You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
After you [set up an Azure Digital Twins instance and authentication](how-to-set-up-instance-portal.md), you can create a client application that you'll use to interact with the instance. Once you have set up a starter client project, you'll need to **write code in that client app to authenticate it** against the Azure Digital Twins instance.
20
+
After you [set up an Azure Digital Twins instance and authentication](how-to-set-up-instance-portal.md), you can create a client application that you'll use to interact with the instance. Once you set up a starter client project, you need to **write code in that client app to authenticate it** against the Azure Digital Twins instance.
21
21
22
-
Azure Digital Twins authenticates using [Microsoft Entra Security Tokens based on OAUTH 2.0](../active-directory/develop/security-tokens.md#json-web-tokens-and-claims). To authenticate your SDK, you'll need to get a bearer token with the right permissions to Azure Digital Twins, and pass it along with your API calls.
22
+
Azure Digital Twins authenticates using [Microsoft Entra Security Tokens based on OAUTH 2.0](../active-directory/develop/security-tokens.md#json-web-tokens-and-claims). To authenticate your SDK, you need to get a bearer token with the right permissions to Azure Digital Twins, and pass it along with your API calls.
23
23
24
24
This article describes how to obtain credentials using the `Azure.Identity` client library. While this article shows code examples in C#, such as what you'd write for the [.NET (C#) SDK](/dotnet/api/overview/azure/digitaltwins.core-readme), you can use a version of `Azure.Identity` regardless of what SDK you're using (for more on the SDKs available for Azure Digital Twins, see [Azure Digital Twins APIs and SDKs](concepts-apis-sdks.md).
25
25
26
26
## Prerequisites
27
27
28
-
First, complete the setup steps in [Set up an instance and authentication](how-to-set-up-instance-portal.md). This setup will ensure you have an Azure Digital Twins instance and your user has access permissions. After that setup, you're ready to write client app code.
28
+
First, complete the setup steps in [Set up an instance and authentication](how-to-set-up-instance-portal.md). This setup ensures that you have an Azure Digital Twins instance and your user has access permissions. After that setup, you're ready to write client app code.
29
29
30
-
To continue, you'll need a client app project in which you write your code. If you don't already have a client app project set up, create a basic project in your language of choice to use with this tutorial.
30
+
To continue, you need a client app project in which you write your code. If you don't already have a client app project set up, create a basic project in your language of choice to use with this tutorial.
31
31
32
32
## Authenticate using Azure.Identity library
33
33
@@ -40,9 +40,9 @@ To continue, you'll need a client app project in which you write your code. If y
40
40
41
41
Three common credential-obtaining methods in `Azure.Identity` are:
42
42
43
-
*[DefaultAzureCredential](/dotnet/api/azure.identity.defaultazurecredential?view=azure-dotnet&preserve-view=true) provides a default `TokenCredential` authentication flow for applications that will be deployed to Azure, and is **the recommended choice for local development**. It also can be enabled to try the other two methods recommended in this article; it wraps `ManagedIdentityCredential` and can access `InteractiveBrowserCredential` with a configuration variable.
44
-
*[ManagedIdentityCredential](/dotnet/api/azure.identity.managedidentitycredential?view=azure-dotnet&preserve-view=true) works well in cases where you need [managed identities (MSI)](../active-directory/managed-identities-azure-resources/overview.md), and is a good candidate for working with Azure Functions and deploying to Azure services.
45
-
*[InteractiveBrowserCredential](/dotnet/api/azure.identity.interactivebrowsercredential?view=azure-dotnet&preserve-view=true) is intended for interactive applications, and can be used to create an authenticated SDK client.
43
+
*[DefaultAzureCredential](/dotnet/api/azure.identity.defaultazurecredential?view=azure-dotnet&preserve-view=true) provides a default `TokenCredential` authentication flow for applications that are deployed to Azure. This method is **the recommended choice for local development**. It also can be enabled to try the other two methods recommended in this article; it wraps `ManagedIdentityCredential` and can access `InteractiveBrowserCredential` with a configuration variable.
44
+
*[ManagedIdentityCredential](/dotnet/api/azure.identity.managedidentitycredential?view=azure-dotnet&preserve-view=true) works well in cases where you need [managed identities (MSI)](../active-directory/managed-identities-azure-resources/overview.md). This method is a good candidate for working with Azure Functions and deploying to Azure services.
45
+
*[InteractiveBrowserCredential](/dotnet/api/azure.identity.interactivebrowsercredential?view=azure-dotnet&preserve-view=true) is intended for interactive applications. This method can be used to create an authenticated SDK client.
46
46
47
47
The rest of this article shows how to use these methods with the [.NET (C#) SDK](/dotnet/api/overview/azure/digitaltwins.core-readme).
48
48
@@ -60,9 +60,9 @@ Next, add code to obtain credentials using one of the methods in `Azure.Identity
60
60
61
61
### DefaultAzureCredential method
62
62
63
-
[DefaultAzureCredential](/dotnet/api/azure.identity.defaultazurecredential?view=azure-dotnet&preserve-view=true) provides a default `TokenCredential` authentication flow for applications that will be deployed to Azure, and is **the recommended choice for local development**.
63
+
[DefaultAzureCredential](/dotnet/api/azure.identity.defaultazurecredential?view=azure-dotnet&preserve-view=true) provides a default `TokenCredential` authentication flow for applications that are deployed to Azure. This method is **the recommended choice for local development**.
64
64
65
-
To use the default Azure credentials, you'll need the Azure Digital Twins instance's URL ([instructions to find](how-to-set-up-instance-portal.md#verify-success-and-collect-important-values)).
65
+
To use the default Azure credentials, you need the Azure Digital Twins instance's URL ([instructions to find](how-to-set-up-instance-portal.md#verify-success-and-collect-important-values)).
66
66
67
67
Here's a code sample to add a `DefaultAzureCredential` to your project:
68
68
@@ -80,19 +80,19 @@ The [ManagedIdentityCredential](/dotnet/api/azure.identity.managedidentitycreden
80
80
81
81
This means that you can use `ManagedIdentityCredential` in the same project as `DefaultAzureCredential` or `InteractiveBrowserCredential`, to authenticate a different part of the project.
82
82
83
-
To use the default Azure credentials, you'll need the Azure Digital Twins instance's URL ([instructions to find](how-to-set-up-instance-portal.md#verify-success-and-collect-important-values)). You may also need an [app registration](./how-to-create-app-registration.md) and the registration's [Application (client) ID](./how-to-create-app-registration.md#collect-client-id-and-tenant-id).
83
+
To use the default Azure credentials, you need the Azure Digital Twins instance's URL ([instructions to find](how-to-set-up-instance-portal.md#verify-success-and-collect-important-values)). You might also need an [app registration](./how-to-create-app-registration.md) and the registration's [Application (client) ID](./how-to-create-app-registration.md#collect-client-id-and-tenant-id).
84
84
85
85
In an Azure function, you can use the managed identity credentials like this:
While creating the credential, leaving the parameter empty as shown above will return the credential for the function app's system-assigned identity, if it has one. To specify a user-assigned identity instead, pass the user-assigned identity's **client ID** into the parameter.
89
+
When you create the credential without parameters, as shown in the previous example, it returns the credential for the function app's system-assigned identity, if it has one. To specify a user-assigned identity instead, pass the user-assigned identity's **client ID** into the `id`parameter for the constructor.
90
90
91
91
### InteractiveBrowserCredential method
92
92
93
-
The [InteractiveBrowserCredential](/dotnet/api/azure.identity.interactivebrowsercredential?view=azure-dotnet&preserve-view=true) method is intended for interactive applications and will bring up a web browser for authentication. You can use this method instead of `DefaultAzureCredential` in cases where you require interactive authentication.
93
+
The [InteractiveBrowserCredential](/dotnet/api/azure.identity.interactivebrowsercredential?view=azure-dotnet&preserve-view=true) method is intended for interactive applications and brings up a web browser for authentication. You can use this method instead of `DefaultAzureCredential` in cases where you require interactive authentication.
94
94
95
-
To use the interactive browser credentials, you'll need an **app registration** that has permissions to the Azure Digital Twins APIs. For steps on how to set up this app registration, see [Create an app registration with Azure Digital Twins access](./how-to-create-app-registration.md). Once the app registration is set up, you'll need...
95
+
To use the interactive browser credentials, you need an **app registration** that has permissions to the Azure Digital Twins APIs. For steps on how to set up this app registration, see [Create an app registration with Azure Digital Twins access](./how-to-create-app-registration.md). Once the app registration is set up, you need the following values:
> While you can place the client ID, tenant ID and instance URL directly into the code as shown above, it's a good idea to have your code get these values from a configuration file or environment variable instead.
105
+
> While you can place the client ID, tenant ID and instance URL directly into the code as shown in the previous example, it's a good idea to have your code get these values from a configuration file or environment variable instead.
106
106
107
107
## Authenticate Azure Functions
108
108
109
-
This section contains some of the important configuration choices in the context of authenticating with Azure Functions. First, you'll read about recommended class-level variables and authentication code that will allow the function to access Azure Digital Twins. Then, you'll read about some final configuration steps to complete for your function after its code is published to Azure.
109
+
This section contains some of the important configuration choices in the context of authenticating with Azure Functions. First, you read about recommended class-level variables and authentication code that allow the function to access Azure Digital Twins. Then, you read about some final configuration steps to complete for your function after its code is published to Azure.
110
110
111
111
### Write application code
112
112
@@ -118,22 +118,22 @@ When writing the Azure function, consider adding these variables and code to you
118
118
119
119
Later, after publishing the function, you'll create and set the value of the environment variable for this code to read. For instructions on how to do so, skip ahead to [Configure application settings](#configure-application-settings).
120
120
121
-
***A static variable to hold an HttpClient instance.** HttpClient is relatively expensive to create, so you'll probably want to create it once with the authentication code to avoid creating it for every function invocation.
121
+
***A static variable to hold an HttpClient instance.** HttpClient is relatively expensive to create, so you probably want to create it once with the authentication code to avoid creating it for every function invocation.
Leaving the parameter empty as shown above will return the credential for the function app's system-assigned identity, if it has one. To specify a user-assigned identity instead, pass the user-assigned identity's **client ID** into the parameter.
129
+
When you create the credential without parameters, as shown in the previous example, it returns the credential for the function app's system-assigned identity, if it has one. To specify a user-assigned identity instead, pass the user-assigned identity's **client ID** into the `id`parameter for the constructor.
130
130
131
-
Later, after publishing the function, you'll make sure the function's identity has permission to access the Azure Digital Twins APIs. For instructions on how to do so, skip ahead to [Assign an access role](#assign-an-access-role).
131
+
Later, after publishing the function, you ensure that the function's identity has permission to access the Azure Digital Twins APIs. For instructions on how to do so, skip ahead to [Assign an access role](#assign-an-access-role).
132
132
133
133
***A local variable _DigitalTwinsClient_.** Add the variable inside your function to hold your Azure Digital Twins client instance. _Don't_ make this variable static inside your class.
***A null check for _adtInstanceUrl_.**Add the null check and then wrap your function logic in a try/catch block to catch any exceptions.
136
+
***A null check for _adtInstanceUrl_.**To catch any exceptions, add the null check and then wrap your function logic in a try/catch block.
137
137
138
138
After these variables are added to a function, your function code might look like the following example.
139
139
@@ -163,7 +163,7 @@ You can also specify the home tenant in the credential options in your code.
163
163
164
164
## Other credential methods
165
165
166
-
If the highlighted authentication scenarios above don't cover the needs of your app, you can explore other types of authentication offered in the [Microsoft identity platform](../active-directory/develop/v2-overview.md#getting-started). The documentation for this platform covers more authentication scenarios, organized by application type.
166
+
If the highlighted authentication scenarios described in this article don't cover the needs of your app, you can explore other types of authentication offered in the [Microsoft identity platform](../active-directory/develop/v2-overview.md#getting-started). The documentation for this platform covers more authentication scenarios, organized by application type.
![prmerger-automator[bot]](https://avatars.githubusercontent.com/u/22479449?v=4&size=40){kind=avatar}
0 commit comments