@azure/identity 4.3.1-alpha.20240627.1 → 4.3.1-alpha.20240628.2

package/dist/index.js

@@ -2232,17 +2232,22 @@ To work with multiple accounts for the same Client ID and Tenant ID, please prov
             });
         });
     }
-    async function getTokenOnBehalfOf(scopes, userAssertionToken, clientSecretOrCertificate, options = {}) {
+    async function getTokenOnBehalfOf(scopes, userAssertionToken, clientCredentials, options = {}) {
         msalLogger.getToken.info(`Attempting to acquire token on behalf of another user`);
-        if (typeof clientSecretOrCertificate === "string") {
+        if (typeof clientCredentials === "string") {
             // Client secret
             msalLogger.getToken.info(`Using client secret for on behalf of flow`);
-            state.msalConfig.auth.clientSecret = clientSecretOrCertificate;
+            state.msalConfig.auth.clientSecret = clientCredentials;
+        }
+        else if (typeof clientCredentials === "function") {
+            // Client Assertion
+            msalLogger.getToken.info(`Using client assertion callback for on behalf of flow`);
+            state.msalConfig.auth.clientAssertion = clientCredentials;
         }
         else {
             // Client certificate
             msalLogger.getToken.info(`Using client certificate for on behalf of flow`);
-            state.msalConfig.auth.clientCertificate = clientSecretOrCertificate;
+            state.msalConfig.auth.clientCertificate = clientCredentials;
         }
         const msalApp = await getConfidentialApp(options);
         try {
@@ -2382,9 +2387,8 @@ class ClientAssertionCredential {
     async getToken(scopes, options = {}) {
         return tracingClient.withSpan(`${this.constructor.name}.getToken`, options, async (newOptions) => {
             newOptions.tenantId = processMultiTenantRequest(this.tenantId, newOptions, this.additionallyAllowedTenantIds, logger$h);
-            const clientAssertion = await this.getAssertion();
             const arrayScopes = Array.isArray(scopes) ? scopes : [scopes];
-            return this.msalClient.getTokenByClientAssertion(arrayScopes, clientAssertion, newOptions);
+            return this.msalClient.getTokenByClientAssertion(arrayScopes, this.getAssertion, newOptions);
         });
     }
 }
@@ -4278,14 +4282,19 @@ class OnBehalfOfCredential {
     constructor(options) {
         const { clientSecret } = options;
         const { certificatePath, sendCertificateChain } = options;
+        const { getAssertion } = options;
         const { tenantId, clientId, userAssertionToken, additionallyAllowedTenants: additionallyAllowedTenantIds, } = options;
-        if (!tenantId || !clientId || !(clientSecret || certificatePath) || !userAssertionToken) {
-            throw new Error(`${credentialName}: tenantId, clientId, clientSecret (or certificatePath) and userAssertionToken are required parameters.`);
+        if (!tenantId ||
+            !clientId ||
+            !(clientSecret || certificatePath || getAssertion) ||
+            !userAssertionToken) {
+            throw new Error(`${credentialName}: tenantId, clientId, clientSecret (or certificatePath or getAssertion) and userAssertionToken are required parameters.`);
         }
         this.certificatePath = certificatePath;
         this.clientSecret = clientSecret;
         this.userAssertionToken = userAssertionToken;
         this.sendCertificateChain = sendCertificateChain;
+        this.clientAssertion = getAssertion;
         this.tenantId = tenantId;
         this.additionallyAllowedTenantIds = resolveAdditionallyAllowedTenantIds(additionallyAllowedTenantIds);
         this.msalClient = createMsalClient(clientId, this.tenantId, Object.assign(Object.assign({}, options), { logger, tokenCredentialOptions: options }));
@@ -4308,9 +4317,12 @@ class OnBehalfOfCredential {
             else if (this.clientSecret) {
                 return this.msalClient.getTokenOnBehalfOf(arrayScopes, this.userAssertionToken, this.clientSecret, options);
             }
+            else if (this.clientAssertion) {
+                return this.msalClient.getTokenOnBehalfOf(arrayScopes, this.userAssertionToken, this.clientAssertion, options);
+            }
             else {
-                // this is a bug, as the constructor should have thrown an error if neither clientSecret nor certificatePath were provided
-                throw new Error("Expected either clientSecret or certificatePath to be defined.");
+                // this is an invalid scenario and is a bug, as the constructor should have thrown an error if neither clientSecret nor certificatePath nor clientAssertion were provided
+                throw new Error("Expected either clientSecret or certificatePath or clientAssertion to be defined.");
             }
         });
     }