Dev-time Credential Experience for Azure.Identity

[joshfree]

Tracking issue for feature work specific to Developer-time Azure.Identity Credential Experience

• Bring back file based auth for Management Plane: https://docs.microsoft.com/en-us/dotnet/azure/dotnet-sdk-azure-authenticate?view=azure-dotnet#mgmt-auth AZURE_AUTH_LOCATION (see Support AZURE_AUTH_LOCATION azure-sdk-for-net#9312) (@ellismg driving design requirements)

• Add Support for writing back to the SharedTokenCache (@schaabs driving design requirements) (blocked on [Identity] Azure SDK credential built on msal-node #9778)

• Add Linux and Mac SharedTokenCache Support (@jianghaolu driving design requirements) (blocked on [Identity] Azure SDK credential built on msal-node #9778)

• Improve DefaultAzureCredential/ChainedTokenCredential - e.g., tell me what Credential I'm using for dev debug scenarios (accomplied via logging change @catalinaperalta driving design requirements)

• Have ManagedIdentityCredential utilize the AZURE_CLIENT_ID environment variable. To allow user assigned identities to utilize DefaultAzureCredential (@jongio driving implementation with vendor team)

• Have TokenCredentialOptions utilize AZURE_AUTHORITY_HOST environment variable. To allow other clouds to use DefaultAzureCredential. (@jongio driving implementation with vendor team)

• CliCredentials / Better support for dev creds: CLI, PSH, VS, VS CODE, VS ONLINE, CLOUD SHELL

  • devCredentials (@schaabs driving design requirements)
  • CliCredential (@jongio driving implementation with vendor team)

[joshfree]

Moving this to the September milestone for tracking in the next Identity wave

[sadasant]

Question:

Have ManagedIdentityCredential utilize the AZURE_CLIENT_ID environment variable. To allow user assigned identities to utilize DefaultAzureCredential (@jongio driving implementation with vendor team)

Was this done here? https://github.com/Azure/azure-sdk-for-js/blob/master/sdk/identity/identity/src/credentials/defaultAzureCredential.ts#L42-L46

Please let me know if I'm missing something 🙂

[jongio]

@sadasant - it was decided to not have MICred read the env var. It's done via DAC.

[ramya-rao-a]

@jonathandturner Please add a link to the MSAL issue that we are now blocked on

[sadasant]

I believe we won't be adding support for writing back to the SharedTokenCache this month. Moving to March.

[sadasant]

These two items:

• Add Support for writing back to the SharedTokenCache (@schaabs driving design requirements) (blocked on [Identity] Azure SDK credential built on msal-node #9778)
• Add Linux and Mac SharedTokenCache Support (@jianghaolu driving design requirements) (blocked on [Identity] Azure SDK credential built on msal-node #9778)

Are fixed by this PR: #14064

[sadasant]

The PR is merged so I'm making those two items as done.

[sadasant]

For this last item:

Improve DefaultAzureCredential/ChainedTokenCredential - e.g., tell me what Credential I'm using for dev debug scenarios (accomplied via logging change @catalinaperalta driving design requirements)

I'll ask for help to @catalinaperalta to see if she can help me determine how far we're off of the mark. I can do the alignment afterwards.

[catalinaperalta]

@sadasant I took a look at Chained Token Credential and you are missing the credential information in the success logs. On line:

azure-sdk-for-js/sdk/identity/identity/src/credentials/chainedTokenCredential.ts

Line 88 in 1ca1f14

logger.getToken.info(formatSuccess(scopes));

This log message should include the credential that succeeded or you can add an additional log message that states which credential was used. In Go the message would look something like this:

Azure Identity => GetToken() result for <CREDENTIAL NAME HERE>: SUCCESS

That's basically what you need to satisfy the logging requirement for DAC and Chained Token Credential.

[sadasant]

@catalinaperalta Thank you so much! I'll make a PR