@azure/identity 4.3.0-alpha.20240507.1 → 4.3.0-beta.1

package/types/identity.d.ts

@@ -347,16 +347,17 @@ export declare interface AzureDeveloperCliCredentialOptions extends MultiTenantT
  * This credential is designed to be used in Azure Pipelines with service connections
  * as a setup for workload identity federation.
  */
-export declare class AzurePipelinesServiceConnectionCredential implements TokenCredential {
+export declare class AzurePipelinesCredential implements TokenCredential {
     private clientAssertionCredential;
+    private identityClient;
     /**
-     * AzurePipelinesServiceConnectionCredential supports Federated Identity on Azure Pipelines through Service Connections.
+     * AzurePipelinesCredential supports Federated Identity on Azure Pipelines through Service Connections.
      * @param tenantId - tenantId associated with the service connection
      * @param clientId - clientId associated with the service connection
      * @param serviceConnectionId - id for the service connection, as found in the querystring's resourceId key
      * @param options - The identity client options to use for authentication.
      */
-    constructor(tenantId: string, clientId: string, serviceConnectionId: string, options?: AzurePipelinesServiceConnectionCredentialOptions);
+    constructor(tenantId: string, clientId: string, serviceConnectionId: string, options?: AzurePipelinesCredentialOptions);
     /**
      * Authenticates with Microsoft Entra ID and returns an access token if successful.
      * If authentication fails, a {@link CredentialUnavailableError} or {@link AuthenticationError} will be thrown with the details of the failure.
@@ -382,9 +383,9 @@ export declare class AzurePipelinesServiceConnectionCredential implements TokenC
 }
 
 /**
- * Optional parameters for the {@link AzurePipelinesServiceConnectionCredential} class.
+ * Optional parameters for the {@link AzurePipelinesCredential} class.
  */
-export declare interface AzurePipelinesServiceConnectionCredentialOptions extends MultiTenantTokenCredentialOptions, CredentialPersistenceOptions, AuthorityValidationOptions {
+export declare interface AzurePipelinesCredentialOptions extends MultiTenantTokenCredentialOptions, CredentialPersistenceOptions, AuthorityValidationOptions {
 }
 
 /**
@@ -940,8 +941,9 @@ export declare function deserializeAuthenticationRecord(serializedRecord: string
 export declare class DeviceCodeCredential implements TokenCredential {
     private tenantId?;
     private additionallyAllowedTenantIds;
-    private msalFlow;
     private disableAutomaticAuthentication?;
+    private msalClient;
+    private userPromptCallback;
     /**
      * Creates an instance of DeviceCodeCredential with the details needed
      * to initiate the device code authorization flow with Microsoft Entra ID.

package/dist-esm/src/credentials/azurePipelinesServiceConnectionCredential.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"azurePipelinesServiceConnectionCredential.js","sourceRoot":"","sources":["../../../src/credentials/azurePipelinesServiceConnectionCredential.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAGlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAGnC,MAAM,cAAc,GAAG,2CAA2C,CAAC;AACnE,MAAM,MAAM,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;AAChD,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEzC;;;GAGG;AACH,MAAM,OAAO,yCAAyC;IAGpD;;;;;;OAMG;IACH,YACE,QAAgB,EAChB,QAAgB,EAChB,mBAA2B,EAC3B,OAA0D;QAE1D,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACnD,MAAM,IAAI,0BAA0B,CAClC,GAAG,cAAc,wFAAwF,CAC1G,CAAC;QACJ,CAAC;QAED,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CACT,sEAAsE,QAAQ,eAAe,QAAQ,+BAA+B,mBAAmB,EAAE,CAC1J,CAAC;QAEF,IAAI,QAAQ,IAAI,QAAQ,IAAI,mBAAmB,EAAE,CAAC;YAChD,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACjC,MAAM,cAAc,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,2CAA2C,OAAO,CAAC,GAAG,CAAC,aAAa,SAAS,OAAO,CAAC,GAAG,CAAC,YAAY,0BAA0B,gBAAgB,wBAAwB,mBAAmB,EAAE,CAAC;YACxS,MAAM,iBAAiB,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;YAC9D,MAAM,CAAC,IAAI,CACT,sDAAsD,QAAQ,eAAe,QAAQ,+BAA+B,mBAAmB,EAAE,CAC1I,CAAC;YACF,IAAI,CAAC,yBAAyB,GAAG,IAAI,yBAAyB,CAC5D,QAAQ,EACR,QAAQ,EACR,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,iBAAiB,CAAC,EACnE,OAAO,CACR,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,QAAQ,CACnB,MAAyB,EACzB,OAAyB;QAEzB,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,GAAG,cAAc;;;;;;;;;wGAS4D,CAAC;YACnG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC3B,MAAM,IAAI,0BAA0B,CAAC,YAAY,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,gBAAgB,CAC5B,cAAsB,EACtB,iBAAyB;QAEzB,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE5B,MAAM,UAAU,GAAG,uBAAuB,EAAE,CAAC;QAE7C,MAAM,OAAO,GAAG,qBAAqB,CAAC;YACpC,GAAG,EAAE,cAAc;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,iBAAiB,CAAC;gBACzB,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,iBAAiB,EAAE;aAC7C,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,CACV,GAAG,cAAc,mFACf,QAAQ,CAAC,MACX,yBAAyB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CACpD,CAAC;YACF,MAAM,IAAI,0BAA0B,CAClC,GAAG,cAAc,mFACf,QAAQ,CAAC,MACX,yBAAyB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,SAAS,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CACV,GAAG,cAAc,qFAAqF,IAAI,CAAC,SAAS,CAClH,MAAM,CACP,EAAE,CACJ,CAAC;YACF,MAAM,IAAI,0BAA0B,CAClC,GAAG,cAAc,qFAAqF,IAAI,CAAC,SAAS,CAClH,MAAM,CACP,EAAE,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,yBAAyB;QAC/B,IACE,OAAO,CAAC,GAAG,CAAC,kCAAkC;YAC9C,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAChC,OAAO,CAAC,GAAG,CAAC,aAAa;YACzB,OAAO,CAAC,GAAG,CAAC,YAAY;YACxB,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAC9B,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,EAAE,CAAC;QAC1B,IAAI,YAAY,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,CAAC;YACpD,cAAc,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAAE,cAAc,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa;YAAE,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY;YAAE,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;YACpC,YAAY;gBACV,0PAA0P,CAAC;YAC7P,cAAc,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,0BAA0B,CAClC,GAAG,cAAc,6IAA6I,cAAc,CAAC,IAAI,CAC/K,IAAI,CACL,IAAI,YAAY,EAAE,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;CACF","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT license.\n\nimport { AccessToken, GetTokenOptions, TokenCredential } from \"@azure/core-auth\";\nimport { ClientAssertionCredential } from \"./clientAssertionCredential\";\nimport { AuthenticationError, CredentialUnavailableError } from \"../errors\";\nimport { credentialLogger } from \"../util/logging\";\nimport { checkTenantId } from \"../util/tenantIdUtils\";\nimport {\n  createDefaultHttpClient,\n  createHttpHeaders,\n  createPipelineRequest,\n} from \"@azure/core-rest-pipeline\";\nimport { AzurePipelinesServiceConnectionCredentialOptions } from \"./azurePipelinesServiceConnectionCredentialOptions\";\n\nconst credentialName = \"AzurePipelinesServiceConnectionCredential\";\nconst logger = credentialLogger(credentialName);\nconst OIDC_API_VERSION = \"7.1-preview.1\";\n\n/**\n * This credential is designed to be used in Azure Pipelines with service connections\n * as a setup for workload identity federation.\n */\nexport class AzurePipelinesServiceConnectionCredential implements TokenCredential {\n  private clientAssertionCredential: ClientAssertionCredential | undefined;\n\n  /**\n   * AzurePipelinesServiceConnectionCredential supports Federated Identity on Azure Pipelines through Service Connections.\n   * @param tenantId - tenantId associated with the service connection\n   * @param clientId - clientId associated with the service connection\n   * @param serviceConnectionId - id for the service connection, as found in the querystring's resourceId key\n   * @param options - The identity client options to use for authentication.\n   */\n  constructor(\n    tenantId: string,\n    clientId: string,\n    serviceConnectionId: string,\n    options?: AzurePipelinesServiceConnectionCredentialOptions,\n  ) {\n    if (!clientId || !tenantId || !serviceConnectionId) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. tenantId, clientId, and serviceConnectionId are required parameters.`,\n      );\n    }\n\n    checkTenantId(logger, tenantId);\n    logger.info(\n      `Invoking AzurePipelinesServiceConnectionCredential with tenant ID: ${tenantId}, clientId: ${clientId} and service connection id: ${serviceConnectionId}`,\n    );\n\n    if (clientId && tenantId && serviceConnectionId) {\n      this.ensurePipelinesSystemVars();\n      const oidcRequestUrl = `${process.env.SYSTEM_TEAMFOUNDATIONCOLLECTIONURI}${process.env.SYSTEM_TEAMPROJECTID}/_apis/distributedtask/hubs/build/plans/${process.env.SYSTEM_PLANID}/jobs/${process.env.SYSTEM_JOBID}/oidctoken?api-version=${OIDC_API_VERSION}&serviceConnectionId=${serviceConnectionId}`;\n      const systemAccessToken = `${process.env.SYSTEM_ACCESSTOKEN}`;\n      logger.info(\n        `Invoking ClientAssertionCredential with tenant ID: ${tenantId}, clientId: ${clientId} and service connection id: ${serviceConnectionId}`,\n      );\n      this.clientAssertionCredential = new ClientAssertionCredential(\n        tenantId,\n        clientId,\n        this.requestOidcToken.bind(this, oidcRequestUrl, systemAccessToken),\n        options,\n      );\n    }\n  }\n\n  /**\n   * Authenticates with Microsoft Entra ID and returns an access token if successful.\n   * If authentication fails, a {@link CredentialUnavailableError} or {@link AuthenticationError} will be thrown with the details of the failure.\n   *\n   * @param scopes - The list of scopes for which the token will have access.\n   * @param options - The options used to configure any requests this\n   *                TokenCredential implementation might make.\n   */\n  public async getToken(\n    scopes: string | string[],\n    options?: GetTokenOptions,\n  ): Promise<AccessToken> {\n    if (!this.clientAssertionCredential) {\n      const errorMessage = `${credentialName}: is unavailable. To use Federation Identity in Azure Pipelines, these are required as input parameters / env variables - \n      tenantId,\n      clientId,\n      serviceConnectionId,\n      \"SYSTEM_TEAMFOUNDATIONCOLLECTIONURI\" &&\n      \"SYSTEM_TEAMPROJECTID\" &&\n      \"SYSTEM_PLANID\" &&\n      \"SYSTEM_JOBID\" &&\n      \"SYSTEM_ACCESSTOKEN\"\n      See the troubleshooting guide for more information: https://aka.ms/azsdk/js/identity/troubleshoot`;\n      logger.error(errorMessage);\n      throw new CredentialUnavailableError(errorMessage);\n    }\n    logger.info(\"Invoking getToken() of Client Assertion Credential\");\n    return this.clientAssertionCredential.getToken(scopes, options);\n  }\n\n  /**\n   *\n   * @param oidcRequestUrl - oidc request url\n   * @param systemAccessToken - system access token\n   * @returns OIDC token from Azure Pipelines\n   */\n  private async requestOidcToken(\n    oidcRequestUrl: string,\n    systemAccessToken: string,\n  ): Promise<string> {\n    logger.info(\"Requesting OIDC token from Azure Pipelines...\");\n    logger.info(oidcRequestUrl);\n\n    const httpClient = createDefaultHttpClient();\n\n    const request = createPipelineRequest({\n      url: oidcRequestUrl,\n      method: \"POST\",\n      headers: createHttpHeaders({\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${systemAccessToken}`,\n      }),\n    });\n\n    const response = await httpClient.sendRequest(request);\n    const text = response.bodyAsText;\n    if (!text) {\n      logger.error(\n        `${credentialName}: Authenticated Failed. Received null token from OIDC request. Response status- ${\n          response.status\n        }. Complete response - ${JSON.stringify(response)}`,\n      );\n      throw new CredentialUnavailableError(\n        `${credentialName}: Authenticated Failed. Received null token from OIDC request. Response status- ${\n          response.status\n        }. Complete response - ${JSON.stringify(response)}`,\n      );\n    }\n    const result = JSON.parse(text);\n    if (result?.oidcToken) {\n      return result.oidcToken;\n    } else {\n      logger.error(\n        `${credentialName}: Authentication Failed. oidcToken field not detected in the response. Response = ${JSON.stringify(\n          result,\n        )}`,\n      );\n      throw new CredentialUnavailableError(\n        `${credentialName}: Authentication Failed. oidcToken field not detected in the response. Response = ${JSON.stringify(\n          result,\n        )}`,\n      );\n    }\n  }\n\n  /**\n   * Ensures all system env vars are there to form the request uri for OIDC token\n   * @returns void\n   * @throws CredentialUnavailableError\n   */\n  private ensurePipelinesSystemVars(): void {\n    if (\n      process.env.SYSTEM_TEAMFOUNDATIONCOLLECTIONURI &&\n      process.env.SYSTEM_TEAMPROJECTID &&\n      process.env.SYSTEM_PLANID &&\n      process.env.SYSTEM_JOBID &&\n      process.env.SYSTEM_ACCESSTOKEN\n    ) {\n      return;\n    }\n    const missingEnvVars = [];\n    let errorMessage = \"\";\n    if (!process.env.SYSTEM_TEAMFOUNDATIONCOLLECTIONURI) {\n      missingEnvVars.push(\"SYSTEM_TEAMFOUNDATIONCOLLECTIONURI\");\n    }\n    if (!process.env.SYSTEM_TEAMPROJECTID) missingEnvVars.push(\"SYSTEM_TEAMPROJECTID\");\n    if (!process.env.SYSTEM_PLANID) missingEnvVars.push(\"SYSTEM_PLANID\");\n    if (!process.env.SYSTEM_JOBID) missingEnvVars.push(\"SYSTEM_JOBID\");\n    if (!process.env.SYSTEM_ACCESSTOKEN) {\n      errorMessage +=\n        \"\\nPlease ensure that the system access token is available in the SYSTEM_ACCESSTOKEN value; this is often most easily achieved by adding a block to the end of your pipeline yaml for the task with:\\n env: \\n- SYSTEM_ACCESSTOKEN: $(System.AccessToken)\";\n      missingEnvVars.push(\"SYSTEM_ACCESSTOKEN\");\n    }\n    if (missingEnvVars.length > 0) {\n      throw new CredentialUnavailableError(\n        `${credentialName}: is unavailable. Ensure that you're running this task in an Azure Pipeline, so that following missing system variable(s) can be defined- ${missingEnvVars.join(\n          \", \",\n        )}.${errorMessage}`,\n      );\n    }\n  }\n}\n"]}

package/dist-esm/src/credentials/azurePipelinesServiceConnectionCredentialOptions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"azurePipelinesServiceConnectionCredentialOptions.js","sourceRoot":"","sources":["../../../src/credentials/azurePipelinesServiceConnectionCredentialOptions.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT license.\n\nimport { AuthorityValidationOptions } from \"./authorityValidationOptions\";\nimport { CredentialPersistenceOptions } from \"./credentialPersistenceOptions\";\nimport { MultiTenantTokenCredentialOptions } from \"./multiTenantTokenCredentialOptions\";\n\n/**\n * Optional parameters for the {@link AzurePipelinesServiceConnectionCredential} class.\n */\nexport interface AzurePipelinesServiceConnectionCredentialOptions\n  extends MultiTenantTokenCredentialOptions,\n    CredentialPersistenceOptions,\n    AuthorityValidationOptions {}\n"]}