAzureCredential` and `EnvironmentCredential` can be configured with environment variables. Each type of authentication requires values for specific variables.
|
|
260
|
+
|
|
261
|
+
#### Service principal with secret
|
|
262
|
+
|
|
263
|
+
| Variable name | Value |
|
|
264
|
+
| --------------------- | --------------------------------------- |
|
|
265
|
+
| `AZURE_CLIENT_ID` | ID of an Azure AD application |
|
|
266
|
+
| `AZURE_TENANT_ID` | ID of the application's Azure AD tenant |
|
|
267
|
+
| `AZURE_CLIENT_SECRET` | one of the application's client secrets |
|
|
268
|
+
|
|
269
|
+
#### Service principal with certificate
|
|
270
|
+
|
|
271
|
+
| Variable name | Value |
|
|
272
|
+
| ----------------------------------- | ------------------------------------------------------------ |
|
|
273
|
+
| `AZURE_CLIENT_ID` | ID of an Azure AD application |
|
|
274
|
+
| `AZURE_TENANT_ID` | ID of the application's Azure AD tenant |
|
|
275
|
+
| `AZURE_CLIENT_CERTIFICATE_PATH` | path to a PEM-encoded certificate file including private key |
|
|
276
|
+
| `AZURE_CLIENT_CERTIFICATE_PASSWORD` | password of the certificate file, if any |
|
|
277
|
+
|
|
278
|
+
#### Username and password
|
|
279
|
+
|
|
280
|
+
| Variable name | Value |
|
|
281
|
+
| ----------------- | --------------------------------------- |
|
|
282
|
+
| `AZURE_CLIENT_ID` | ID of an Azure AD application |
|
|
283
|
+
| `AZURE_TENANT_ID` | ID of the application's Azure AD tenant |
|
|
284
|
+
| `AZURE_USERNAME` | a username (usually an email address) |
|
|
285
|
+
| `AZURE_PASSWORD` | that user's password |
|
|
286
|
+
|
|
287
|
+
Configuration is attempted in the above order. For example, if values for a client secret and certificate are both present, the client secret will be used.
|
|
284
288
|
|
|
285
289
|
## Troubleshooting
|
|
286
290
|
|
|
287
|
-
### Error
|
|
291
|
+
### Error handling
|
|
288
292
|
|
|
289
293
|
Credentials raise `AuthenticationError` when they fail to authenticate. This class has a `message` field which describes why authentication failed. An `AggregateAuthenticationError` will be raised by `ChainedTokenCredential` with an `errors` field containing an array of errors from each credential in the chain.
|
|
290
294
|
|
|
@@ -338,19 +342,21 @@ For assistance with troubleshooting, see the [troubleshooting guide](https://aka
|
|
|
338
342
|
|
|
339
343
|
### Read the documentation
|
|
340
344
|
|
|
341
|
-
API documentation for this library can be found on our [documentation site](https://
|
|
345
|
+
API documentation for this library can be found on our [documentation site](https://learn.microsoft.com/javascript/api/@azure/identity).
|
|
342
346
|
|
|
343
347
|
### Client library support
|
|
344
348
|
|
|
345
349
|
Client and management libraries listed on the [Azure SDK releases page](https://azure.github.io/azure-sdk/releases/latest/js.html) that support Azure AD authentication accept credentials from this library. Learn more about using these libraries in their documentation, which is linked from the releases page.
|
|
346
350
|
|
|
347
|
-
### Known
|
|
351
|
+
### Known issues
|
|
348
352
|
|
|
349
353
|
#### Azure AD B2C support
|
|
350
354
|
|
|
351
|
-
This library
|
|
355
|
+
This library doesn't support the [Azure AD B2C](https://learn.microsoft.com/azure/active-directory-b2c/overview) service.
|
|
356
|
+
|
|
357
|
+
For other open issues, see the library's [GitHub repository](https://github.com/Azure/azure-sdk-for-js/issues?q=is%3Aopen+is%3Aissue+label%3AAzure.Identity).
|
|
352
358
|
|
|
353
|
-
### Provide
|
|
359
|
+
### Provide feedback
|
|
354
360
|
|
|
355
361
|
If you encounter bugs or have suggestions, please [open an issue](https://github.com/Azure/azure-sdk-for-js/issues).
|
|
356
362
|
|
|
@@ -367,8 +373,8 @@ If you'd like to contribute to this library, please read the [contributing guide
|
|
|
367
373
|
[7]: https://azuresdkdocs.blob.core.windows.net/$web/javascript/azure-identity/1.0.0/classes/authorizationcodecredential.html
|
|
368
374
|
[8]: https://azuresdkdocs.blob.core.windows.net/$web/javascript/azure-identity/1.0.0/classes/interactivebrowsercredential.html
|
|
369
375
|
[9]: https://azuresdkdocs.blob.core.windows.net/$web/javascript/azure-identity/1.0.0/classes/usernamepasswordcredential.html
|
|
370
|
-
[azure_cli]: https://
|
|
371
|
-
[azure_powershell]: https://
|
|
376
|
+
[azure_cli]: https://learn.microsoft.com/cli/azure
|
|
377
|
+
[azure_powershell]: https://learn.microsoft.com/powershell/azure/
|
|
372
378
|
[azureclilogin_image]: https://raw.githubusercontent.com/Azure/azure-sdk-for-js/main/sdk/identity/identity/images/AzureCliLogin.png
|
|
373
379
|
[azureclilogindevicecode_image]: https://raw.githubusercontent.com/Azure/azure-sdk-for-js/main/sdk/identity/identity/images/AzureCliLoginDeviceCode.png
|
|
374
380
|
[azurepowershelllogin_image]: https://raw.githubusercontent.com/Azure/azure-sdk-for-js/main/sdk/identity/identity/images/AzurePowerShellLogin.png
|
package/dist/index.js
CHANGED
|
@@ -256,7 +256,7 @@ function credentialLogger(title, log = logger$l) {
|
|
|
256
256
|
/**
|
|
257
257
|
* Current version of the `@azure/identity` package.
|
|
258
258
|
*/
|
|
259
|
-
const SDK_VERSION = `3.1.0
|
|
259
|
+
const SDK_VERSION = `3.1.0`;
|
|
260
260
|
/**
|
|
261
261
|
* The default client ID for authentication
|
|
262
262
|
* @internal
|
|
@@ -512,6 +512,78 @@ function deserializeAuthenticationRecord(serializedRecord) {
|
|
|
512
512
|
return parsed;
|
|
513
513
|
}
|
|
514
514
|
|
|
515
|
+
// Copyright (c) Microsoft Corporation.
|
|
516
|
+
// Licensed under the MIT license.
|
|
517
|
+
function createConfigurationErrorMessage(tenantId) {
|
|
518
|
+
return `The current credential is not configured to acquire tokens for tenant ${tenantId}. To enable acquiring tokens for this tenant add it to the AdditionallyAllowedTenants on the credential options, or add "*" to AdditionallyAllowedTenants to allow acquiring tokens for any tenant.`;
|
|
519
|
+
}
|
|
520
|
+
/**
|
|
521
|
+
* Of getToken contains a tenantId, this functions allows picking this tenantId as the appropriate for authentication,
|
|
522
|
+
* unless multitenant authentication has been disabled through the AZURE_IDENTITY_DISABLE_MULTITENANTAUTH (on Node.js),
|
|
523
|
+
* or unless the original tenant Id is `adfs`.
|
|
524
|
+
* @internal
|
|
525
|
+
*/
|
|
526
|
+
function processMultiTenantRequest(tenantId, getTokenOptions, additionallyAllowedTenantIds = []) {
|
|
527
|
+
var _a;
|
|
528
|
+
let resolvedTenantId;
|
|
529
|
+
if (process.env.AZURE_IDENTITY_DISABLE_MULTITENANTAUTH) {
|
|
530
|
+
resolvedTenantId = tenantId;
|
|
531
|
+
}
|
|
532
|
+
else if (tenantId === "adfs") {
|
|
533
|
+
resolvedTenantId = tenantId;
|
|
534
|
+
}
|
|
535
|
+
else {
|
|
536
|
+
resolvedTenantId = (_a = getTokenOptions === null || getTokenOptions === void 0 ? void 0 : getTokenOptions.tenantId) !== null && _a !== void 0 ? _a : tenantId;
|
|
537
|
+
}
|
|
538
|
+
if (tenantId &&
|
|
539
|
+
resolvedTenantId !== tenantId &&
|
|
540
|
+
!additionallyAllowedTenantIds.includes("*") &&
|
|
541
|
+
!additionallyAllowedTenantIds.some((t) => t.localeCompare(resolvedTenantId) === 0)) {
|
|
542
|
+
throw new Error(createConfigurationErrorMessage(tenantId));
|
|
543
|
+
}
|
|
544
|
+
return resolvedTenantId;
|
|
545
|
+
}
|
|
546
|
+
|
|
547
|
+
// Copyright (c) Microsoft Corporation.
|
|
548
|
+
/**
|
|
549
|
+
* @internal
|
|
550
|
+
*/
|
|
551
|
+
function checkTenantId(logger, tenantId) {
|
|
552
|
+
if (!tenantId.match(/^[0-9a-zA-Z-.:/]+$/)) {
|
|
553
|
+
const error = new Error("Invalid tenant id provided. You can locate your tenant id by following the instructions listed here: https://docs.microsoft.com/partner-center/find-ids-and-domain-names.");
|
|
554
|
+
logger.info(formatError("", error));
|
|
555
|
+
throw error;
|
|
556
|
+
}
|
|
557
|
+
}
|
|
558
|
+
/**
|
|
559
|
+
* @internal
|
|
560
|
+
*/
|
|
561
|
+
function resolveTenantId(logger, tenantId, clientId) {
|
|
562
|
+
if (tenantId) {
|
|
563
|
+
checkTenantId(logger, tenantId);
|
|
564
|
+
return tenantId;
|
|
565
|
+
}
|
|
566
|
+
if (!clientId) {
|
|
567
|
+
clientId = DeveloperSignOnClientId;
|
|
568
|
+
}
|
|
569
|
+
if (clientId !== DeveloperSignOnClientId) {
|
|
570
|
+
return "common";
|
|
571
|
+
}
|
|
572
|
+
return "organizations";
|
|
573
|
+
}
|
|
574
|
+
/**
|
|
575
|
+
* @internal
|
|
576
|
+
*/
|
|
577
|
+
function resolveAddionallyAllowedTenantIds(additionallyAllowedTenants) {
|
|
578
|
+
if (!additionallyAllowedTenants || additionallyAllowedTenants.length === 0) {
|
|
579
|
+
return [];
|
|
580
|
+
}
|
|
581
|
+
if (additionallyAllowedTenants.includes("*")) {
|
|
582
|
+
return ALL_TENANTS;
|
|
583
|
+
}
|
|
584
|
+
return additionallyAllowedTenants;
|
|
585
|
+
}
|
|
586
|
+
|
|
515
587
|
// Copyright (c) Microsoft Corporation.
|
|
516
588
|
// Licensed under the MIT license.
|
|
517
589
|
function getIdentityTokenEndpointSuffix(tenantId) {
|
|
@@ -928,78 +1000,6 @@ var RegionalAuthority;
|
|
|
928
1000
|
RegionalAuthority["GovernmentUSDodCentral"] = "usdodcentral";
|
|
929
1001
|
})(RegionalAuthority || (RegionalAuthority = {}));
|
|
930
1002
|
|
|
931
|
-
// Copyright (c) Microsoft Corporation.
|
|
932
|
-
// Licensed under the MIT license.
|
|
933
|
-
function createConfigurationErrorMessage(tenantId) {
|
|
934
|
-
return `The current credential is not configured to acquire tokens for tenant ${tenantId}. To enable acquiring tokens for this tenant add it to the AdditionallyAllowedTenants on the credential options, or add "*" to AdditionallyAllowedTenants to allow acquiring tokens for any tenant.`;
|
|
935
|
-
}
|
|
936
|
-
/**
|
|
937
|
-
* Of getToken contains a tenantId, this functions allows picking this tenantId as the appropriate for authentication,
|
|
938
|
-
* unless multitenant authentication has been disabled through the AZURE_IDENTITY_DISABLE_MULTITENANTAUTH (on Node.js),
|
|
939
|
-
* or unless the original tenant Id is `adfs`.
|
|
940
|
-
* @internal
|
|
941
|
-
*/
|
|
942
|
-
function processMultiTenantRequest(tenantId, getTokenOptions, additionallyAllowedTenantIds = []) {
|
|
943
|
-
var _a;
|
|
944
|
-
let resolvedTenantId;
|
|
945
|
-
if (process.env.AZURE_IDENTITY_DISABLE_MULTITENANTAUTH) {
|
|
946
|
-
resolvedTenantId = tenantId;
|
|
947
|
-
}
|
|
948
|
-
else if (tenantId === "adfs") {
|
|
949
|
-
resolvedTenantId = tenantId;
|
|
950
|
-
}
|
|
951
|
-
else {
|
|
952
|
-
resolvedTenantId = (_a = getTokenOptions === null || getTokenOptions === void 0 ? void 0 : getTokenOptions.tenantId) !== null && _a !== void 0 ? _a : tenantId;
|
|
953
|
-
}
|
|
954
|
-
if (tenantId &&
|
|
955
|
-
resolvedTenantId !== tenantId &&
|
|
956
|
-
!additionallyAllowedTenantIds.includes("*") &&
|
|
957
|
-
!additionallyAllowedTenantIds.some((t) => t.localeCompare(resolvedTenantId) === 0)) {
|
|
958
|
-
throw new Error(createConfigurationErrorMessage(tenantId));
|
|
959
|
-
}
|
|
960
|
-
return resolvedTenantId;
|
|
961
|
-
}
|
|
962
|
-
|
|
963
|
-
// Copyright (c) Microsoft Corporation.
|
|
964
|
-
/**
|
|
965
|
-
* @internal
|
|
966
|
-
*/
|
|
967
|
-
function checkTenantId(logger, tenantId) {
|
|
968
|
-
if (!tenantId.match(/^[0-9a-zA-Z-.:/]+$/)) {
|
|
969
|
-
const error = new Error("Invalid tenant id provided. You can locate your tenant id by following the instructions listed here: https://docs.microsoft.com/partner-center/find-ids-and-domain-names.");
|
|
970
|
-
logger.info(formatError("", error));
|
|
971
|
-
throw error;
|
|
972
|
-
}
|
|
973
|
-
}
|
|
974
|
-
/**
|
|
975
|
-
* @internal
|
|
976
|
-
*/
|
|
977
|
-
function resolveTenantId(logger, tenantId, clientId) {
|
|
978
|
-
if (tenantId) {
|
|
979
|
-
checkTenantId(logger, tenantId);
|
|
980
|
-
return tenantId;
|
|
981
|
-
}
|
|
982
|
-
if (!clientId) {
|
|
983
|
-
clientId = DeveloperSignOnClientId;
|
|
984
|
-
}
|
|
985
|
-
if (clientId !== DeveloperSignOnClientId) {
|
|
986
|
-
return "common";
|
|
987
|
-
}
|
|
988
|
-
return "organizations";
|
|
989
|
-
}
|
|
990
|
-
/**
|
|
991
|
-
* @internal
|
|
992
|
-
*/
|
|
993
|
-
function resolveAddionallyAllowedTenantIds(additionallyAllowedTenants) {
|
|
994
|
-
if (!additionallyAllowedTenants || additionallyAllowedTenants.length === 0) {
|
|
995
|
-
return [];
|
|
996
|
-
}
|
|
997
|
-
if (additionallyAllowedTenants.includes("*")) {
|
|
998
|
-
return ALL_TENANTS;
|
|
999
|
-
}
|
|
1000
|
-
return additionallyAllowedTenants;
|
|
1001
|
-
}
|
|
1002
|
-
|
|
1003
1003
|
// Copyright (c) Microsoft Corporation.
|
|
1004
1004
|
/**
|
|
1005
1005
|
* The current persistence provider, undefined by default.
|
|
@@ -1026,20 +1026,21 @@ const msalNodeFlowCacheControl = {
|
|
|
1026
1026
|
*/
|
|
1027
1027
|
class MsalNode extends MsalBaseUtilities {
|
|
1028
1028
|
constructor(options) {
|
|
1029
|
-
var _a, _b, _c;
|
|
1029
|
+
var _a, _b, _c, _d;
|
|
1030
1030
|
super(options);
|
|
1031
1031
|
this.requiresConfidential = false;
|
|
1032
1032
|
this.msalConfig = this.defaultNodeMsalConfig(options);
|
|
1033
1033
|
this.tenantId = resolveTenantId(options.logger, options.tenantId, options.clientId);
|
|
1034
|
+
this.additionallyAllowedTenantIds = resolveAddionallyAllowedTenantIds((_a = options === null || options === void 0 ? void 0 : options.tokenCredentialOptions) === null || _a === void 0 ? void 0 : _a.additionallyAllowedTenants);
|
|
1034
1035
|
this.clientId = this.msalConfig.auth.clientId;
|
|
1035
1036
|
if (options === null || options === void 0 ? void 0 : options.getAssertion) {
|
|
1036
1037
|
this.getAssertion = options.getAssertion;
|
|
1037
1038
|
}
|
|
1038
1039
|
// If persistence has been configured
|
|
1039
|
-
if (persistenceProvider !== undefined && ((
|
|
1040
|
+
if (persistenceProvider !== undefined && ((_b = options.tokenCachePersistenceOptions) === null || _b === void 0 ? void 0 : _b.enabled)) {
|
|
1040
1041
|
this.createCachePlugin = () => persistenceProvider(options.tokenCachePersistenceOptions);
|
|
1041
1042
|
}
|
|
1042
|
-
else if ((
|
|
1043
|
+
else if ((_c = options.tokenCachePersistenceOptions) === null || _c === void 0 ? void 0 : _c.enabled) {
|
|
1043
1044
|
throw new Error([
|
|
1044
1045
|
"Persistent token caching was requested, but no persistence provider was configured.",
|
|
1045
1046
|
"You must install the identity-cache-persistence plugin package (`npm install --save @azure/identity-cache-persistence`)",
|
|
@@ -1047,7 +1048,7 @@ class MsalNode extends MsalBaseUtilities {
|
|
|
1047
1048
|
"`useIdentityPlugin(cachePersistencePlugin)` before using `tokenCachePersistenceOptions`.",
|
|
1048
1049
|
].join(" "));
|
|
1049
1050
|
}
|
|
1050
|
-
this.azureRegion = (
|
|
1051
|
+
this.azureRegion = (_d = options.regionalAuthority) !== null && _d !== void 0 ? _d : process.env.AZURE_REGIONAL_AUTHORITY_NAME;
|
|
1051
1052
|
if (this.azureRegion === RegionalAuthority.AutoDiscoverRegion) {
|
|
1052
1053
|
this.azureRegion = "AUTO_DISCOVER";
|
|
1053
1054
|
}
|
|
@@ -1195,7 +1196,8 @@ To work with multiple accounts for the same Client ID and Tenant ID, please prov
|
|
|
1195
1196
|
* If disableAutomaticAuthentication is sent through the constructor, it will prevent MSAL from requesting the user input.
|
|
1196
1197
|
*/
|
|
1197
1198
|
async getToken(scopes, options = {}) {
|
|
1198
|
-
const tenantId = processMultiTenantRequest(this.tenantId, options) ||
|
|
1199
|
+
const tenantId = processMultiTenantRequest(this.tenantId, options, this.additionallyAllowedTenantIds) ||
|
|
1200
|
+
this.tenantId;
|
|
1199
1201
|
options.authority = getAuthority(tenantId, this.authorityHost);
|
|
1200
1202
|
options.correlationId = (options === null || options === void 0 ? void 0 : options.correlationId) || this.generateUuid();
|
|
1201
1203
|
await this.init(options);
|
|
@@ -1294,6 +1296,11 @@ function getPropertyFromVSCode(property) {
|
|
|
1294
1296
|
* Connects to Azure using the credential provided by the VSCode extension 'Azure Account'.
|
|
1295
1297
|
* Once the user has logged in via the extension, this credential can share the same refresh token
|
|
1296
1298
|
* that is cached by the extension.
|
|
1299
|
+
*
|
|
1300
|
+
* It's a [known issue](https://github.com/Azure/azure-sdk-for-js/issues/20500) that this credential doesn't
|
|
1301
|
+
* work with [Azure Account extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode.azure-account)
|
|
1302
|
+
* versions newer than **0.9.11**. A long-term fix to this problem is in progress. In the meantime, consider
|
|
1303
|
+
* authenticating with {@link AzureCliCredential}.
|
|
1297
1304
|
*/
|
|
1298
1305
|
class VisualStudioCodeCredential {
|
|
1299
1306
|
/**
|
|
@@ -3088,8 +3095,8 @@ function getAdditionallyAllowedTenants() {
|
|
|
3088
3095
|
const credentialName$1 = "EnvironmentCredential";
|
|
3089
3096
|
const logger$5 = credentialLogger(credentialName$1);
|
|
3090
3097
|
/**
|
|
3091
|
-
* Enables authentication to Azure Active Directory using client secret
|
|
3092
|
-
*
|
|
3098
|
+
* Enables authentication to Azure Active Directory using a client secret or certificate, or as a user
|
|
3099
|
+
* with a username and password.
|
|
3093
3100
|
*/
|
|
3094
3101
|
class EnvironmentCredential {
|
|
3095
3102
|
/**
|
|
@@ -3429,7 +3436,7 @@ class MsalOpenBrowser extends MsalNode {
|
|
|
3429
3436
|
reject(new Error("Aborted"));
|
|
3430
3437
|
});
|
|
3431
3438
|
}
|
|
3432
|
-
openPromise.
|
|
3439
|
+
openPromise.catch((e) => {
|
|
3433
3440
|
cleanup();
|
|
3434
3441
|
reject(e);
|
|
3435
3442
|
});
|