Skip to content

Commit 494019d

Browse files
localdenlocalden
authored
Merge pull request #96 from MicrosoftDocs/main
Sync changes
2 parents 5121f6c + 9dda604 commit 494019d

File tree

2 files changed

+104
-66
lines changed

2 files changed

+104
-66
lines changed

‎python/docs-ref-autogen/msal/msal.application.ClientApplication.yml‎

Lines changed: 52 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -26,52 +26,71 @@ constructor:
2626
- <xref:str>
2727
- name: client_credential
2828
description: "For <xref:msal.application.PublicClientApplication>, you use *None*\
29-
\ here.\nFor <xref:msal.application.ConfidentialClientApplication>,\nit can\
30-
\ be a string containing client secret,\nor an X509 certificate container in\
29+
\ here.\n\nFor <xref:msal.application.ConfidentialClientApplication>,\nit supports\
30+
\ many different input formats for different scenarios.\n\n\n\n## Support using\
31+
\ a client secret.Just feed in a string, such as `\"your client secret\"`.\n\
32+
\n\n\n## Support using a certificate in X.509 (.pem) formatFeed in a dict in\
3133
\ this form:\n\n<!-- literal_block {\"ids\": [], \"classes\": [], \"names\"\
3234
: [], \"dupnames\": [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\"\
3335
: \"default\", \"force\": false, \"linenos\": false} -->\n\n````default\n\n\
3436
\ {\n \"private_key\": \"...-----BEGIN PRIVATE KEY-----... in PEM format\"\
35-
,\n \"thumbprint\": \"A1B2C3D4E5F6...\",\n \"public_certificate\"\
36-
: \"...-----BEGIN CERTIFICATE-----... (Optional. See below.)\",\n \"passphrase\"\
37-
: \"Passphrase if the private_key is encrypted (Optional. Added in version 1.6.0)\"\
38-
,\n }\n ````\n\nMSAL Python requires a \"private_key\" in PEM format.\n\
39-
If your cert is in a PKCS12 (.pfx) format, you can also\n[convert it to PEM\
40-
\ and get the thumbprint](https://github.com/Azure/azure-sdk-for-python/blob/07d10639d7e47f4852eaeb74aef5d569db499d6e/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py#L101-L123).\n\
41-
\nThe thumbprint is available in your app's registration in Azure Portal.\n\
42-
Alternatively, you can [calculate the thumbprint](https://github.com/Azure/azure-sdk-for-python/blob/07d10639d7e47f4852eaeb74aef5d569db499d6e/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py#L94-L97).\n\
43-
\n*Added in version 0.5.0*:\npublic_certificate (optional) is public key certificate\n\
44-
which will be sent through 'x5c' JWT header only for\nsubject name and issuer\
45-
\ authentication to support cert auto rolls.\n\nPer [specs](https://tools.ietf.org/html/rfc7515#section-4.1.6),\n\
46-
\"the certificate containing\nthe public key corresponding to the key used to\
37+
,\n \"thumbprint\": \"A1B2C3D4E5F6...\",\n \"passphrase\": \"Passphrase\
38+
\ if the private_key is encrypted (Optional. Added in version 1.6.0)\",\n \
39+
\ }\n ````\n\nMSAL Python requires a \"private_key\" in PEM format.\nIf your\
40+
\ cert is in PKCS12 (.pfx) format,\nyou can convert it to X.509 (.pem) format,\n\
41+
by `openssl pkcs12 -in file.pfx -out file.pem -nodes`.The thumbprint is available\
42+
\ in your app's registration in Azure Portal.\nAlternatively, you can [calculate\
43+
\ the thumbprint](https://github.com/Azure/azure-sdk-for-python/blob/07d10639d7e47f4852eaeb74aef5d569db499d6e/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py#L94-L97).\n\
44+
\n\n\n## Support Subject Name/Issuer Auth with a cert in .pem[Subject Name/Issuer\
45+
\ Auth](https://github.com/AzureAD/microsoft-authentication-library-for-python/issues/60)\n\
46+
is an approach to allow easier certificate rotation.*Added in version 0.5.0*:\n\
47+
\n<!-- literal_block {\"ids\": [], \"classes\": [], \"names\": [], \"dupnames\"\
48+
: [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\": \"default\"\
49+
, \"force\": false, \"linenos\": false} -->\n\n````default\n\n {\n \"\
50+
private_key\": \"...-----BEGIN PRIVATE KEY-----... in PEM format\",\n \
51+
\ \"thumbprint\": \"A1B2C3D4E5F6...\",\n \"public_certificate\": \"...-----BEGIN\
52+
\ CERTIFICATE-----...\",\n \"passphrase\": \"Passphrase if the private_key\
53+
\ is encrypted (Optional. Added in version 1.6.0)\",\n }\n ````\n\n`public_certificate`\
54+
\ (optional) is public key certificate\nwhich will be sent through 'x5c' JWT\
55+
\ header only for\nsubject name and issuer authentication to support cert auto\
56+
\ rolls.Per [specs](https://tools.ietf.org/html/rfc7515#section-4.1.6),\n\"\
57+
the certificate containing\nthe public key corresponding to the key used to\
4758
\ digitally sign the\nJWS MUST be the first certificate. This MAY be followed\
4859
\ by\nadditional certificates, with each subsequent certificate being the\n\
4960
one used to certify the previous one.\"\nHowever, your certificate's issuer\
5061
\ may use a different order.\nSo, if your attempt ends up with an error AADSTS700027\
5162
\ -\n\"The provided signature value did not match the expected signature value\"\
52-
,\nyou may try use only the leaf cert (in PEM/str format) instead.\n\n*Added\
53-
\ in version 1.13.0*:\nIt can also be a completely pre-signed assertion that\
54-
\ you've assembled yourself.\nSimply pass a container containing only the key\
55-
\ \"client_assertion\", like this:\n\n<!-- literal_block {\"ids\": [], \"classes\"\
63+
,\nyou may try use only the leaf cert (in PEM/str format) instead.\n\n\n\n##\
64+
\ Supporting raw assertion obtained from elsewhere*Added in version 1.13.0*:\n\
65+
It can also be a completely pre-signed assertion that you've assembled yourself.\n\
66+
Simply pass a container containing only the key \"client_assertion\", like this:\n\
67+
\n<!-- literal_block {\"ids\": [], \"classes\": [], \"names\": [], \"dupnames\"\
68+
: [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\": \"default\"\
69+
, \"force\": false, \"linenos\": false} -->\n\n````default\n\n {\n \"\
70+
client_assertion\": \"...a JWT with claims aud, exp, iss, jti, nbf, and sub...\"\
71+
\n }\n ````\n\n\n\n## Supporting reading client cerficates from PFX files*Added\
72+
\ in version 1.29.0*:\nFeed in a dictionary containing the path to a PFX file:\n\
73+
\n<!-- literal_block {\"ids\": [], \"classes\": [], \"names\": [], \"dupnames\"\
74+
: [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\": \"default\"\
75+
, \"force\": false, \"linenos\": false} -->\n\n````default\n\n {\n \"\
76+
private_key_pfx_path\": \"/path/to/your.pfx\",\n \"passphrase\": \"Passphrase\
77+
\ if the private_key is encrypted (Optional)\",\n }\n ````\n\nThe following\
78+
\ command will generate a .pfx file from your .key and .pem file:\n\n<!-- literal_block\
79+
\ {\"ids\": [], \"classes\": [], \"names\": [], \"dupnames\": [], \"backrefs\"\
80+
: [], \"xml:space\": \"preserve\", \"language\": \"default\", \"force\": false,\
81+
\ \"linenos\": false} -->\n\n````default\n\n openssl pkcs12 -export -out certificate.pfx\
82+
\ -inkey privateKey.key -in certificate.pem\n ````\n\n\n\n## Support Subject\
83+
\ Name/Issuer Auth with a cert in .pfx*Added in version 1.30.0*:\nIf your .pfx\
84+
\ file contains both the private key and public cert,\nyou can opt in for Subject\
85+
\ Name/Issuer Auth like this:\n\n<!-- literal_block {\"ids\": [], \"classes\"\
5686
: [], \"names\": [], \"dupnames\": [], \"backrefs\": [], \"xml:space\": \"preserve\"\
5787
, \"language\": \"default\", \"force\": false, \"linenos\": false} -->\n\n````default\n\
58-
\n {\n \"client_assertion\": \"...a JWT with claims aud, exp, iss, jti,\
59-
\ nbf, and sub...\"\n }\n ````\n\n\n\n## Supporting reading client cerficates\
60-
\ from PFX files*Added in version 1.29.0*:\nFeed in a dictionary containing\
61-
\ the path to a PFX file:\n\n<!-- literal_block {\"ids\": [], \"classes\": [],\
62-
\ \"names\": [], \"dupnames\": [], \"backrefs\": [], \"xml:space\": \"preserve\"\
63-
, \"language\": \"default\", \"force\": false, \"linenos\": false} -->\n\n````default\n\
64-
\n {\n \"private_key_pfx_path\": \"/path/to/your.pfx\",\n \"passphrase\"\
65-
: \"Passphrase if the private_key is encrypted (Optional. Added in version 1.6.0)\"\
66-
,\n }\n ````\n\nThe following command will generate a .pfx file from your\
67-
\ .key and .pem file:\n\n<!-- literal_block {\"ids\": [], \"classes\": [], \"\
68-
names\": [], \"dupnames\": [], \"backrefs\": [], \"xml:space\": \"preserve\"\
69-
, \"language\": \"default\", \"force\": false, \"linenos\": false} -->\n\n````default\n\
70-
\n openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.pem\n\
71-
\ ````"
88+
\n {\n \"private_key_pfx_path\": \"/path/to/your.pfx\",\n \"public_certificate\"\
89+
: True,\n \"passphrase\": \"Passphrase if the private_key is encrypted\
90+
\ (Optional)\",\n }\n ````"
7291
defaultValue: None
7392
types:
74-
- <xref:typing.Union>[<xref:dict>, <xref:str>]
93+
- <xref:typing.Union>[<xref:dict>, <xref:str>, <xref:None>]
7594
- name: client_claims
7695
description: "*Added in version 0.5.0*:\nIt is a dictionary of extra claims that\
7796
\ would be signed by\nby this <xref:msal.application.ConfidentialClientApplication>\

‎python/docs-ref-autogen/msal/msal.application.ConfidentialClientApplication.yml‎

Lines changed: 52 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -26,52 +26,71 @@ constructor:
2626
- <xref:str>
2727
- name: client_credential
2828
description: "For <xref:msal.application.PublicClientApplication>, you use *None*\
29-
\ here.\nFor <xref:msal.application.ConfidentialClientApplication>,\nit can\
30-
\ be a string containing client secret,\nor an X509 certificate container in\
29+
\ here.\n\nFor <xref:msal.application.ConfidentialClientApplication>,\nit supports\
30+
\ many different input formats for different scenarios.\n\n\n\n## Support using\
31+
\ a client secret.Just feed in a string, such as `\"your client secret\"`.\n\
32+
\n\n\n## Support using a certificate in X.509 (.pem) formatFeed in a dict in\
3133
\ this form:\n\n<!-- literal_block {\"ids\": [], \"classes\": [], \"names\"\
3234
: [], \"dupnames\": [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\"\
3335
: \"default\", \"force\": false, \"linenos\": false} -->\n\n````default\n\n\
3436
\ {\n \"private_key\": \"...-----BEGIN PRIVATE KEY-----... in PEM format\"\
35-
,\n \"thumbprint\": \"A1B2C3D4E5F6...\",\n \"public_certificate\"\
36-
: \"...-----BEGIN CERTIFICATE-----... (Optional. See below.)\",\n \"passphrase\"\
37-
: \"Passphrase if the private_key is encrypted (Optional. Added in version 1.6.0)\"\
38-
,\n }\n ````\n\nMSAL Python requires a \"private_key\" in PEM format.\n\
39-
If your cert is in a PKCS12 (.pfx) format, you can also\n[convert it to PEM\
40-
\ and get the thumbprint](https://github.com/Azure/azure-sdk-for-python/blob/07d10639d7e47f4852eaeb74aef5d569db499d6e/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py#L101-L123).\n\
41-
\nThe thumbprint is available in your app's registration in Azure Portal.\n\
42-
Alternatively, you can [calculate the thumbprint](https://github.com/Azure/azure-sdk-for-python/blob/07d10639d7e47f4852eaeb74aef5d569db499d6e/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py#L94-L97).\n\
43-
\n*Added in version 0.5.0*:\npublic_certificate (optional) is public key certificate\n\
44-
which will be sent through 'x5c' JWT header only for\nsubject name and issuer\
45-
\ authentication to support cert auto rolls.\n\nPer [specs](https://tools.ietf.org/html/rfc7515#section-4.1.6),\n\
46-
\"the certificate containing\nthe public key corresponding to the key used to\
37+
,\n \"thumbprint\": \"A1B2C3D4E5F6...\",\n \"passphrase\": \"Passphrase\
38+
\ if the private_key is encrypted (Optional. Added in version 1.6.0)\",\n \
39+
\ }\n ````\n\nMSAL Python requires a \"private_key\" in PEM format.\nIf your\
40+
\ cert is in PKCS12 (.pfx) format,\nyou can convert it to X.509 (.pem) format,\n\
41+
by `openssl pkcs12 -in file.pfx -out file.pem -nodes`.The thumbprint is available\
42+
\ in your app's registration in Azure Portal.\nAlternatively, you can [calculate\
43+
\ the thumbprint](https://github.com/Azure/azure-sdk-for-python/blob/07d10639d7e47f4852eaeb74aef5d569db499d6e/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py#L94-L97).\n\
44+
\n\n\n## Support Subject Name/Issuer Auth with a cert in .pem[Subject Name/Issuer\
45+
\ Auth](https://github.com/AzureAD/microsoft-authentication-library-for-python/issues/60)\n\
46+
is an approach to allow easier certificate rotation.*Added in version 0.5.0*:\n\
47+
\n<!-- literal_block {\"ids\": [], \"classes\": [], \"names\": [], \"dupnames\"\
48+
: [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\": \"default\"\
49+
, \"force\": false, \"linenos\": false} -->\n\n````default\n\n {\n \"\
50+
private_key\": \"...-----BEGIN PRIVATE KEY-----... in PEM format\",\n \
51+
\ \"thumbprint\": \"A1B2C3D4E5F6...\",\n \"public_certificate\": \"...-----BEGIN\
52+
\ CERTIFICATE-----...\",\n \"passphrase\": \"Passphrase if the private_key\
53+
\ is encrypted (Optional. Added in version 1.6.0)\",\n }\n ````\n\n`public_certificate`\
54+
\ (optional) is public key certificate\nwhich will be sent through 'x5c' JWT\
55+
\ header only for\nsubject name and issuer authentication to support cert auto\
56+
\ rolls.Per [specs](https://tools.ietf.org/html/rfc7515#section-4.1.6),\n\"\
57+
the certificate containing\nthe public key corresponding to the key used to\
4758
\ digitally sign the\nJWS MUST be the first certificate. This MAY be followed\
4859
\ by\nadditional certificates, with each subsequent certificate being the\n\
4960
one used to certify the previous one.\"\nHowever, your certificate's issuer\
5061
\ may use a different order.\nSo, if your attempt ends up with an error AADSTS700027\
5162
\ -\n\"The provided signature value did not match the expected signature value\"\
52-
,\nyou may try use only the leaf cert (in PEM/str format) instead.\n\n*Added\
53-
\ in version 1.13.0*:\nIt can also be a completely pre-signed assertion that\
54-
\ you've assembled yourself.\nSimply pass a container containing only the key\
55-
\ \"client_assertion\", like this:\n\n<!-- literal_block {\"ids\": [], \"classes\"\
63+
,\nyou may try use only the leaf cert (in PEM/str format) instead.\n\n\n\n##\
64+
\ Supporting raw assertion obtained from elsewhere*Added in version 1.13.0*:\n\
65+
It can also be a completely pre-signed assertion that you've assembled yourself.\n\
66+
Simply pass a container containing only the key \"client_assertion\", like this:\n\
67+
\n<!-- literal_block {\"ids\": [], \"classes\": [], \"names\": [], \"dupnames\"\
68+
: [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\": \"default\"\
69+
, \"force\": false, \"linenos\": false} -->\n\n````default\n\n {\n \"\
70+
client_assertion\": \"...a JWT with claims aud, exp, iss, jti, nbf, and sub...\"\
71+
\n }\n ````\n\n\n\n## Supporting reading client cerficates from PFX files*Added\
72+
\ in version 1.29.0*:\nFeed in a dictionary containing the path to a PFX file:\n\
73+
\n<!-- literal_block {\"ids\": [], \"classes\": [], \"names\": [], \"dupnames\"\
74+
: [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\": \"default\"\
75+
, \"force\": false, \"linenos\": false} -->\n\n````default\n\n {\n \"\
76+
private_key_pfx_path\": \"/path/to/your.pfx\",\n \"passphrase\": \"Passphrase\
77+
\ if the private_key is encrypted (Optional)\",\n }\n ````\n\nThe following\
78+
\ command will generate a .pfx file from your .key and .pem file:\n\n<!-- literal_block\
79+
\ {\"ids\": [], \"classes\": [], \"names\": [], \"dupnames\": [], \"backrefs\"\
80+
: [], \"xml:space\": \"preserve\", \"language\": \"default\", \"force\": false,\
81+
\ \"linenos\": false} -->\n\n````default\n\n openssl pkcs12 -export -out certificate.pfx\
82+
\ -inkey privateKey.key -in certificate.pem\n ````\n\n\n\n## Support Subject\
83+
\ Name/Issuer Auth with a cert in .pfx*Added in version 1.30.0*:\nIf your .pfx\
84+
\ file contains both the private key and public cert,\nyou can opt in for Subject\
85+
\ Name/Issuer Auth like this:\n\n<!-- literal_block {\"ids\": [], \"classes\"\
5686
: [], \"names\": [], \"dupnames\": [], \"backrefs\": [], \"xml:space\": \"preserve\"\
5787
, \"language\": \"default\", \"force\": false, \"linenos\": false} -->\n\n````default\n\
58-
\n {\n \"client_assertion\": \"...a JWT with claims aud, exp, iss, jti,\
59-
\ nbf, and sub...\"\n }\n ````\n\n\n\n## Supporting reading client cerficates\
60-
\ from PFX files*Added in version 1.29.0*:\nFeed in a dictionary containing\
61-
\ the path to a PFX file:\n\n<!-- literal_block {\"ids\": [], \"classes\": [],\
62-
\ \"names\": [], \"dupnames\": [], \"backrefs\": [], \"xml:space\": \"preserve\"\
63-
, \"language\": \"default\", \"force\": false, \"linenos\": false} -->\n\n````default\n\
64-
\n {\n \"private_key_pfx_path\": \"/path/to/your.pfx\",\n \"passphrase\"\
65-
: \"Passphrase if the private_key is encrypted (Optional. Added in version 1.6.0)\"\
66-
,\n }\n ````\n\nThe following command will generate a .pfx file from your\
67-
\ .key and .pem file:\n\n<!-- literal_block {\"ids\": [], \"classes\": [], \"\
68-
names\": [], \"dupnames\": [], \"backrefs\": [], \"xml:space\": \"preserve\"\
69-
, \"language\": \"default\", \"force\": false, \"linenos\": false} -->\n\n````default\n\
70-
\n openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.pem\n\
71-
\ ````"
88+
\n {\n \"private_key_pfx_path\": \"/path/to/your.pfx\",\n \"public_certificate\"\
89+
: True,\n \"passphrase\": \"Passphrase if the private_key is encrypted\
90+
\ (Optional)\",\n }\n ````"
7291
defaultValue: None
7392
types:
74-
- <xref:typing.Union>[<xref:dict>, <xref:str>]
93+
- <xref:typing.Union>[<xref:dict>, <xref:str>, <xref:None>]
7594
- name: client_claims
7695
description: "*Added in version 0.5.0*:\nIt is a dictionary of extra claims that\
7796
\ would be signed by\nby this <xref:msal.application.ConfidentialClientApplication>\

0 commit comments

Comments
 (0)