Skip to content

Commit 7c45de3

Browse files
msJinLeiBethanyZhouisra-fel
authored
Upgrade Azure.Identity and MSAL versions and WAM (#24792)
* Upgrade Azure.Identity and MSAL versions * Enbale WAM by default * Fix static analysis issue * Fix the issues * Fix the AzConfig issue and Address review comments * Fix Microsoft.IdentityModel.Abstractions version issue * upgrade Microsoft.Identity.Client.NativeInterop to 0.16.0.0 * Disable WAM in the Sovereign Clouds * Skip BinSkim for msalruntime*.dll * Apply the existing MFA error messages to acquire token silently with broker error * revise error message --------- Co-authored-by: Beisi Zhou <[email protected]> Co-authored-by: Yeming Liu <[email protected]>
1 parent c163c6b commit 7c45de3

27 files changed

+171
-66
lines changed

‎.azure-pipelines/security-tools.yml

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -60,14 +60,21 @@ jobs:
6060
targetType: inline
6161
script: ./src/lib/pdb/CopyPdbToArtifacts.ps1
6262
pwsh: true
63+
64+
- task: PowerShell@2
65+
displayName: Generate a response text file for BinSkim
66+
inputs:
67+
targetType: 'inline'
68+
script: |
69+
New-Item $(Build.SourcesDirectory)/artifacts/MyFileList.rsp -ItemType File -Force
70+
(Get-ChildItem -Path .\artifacts\Debug -Include *.dll,*.exe -Exclude msalruntime.dll,msalruntime_arm64.dll,msalruntime_x86.dll -Recurse).FullName > $(Build.SourcesDirectory)/artifacts/MyFileList.rsp
71+
pwsh: true
6372

6473
- task: securedevelopmentteam.vss-secure-development-tools.build-task-binskim.BinSkim@3
6574
displayName: Run BinSkim
6675
inputs:
67-
InputType: 'Basic'
68-
Function: 'analyze'
69-
AnalyzeTarget: '$(Build.SourcesDirectory)/artifacts/Debug/*.dll;$(Build.SourcesDirectory)/artifacts/*.exe'
70-
AnalyzeStatistics: true
76+
InputType: 'CommandLine'
77+
arguments: 'analyze @$(Build.SourcesDirectory)/artifacts/MyFileList.rsp --recurse'
7178

7279
- task: PowerShell@2
7380
displayName: Cleanup Build
@@ -88,4 +95,4 @@ jobs:
8895
inputs:
8996
artifactName: artifacts
9097
targetPath: artifacts
91-
...
98+
...

‎src/Accounts/Accounts/ChangeLog.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
-->
2020

2121
## Upcoming Release
22+
* Web Account Manager (WAM) was set the default experience of interactive login. For more details please refer to https://go.microsoft.com/fwlink/?linkid=2272007
2223
* Enabled secrets detection option by default.
2324
* Fixed a null reference issue during the process of `Get-AzContext -ListAvailable` [#24854].
2425
* Supported interactive subscription selection for user login flow. See more details at [Announcing a new login experience with Azure PowerShell and Azure CLI

‎src/Accounts/AssemblyLoading/ConditionalAssemblyProvider.cs

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -42,15 +42,16 @@ public static void Initialize(string rootPath, IConditionalAssemblyContext conte
4242
// todo: add a tool to update assembly versions after replacing the assemblies. (Can it support newly introduced assemblies?)
4343
// todo: consider moving the list to a standalone config file
4444
#region AssemblyList
45-
CreateAssembly("netstandard2.0", "Azure.Core", "1.37.0.0"),
46-
CreateAssembly("netstandard2.0", "Azure.Identity", "1.10.3.0"),
47-
CreateAssembly("netstandard2.0", "Azure.Identity.Broker", "1.0.0.0"),
45+
CreateAssembly("netstandard2.0", "Azure.Core", "1.38.0.0"),
46+
CreateAssembly("netstandard2.0", "Azure.Identity", "1.11.2.0"),
47+
CreateAssembly("netstandard2.0", "Azure.Identity.Broker", "1.1.0.0"),
4848
CreateAssembly("netstandard2.0", "Microsoft.Bcl.AsyncInterfaces", "1.0.0.0"),
49-
CreateAssembly("netstandard2.0", "Microsoft.Identity.Client", "4.56.0.0"),
50-
CreateAssembly("netstandard2.0", "Microsoft.Identity.Client.Extensions.Msal", "4.56.0.0"),
51-
CreateAssembly("netstandard2.0", "Microsoft.Identity.Client.Broker", "4.56.0.0"),
52-
CreateAssembly("netstandard2.0", "Microsoft.Identity.Client.NativeInterop", "0.13.8.0"),
53-
CreateAssembly("netstandard2.0", "Microsoft.IdentityModel.Abstractions", "6.22.1.0"),
49+
CreateAssembly("netstandard2.0", "Microsoft.Identity.Client", "4.60.3.0"),
50+
CreateAssembly("netstandard2.0", "Microsoft.Identity.Client.Extensions.Msal", "4.60.3.0"),
51+
CreateAssembly("netstandard2.0", "Microsoft.Identity.Client.Broker", "4.60.3.0"),
52+
CreateAssembly("netstandard2.0", "Microsoft.Identity.Client.NativeInterop", "0.16.0.0"),
53+
CreateAssembly("netstandard2.0", "Microsoft.IdentityModel.Abstractions", "6.35.0.0"),
54+
CreateAssembly("netstandard2.0", "System.ClientModel", "1.0.0.0"),
5455
CreateAssembly("netstandard2.0", "System.Memory.Data", "1.0.2.0"),
5556
CreateAssembly("netstandard2.0", "System.Text.Json", "4.0.1.2"),
5657
CreateAssembly("netstandard2.0", "System.Buffers", "4.0.3.0").WithWindowsPowerShell(),

‎src/Accounts/Authentication/Authentication.csproj

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,11 @@
1212
</PropertyGroup>
1313

1414
<ItemGroup>
15-
<PackageReference Include="Azure.Identity" Version="1.10.3" />
16-
<PackageReference Include="Azure.Identity.Broker" Version="1.0.0-beta.5" />
17-
<PackageReference Include="Microsoft.Identity.Client" Version="4.56.0" />
18-
<PackageReference Include="Microsoft.Identity.Client.Extensions.Msal" Version="4.56.0" />
15+
<PackageReference Include="Azure.Identity" Version="1.11.2" />
16+
<PackageReference Include="Azure.Identity.Broker" Version="1.1.0" />
17+
<PackageReference Include="Microsoft.Identity.Client" Version="4.60.3" />
18+
<PackageReference Include="Microsoft.Identity.Client.Extensions.Msal" Version="4.60.3" />
19+
<PackageReference Include="Microsoft.Identity.Client.Broker" Version="4.60.3"/>
1920
</ItemGroup>
2021

2122
<ItemGroup>

‎src/Accounts/Authentication/Authentication/TokenCache/AdalTokenMigrator.cs

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,11 @@ public void MigrateFromAdalToMsal(string tokenCacheFile)
100100
var tenantId = GetTenantId(account.Username);
101101
if(!string.IsNullOrEmpty(tenantId))
102102
{
103-
clientApplication.AcquireTokenSilent(scopes, account).WithAuthority(environment.ActiveDirectoryAuthority, tenantId).ExecuteAsync().ConfigureAwait(false).GetAwaiter().GetResult();
103+
var uriBuilder = new UriBuilder(environment.ActiveDirectoryAuthority)
104+
{
105+
Path = tenantId
106+
};
107+
clientApplication.AcquireTokenSilent(scopes, account).WithTenantIdFromAuthority(uriBuilder.Uri).ExecuteAsync().ConfigureAwait(false).GetAwaiter().GetResult();
104108
}
105109
}
106110
//TODO: Set HomeAccountId for migration

‎src/Accounts/Authentication/Authentication/TokenCache/PowerShellTokenCacheProvider.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
using Hyak.Common;
2222

2323
using Microsoft.Azure.Commands.Common.Authentication.Abstractions;
24+
using Microsoft.Azure.Commands.Common.Authentication.Utilities;
2425
using Microsoft.Azure.Commands.Shared.Config;
2526
using Microsoft.Azure.Internal.Subscriptions;
2627
using Microsoft.Azure.Internal.Subscriptions.Models;
@@ -170,8 +171,7 @@ private SubscriptionClient GetSubscriptionClient(IAccessToken token, IAzureEnvir
170171
public virtual IPublicClientApplication CreatePublicClient(string authority = null)
171172
{
172173
var builder = PublicClientApplicationBuilder.Create(Constants.PowerShellClientId);
173-
if (AzureSession.Instance.TryGetComponent<IConfigManager>(nameof(IConfigManager), out var config)
174-
&& config.GetConfigValue<bool>(ConfigKeys.EnableLoginByWam))
174+
if (AzConfigReader.IsWamEnabled(authority))
175175
{
176176
builder = builder.WithBroker(new BrokerOptions(BrokerOptions.OperatingSystems.Windows));
177177
}

‎src/Accounts/Authentication/Config/Definitions/EnableLoginByWamConfig.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ namespace Microsoft.Azure.Commands.Common.Authentication.Config.Definitions
2727
/// </summary>
2828
internal class EnableLoginByWamConfig : TypedConfig<bool>
2929
{
30-
public override object DefaultValue => false; // Opt-in. Will change to opt-out.
30+
public override object DefaultValue => true;
3131

3232
public override string Key => ConfigKeys.EnableLoginByWam;
3333

‎src/Accounts/Authentication/Factories/AuthenticationFactory.cs

Lines changed: 18 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
using Microsoft.Azure.Commands.Common.Authentication.Abstractions;
1717
using Microsoft.Azure.Commands.Common.Authentication.Authentication;
1818
using Microsoft.Azure.Commands.Common.Authentication.Properties;
19+
using Microsoft.Azure.Commands.Common.Authentication.Utilities;
1920
using Microsoft.Azure.Commands.Common.Exceptions;
2021
using Microsoft.Azure.Commands.ResourceManager.Common;
2122
using Microsoft.Azure.Commands.Shared.Config;
@@ -24,6 +25,7 @@
2425
using Microsoft.Rest;
2526
using Microsoft.WindowsAzure.Commands.Common;
2627
using System;
28+
using System.Diagnostics;
2729
using System.Linq;
2830
using System.Security;
2931
using System.Threading.Tasks;
@@ -184,28 +186,23 @@ private static AzPSAuthenticationFailedException AnalyzeMsalException(Exception
184186
{
185187
if (exception is MsalUiRequiredException msalUiRequiredException)
186188
{
187-
//There's no official error message for requiring MFA permission, so have to compare UGLY error message
188-
if (msalUiRequiredException.ErrorCode == "invalid_grant" &&
189-
msalUiRequiredException.Message.Contains("you must use multi-factor authentication to access"))
189+
string errorMessage;
190+
string desensitizedMessage;
191+
if (NeedTenantArmPermission(environment, tenantId, resourceId))
190192
{
191-
string errorMessage;
192-
string desensitizedMessage;
193-
if (NeedTenantArmPermission(environment, tenantId, resourceId))
194-
{
195-
errorMessage = $"You must use multi-factor authentication to access tenant {tenantId}, please rerun 'Connect-AzAccount' with additional parameter '-TenantId {tenantId}'.";
196-
desensitizedMessage = "MFA is required to access tenant";
197-
}
198-
else
199-
{
200-
errorMessage = $"You must use multi-factor authentication to access resource {resourceId}, please rerun 'Connect-AzAccount' with additional parameter '-AuthScope {resourceId}'.";
201-
desensitizedMessage = "MFA is required to access resource";
202-
}
203-
return new AzPSAuthenticationFailedException(
204-
errorMessage,
205-
msalUiRequiredException.ErrorCode,
206-
originalException,
207-
desensitizedMessage: desensitizedMessage);
193+
errorMessage = string.Format(Resources.ErrorMessageMsalInteractionRequiredWithTid, tenantId);
194+
desensitizedMessage = "MFA is required to access tenant";
208195
}
196+
else
197+
{
198+
errorMessage = string.Format(Resources.ErrorMsgMsalInteractionRequiredWithResourceID, resourceId);
199+
desensitizedMessage = "MFA is required to access resource";
200+
}
201+
return new AzPSAuthenticationFailedException(
202+
errorMessage,
203+
msalUiRequiredException.ErrorCode,
204+
originalException,
205+
desensitizedMessage: desensitizedMessage);
209206
}
210207
exception = exception.InnerException;
211208
}
@@ -615,7 +612,7 @@ private AuthenticationParameters GetAuthenticationParameters(
615612

616613
private static AuthenticationParameters GetInteractiveParameters(PowerShellTokenCacheProvider tokenCacheProvider, IAzureAccount account, IAzureEnvironment environment, string tenant, Action<string> promptAction, IAzureTokenCache tokenCache, string resourceId, string homeAccountId)
617614
{
618-
return IsWamEnabled()
615+
return AzConfigReader.IsWamEnabled(environment.ActiveDirectoryAuthority)
619616
? new InteractiveWamParameters(tokenCacheProvider, environment, tokenCache, tenant, resourceId, account.GetProperty("LoginHint"), homeAccountId, promptAction) as AuthenticationParameters
620617
: new InteractiveParameters(tokenCacheProvider, environment, tokenCache, tenant, resourceId, account.GetProperty("LoginHint"), homeAccountId, promptAction);
621618
}
@@ -624,11 +621,5 @@ private static AuthenticationParameters GetSilentParameters(PowerShellTokenCache
624621
{
625622
return new SilentParameters(tokenCacheProvider, environment, tokenCache, tenant, resourceId, account.Id, homeAccountId);
626623
}
627-
628-
private static bool IsWamEnabled()
629-
{
630-
return AzureSession.Instance.TryGetComponent<IConfigManager>(nameof(IConfigManager), out var config)
631-
&& config.GetConfigValue<bool>(ConfigKeys.EnableLoginByWam);
632-
}
633624
}
634625
}

‎src/Accounts/Authentication/Identity/MsalConfidentialClient.cs

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,11 @@ public virtual async ValueTask<AuthenticationResult> AcquireTokenForClientCoreAs
173173

174174
if (!string.IsNullOrEmpty(tenantId))
175175
{
176-
builder.WithAuthority(AuthorityHost.AbsoluteUri, tenantId);
176+
var uriBuilder = new UriBuilder(AuthorityHost.AbsoluteUri)
177+
{
178+
Path = tenantId
179+
};
180+
builder.WithTenantIdFromAuthority(uriBuilder.Uri);
177181
}
178182
return await builder
179183
.ExecuteAsync(async, cancellationToken)
@@ -208,7 +212,11 @@ public virtual async ValueTask<AuthenticationResult> AcquireTokenSilentCoreAsync
208212
var builder = client.AcquireTokenSilent(scopes, account);
209213
if (!string.IsNullOrEmpty(tenantId))
210214
{
211-
builder.WithAuthority(AuthorityHost.AbsoluteUri, tenantId);
215+
var uriBuilder = new UriBuilder(AuthorityHost.AbsoluteUri)
216+
{
217+
Path = tenantId
218+
};
219+
builder.WithTenantIdFromAuthority(uriBuilder.Uri);
212220
}
213221
return await builder
214222
.ExecuteAsync(async, cancellationToken)
@@ -244,7 +252,11 @@ public virtual async ValueTask<AuthenticationResult> AcquireTokenByAuthorization
244252

245253
if (!string.IsNullOrEmpty(tenantId))
246254
{
247-
builder.WithAuthority(AuthorityHost.AbsoluteUri, tenantId);
255+
var uriBuilder = new UriBuilder(AuthorityHost.AbsoluteUri)
256+
{
257+
Path = tenantId
258+
};
259+
builder.WithTenantIdFromAuthority(uriBuilder.Uri);
248260
}
249261
return await builder
250262
.ExecuteAsync(async, cancellationToken)
@@ -280,7 +292,11 @@ public virtual async ValueTask<AuthenticationResult> AcquireTokenOnBehalfOfCoreA
280292

281293
if (!string.IsNullOrEmpty(tenantId))
282294
{
283-
builder.WithAuthority(AuthorityHost.AbsoluteUri, tenantId);
295+
var uriBuilder = new UriBuilder(AuthorityHost.AbsoluteUri)
296+
{
297+
Path = tenantId
298+
};
299+
builder.WithTenantIdFromAuthority(uriBuilder.Uri);
284300
}
285301
return await builder
286302
.ExecuteAsync(async, cancellationToken)

‎src/Accounts/Authentication/Properties/Resources.Designer.cs

Lines changed: 19 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)