|
| 1 | +### YamlMime:PythonClass |
| 2 | +uid: msal.managed_identity.ManagedIdentityClient |
| 3 | +name: ManagedIdentityClient |
| 4 | +fullName: msal.managed_identity.ManagedIdentityClient |
| 5 | +module: msal.managed_identity |
| 6 | +inheritances: |
| 7 | +- builtins.object |
| 8 | +summary: "This API encapsulates multiple managed identity back-ends:\nVM, App Service,\ |
| 9 | + \ Azure Automation (Runbooks), Azure Function, Service Fabric,\nand Azure Arc.\n\ |
| 10 | + \nIt also provides token cache support.\n\n> [!NOTE]\n> Cloud Shell support is NOT\ |
| 11 | + \ implemented in this class.\n>\n> Since MSAL Python 1.18 in May 2022, it has been\ |
| 12 | + \ implemented in\n>\n> <xref:PublicClientApplication.acquire_token_interactive>\ |
| 13 | + \ via calling pattern\n>\n> PublicClientApplication(...).acquire_token_interactive(scopes=[...],\ |
| 14 | + \ prompt=\"none\").\n>\n> That is appropriate, because Cloud Shell yields a token\ |
| 15 | + \ with\n>\n> delegated permissions for the end user who has signed in to the Azure\ |
| 16 | + \ Portal\n>\n> (like what a PublicClientApplication does),\n>\n> not a token with\ |
| 17 | + \ application permissions for an app.\n>\n\nCreate a managed identity client.\n\n\ |
| 18 | + Recipe 1: Hard code a managed identity for your app:\n\n<!-- literal_block {\"ids\"\ |
| 19 | + : [], \"classes\": [], \"names\": [], \"dupnames\": [], \"backrefs\": [], \"xml:space\"\ |
| 20 | + : \"preserve\", \"language\": \"default\", \"force\": false, \"linenos\": false}\ |
| 21 | + \ -->\n\n````default\n\n import msal, requests\n client = msal.ManagedIdentityClient(\n\ |
| 22 | + \ msal.UserAssignedManagedIdentity(client_id=\"foo\"),\n http_client=requests.Session(),\n\ |
| 23 | + \ )\n token = client.acquire_token_for_client(\"resource\")\n ````\n\n\ |
| 24 | + Recipe 2: Write once, run everywhere.\nIf you use different managed identity on\ |
| 25 | + \ different deployment,\nyou may use an environment variable (such as MY_MANAGED_IDENTITY_CONFIG)\n\ |
| 26 | + to store a json blob like\n`{\"ManagedIdentityIdType\": \"ClientId\", \"Id\": \"\ |
| 27 | + foo\"}` or\n`{\"ManagedIdentityIdType\": \"SystemAssignedManagedIdentity\", \"Id\"\ |
| 28 | + : null})`.\nThe following app can load managed identity configuration dynamically:\n\ |
| 29 | + \n<!-- literal_block {\"ids\": [], \"classes\": [], \"names\": [], \"dupnames\"\ |
| 30 | + : [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\": \"default\",\ |
| 31 | + \ \"force\": false, \"linenos\": false} -->\n\n````default\n\n import json, os,\ |
| 32 | + \ msal, requests\n config = os.getenv(\"MY_MANAGED_IDENTITY_CONFIG\")\n assert\ |
| 33 | + \ config, \"An ENV VAR with value should exist\"\n client = msal.ManagedIdentityClient(\n\ |
| 34 | + \ json.loads(config),\n http_client=requests.Session(),\n )\n\ |
| 35 | + \ token = client.acquire_token_for_client(\"resource\")\n ````" |
| 36 | +constructor: |
| 37 | + syntax: 'ManagedIdentityClient(managed_identity: dict | ManagedIdentity | SystemAssignedManagedIdentity |
| 38 | + | UserAssignedManagedIdentity, *, http_client, token_cache=None, http_cache=None)' |
| 39 | + parameters: |
| 40 | + - name: managed_identity |
| 41 | + description: 'It accepts an instance of <xref:msal.managed_identity.SystemAssignedManagedIdentity> |
| 42 | +
|
| 43 | + or <xref:msal.managed_identity.UserAssignedManagedIdentity>. |
| 44 | +
|
| 45 | + They are equivalent to a dict with a certain shape, |
| 46 | +
|
| 47 | + which may be loaded from a JSON configuration file or an env var.' |
| 48 | + isRequired: true |
| 49 | + - name: http_client |
| 50 | + description: "An http client object. For example, you can use `requests.Session()`,\n\ |
| 51 | + optionally with exponential backoff behavior demonstrated in this recipe:\n\n\ |
| 52 | + <!-- literal_block {\"ids\": [], \"classes\": [], \"names\": [], \"dupnames\"\ |
| 53 | + : [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\": \"default\"\ |
| 54 | + , \"force\": false, \"linenos\": false} -->\n\n````default\n\n import msal,\ |
| 55 | + \ requests\n from requests.adapters import HTTPAdapter, Retry\n s = requests.Session()\n\ |
| 56 | + \ retries = Retry(total=3, backoff_factor=0.1, status_forcelist=[\n \ |
| 57 | + \ 429, 500, 501, 502, 503, 504])\n s.mount('https://', HTTPAdapter(max_retries=retries))\n\ |
| 58 | + \ managed_identity = ...\n client = msal.ManagedIdentityClient(managed_identity,\ |
| 59 | + \ http_client=s)\n ````" |
| 60 | + isRequired: true |
| 61 | + - name: token_cache |
| 62 | + description: 'Optional. It accepts a <xref:msal.TokenCache> instance to store |
| 63 | + tokens. |
| 64 | +
|
| 65 | + It will use an in-memory token cache by default.' |
| 66 | + isRequired: true |
| 67 | + - name: http_cache |
| 68 | + description: 'Optional. It has the same characteristics as the |
| 69 | +
|
| 70 | + >>:paramref:`msal.ClientApplication.http_cache`<<.' |
| 71 | + isRequired: true |
| 72 | + keywordOnlyParameters: |
| 73 | + - name: http_client |
| 74 | + isRequired: true |
| 75 | + - name: token_cache |
| 76 | + isRequired: true |
| 77 | + - name: http_cache |
| 78 | + isRequired: true |
| 79 | +methods: |
| 80 | +- uid: msal.managed_identity.ManagedIdentityClient.acquire_token_for_client |
| 81 | + name: acquire_token_for_client |
| 82 | + summary: "Acquire token for the managed identity.\n\nThe result will be automatically\ |
| 83 | + \ cached.\nSubsequent calls will automatically search from cache first.\n\n> [!NOTE]\n\ |
| 84 | + > Known issue: When an Azure VM has only one user-assigned managed identity,\n\ |
| 85 | + >\n> and your app specifies to use system-assigned managed identity,\n>\n> Azure\ |
| 86 | + \ VM may still return a token for your user-assigned identity.\n>\n> \n>\n> This\ |
| 87 | + \ is a service-side behavior that cannot be changed by this library.\n>\n> [Azure\ |
| 88 | + \ VM docs](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http)\n\ |
| 89 | + >" |
| 90 | + signature: acquire_token_for_client(*, resource) |
| 91 | + keywordOnlyParameters: |
| 92 | + - name: resource |
| 93 | + isRequired: true |
0 commit comments