Skip to content

Commit 6d48d49

Browse files
billwertbillwert
authored
Identity May GA cleanup (Azure#45185)
* Identity May GA cleanup * update changelog * more clenaups * delete an unused class * Add a check for service fabric using user-assigned identity. * spotless * pr feedback
1 parent 479014f commit 6d48d49

File tree

13 files changed

+35
-418
lines changed

13 files changed

+35
-418
lines changed

‎sdk/identity/azure-identity/CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
### Other Changes
1212

1313
- Marked `VisualStudioCodeCredential` and `VisualStudioCodeCredentialBuilder` as deprecated.[#44527](https://github.com/Azure/azure-sdk-for-java/issues/44527)
14+
- Added deprecation message to `EnvironmentCredential` when a username/password is used. [#45185](https://github.com/Azure/azure-sdk-for-java/pull/45185)
1415

1516
## 1.16.0-beta.1 (2025-03-13)
1617

‎sdk/identity/azure-identity/TOKEN_CACHING.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ ClientSecretCredential clientCredential = new ClientSecretCredentialBuilder()
5555
```
5656

5757
#### Silently authenticating a user with AuthenticationRecord and TokenCachePersistenceOptions
58-
When authenticating a user via `InteractiveBrowserCredential`, `DeviceCodeCredential`, or `UsernamePasswordCredential`, an `AuthenticationRecord` can be persisted as well. The authentication record is:
58+
When authenticating a user via `InteractiveBrowserCredential` or `DeviceCodeCredential`, an `AuthenticationRecord` can be persisted as well. The authentication record is:
5959

6060
- Returned from the `authenticate` API and contains data identifying an authenticated account.
6161
- Needed to identify the appropriate entry in the persisted token cache to silently authenticate on subsequent executions.
@@ -124,5 +124,4 @@ The following table indicates the state of in-memory and persistent caching in e
124124
| `InteractiveBrowserCredential` | Supported | Supported |
125125
| `ManagedIdentityCredential` | Supported | Not Supported |
126126
| `OnBehalfOfCredential` | Supported | Supported |
127-
| `UsernamePasswordCredential` | Supported | Supported |
128127
| `WorkloadIdentityCredential` | Supported | Supported |

‎sdk/identity/azure-identity/TROUBLESHOOTING.md‎

Lines changed: 6 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ This troubleshooting guide covers failure investigation techniques, common error
1313
- [Troubleshoot EnvironmentCredential authentication issues](#troubleshoot-environmentcredential-authentication-issues)
1414
- [Troubleshoot ClientSecretCredential authentication issues](#troubleshoot-clientsecretcredential-authentication-issues)
1515
- [Troubleshoot ClientCertificateCredential authentication issues](#troubleshoot-clientcertificatecredential-authentication-issues)
16-
- [Troubleshoot UsernamePasswordCredential authentication issues](#troubleshoot-usernamepasswordcredential-authentication-issues)
1716
- [Troubleshoot ManagedIdentityCredential authentication issues](#troubleshoot-managedidentitycredential-authentication-issues)
1817
- [Azure Virtual Machine Managed Identity](#azure-virtual-machine-managed-identity)
1918
- [Azure App Service and Azure Functions Managed Identity](#azure-app-service-and-azure-functions-managed-identity)
@@ -91,7 +90,7 @@ The underlying MSAL library, MSAL4J, also has detailed logging. It is highly ver
9190

9291
| Error Message | Description | Mitigation |
9392
|------------------------------------------------|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
94-
| Environment variables aren't fully configured. | A valid combination of environment variables wasn't set. | Ensure the appropriate environment variables are set **prior to application startup** for the intended authentication method.</p><ul><li>To authenticate a service principal using a client secret, ensure the variables `AZURE_CLIENT_ID`, `AZURE_TENANT_ID` and `AZURE_CLIENT_SECRET` are properly set.</li><li>To authenticate a service principal using a certificate, ensure the variables `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, `AZURE_CLIENT_CERTIFICATE_PATH` and optionally `AZURE_CLIENT_CERTIFICATE_PASSWORD` are properly set. `AZURE_CLIENT_SEND_CERTIFICATE_CHAIN` may optionally be set to send certificate chain in x5c header to support subject name / issuer-based authentication.</li><li>To authenticate a user using a password, ensure the variables `AZURE_USERNAME` and `AZURE_PASSWORD` are properly set.</li></ul> |
93+
| Environment variables aren't fully configured. | A valid combination of environment variables wasn't set. | Ensure the appropriate environment variables are set **prior to application startup** for the intended authentication method.</p><ul><li>To authenticate a service principal using a client secret, ensure the variables `AZURE_CLIENT_ID`, `AZURE_TENANT_ID` and `AZURE_CLIENT_SECRET` are properly set.</li><li>To authenticate a service principal using a certificate, ensure the variables `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, `AZURE_CLIENT_CERTIFICATE_PATH` and optionally `AZURE_CLIENT_CERTIFICATE_PASSWORD` are properly set. `AZURE_CLIENT_SEND_CERTIFICATE_CHAIN` may optionally be set to send certificate chain in x5c header to support subject name / issuer-based authentication.</li></ul> |
9594

9695
## Troubleshoot `ClientSecretCredential` authentication issues
9796
`ClientAuthenticationException`
@@ -120,13 +119,6 @@ The underlying MSAL library, MSAL4J, also has detailed logging. It is highly ver
120119
|AADSTS700023| Client assertion audience claim does not match Realm issuer. Review the documentation at https://learn.microsoft.com/entra/identity-platform/certificate-credentials. | Ensure the audience `aud` field in the JWT assertion created has the correct value for the audience specified in the payload. This should be set to `https://login.microsoftonline.com/{tenantId}/v2`.|
121120
|AADSTS50027| JWT token is invalid or malformed. | Ensure the JWT assertion token is in the valid format. Refer to the documentation for [client assertion format](https://learn.microsoft.com/entra/identity-platform/certificate-credentials).|
122121

123-
## Troubleshoot `UsernamePasswordCredential` authentication issues
124-
`ClientAuthenticationException`
125-
126-
| Error Code | Issue | Mitigation |
127-
|---|---|---|
128-
|AADSTS50126|The provided username or password is invalid|Ensure the `username` and `password` provided when constructing the credential are valid.|
129-
130122
## Troubleshoot `ManagedIdentityCredential` authentication issues
131123

132124
The `ManagedIdentityCredential` is designed to work on a variety of Azure hosts that provide managed identity. Configuring the managed identity and troubleshooting failures varies from hosts. The table below lists the Azure hosts that can be assigned a managed identity and are supported by the `ManagedIdentityCredential`.
@@ -186,10 +178,11 @@ curl 'http://169.254.169.254/metadata/identity/oauth2/token?resource=https://man
186178

187179
`CredentialUnavailableException`
188180

189-
| Error Message |Description| Mitigation |
190-
|---|---|---|
191-
|Azure CLI not installed|The Azure CLI isn't installed or couldn't be found.|<ul><li>Ensure the Azure CLI is properly installed. Installation instructions can be found [here](https://learn.microsoft.com/cli/azure/install-azure-cli).</li><li>Validate the installation location has been added to the `PATH` environment variable.</li></ul>|
192-
|Please run 'az login' to set up account|No account is currently logged into the Azure CLI, or the login has expired.|<ul><li>Log into the Azure CLI using the `az login` command. More information on authentication in the Azure CLI can be found [here](https://learn.microsoft.com/cli/azure/authenticate-azure-cli).</li><li>Validate that the Azure CLI can obtain tokens. See [below](#verify-the-azure-cli-can-obtain-tokens) for instructions.</li></ul>|
181+
| Error Message | Description | Mitigation |
182+
|--------------------------------------------|------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
183+
| Azure CLI not installed | The Azure CLI isn't installed or couldn't be found. | <ul><li>Ensure the Azure CLI is properly installed. Installation instructions can be found [here](https://learn.microsoft.com/cli/azure/install-azure-cli).</li><li>Validate the installation location has been added to the `PATH` environment variable.</li></ul> |
184+
| Please run 'az login' to set up account | No account is currently logged into the Azure CLI, or the login has expired. | <ul><li>Log into the Azure CLI using the `az login` command. More information on authentication in the Azure CLI can be found [here](https://learn.microsoft.com/cli/azure/authenticate-azure-cli).</li><li>Validate that the Azure CLI can obtain tokens. See [below](#verify-the-azure-cli-can-obtain-tokens) for instructions.</li></ul> |
185+
| Invalid subscription: [your subscription] provided. If this is the name of a subscription, use its ID instead. | The subscription name contains a character that may not be safe in a command line.|Use the subscription's ID instead of its name. You can get this from the Azure CLI: `az account show --name "[your subscription]" --query "id"` |
193186

194187
#### Verify the Azure CLI can obtain tokens
195188

‎sdk/identity/azure-identity/src/main/java/com/azure/identity/AzureApplicationCredential.java‎

Lines changed: 0 additions & 35 deletions
This file was deleted.

‎sdk/identity/azure-identity/src/main/java/com/azure/identity/AzureApplicationCredentialBuilder.java‎

Lines changed: 0 additions & 110 deletions
This file was deleted.

‎sdk/identity/azure-identity/src/main/java/com/azure/identity/ChainedTokenCredential.java‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -28,20 +28,16 @@
2828
*
2929
* <p>The following code sample demonstrates the creation of a {@link ChainedTokenCredential},
3030
* using the {@link ChainedTokenCredentialBuilder} to configure it. The sample below
31-
* tries silent username+password login tried first, then interactive browser login as needed
32-
* (e.g. when 2FA is turned on in the directory). Once this credential is created, it may be passed into the builder
31+
* tries managed identity first, then interactive browser login. Once this credential is created, it may be passed into the builder
3332
* of many of the Azure SDK for Java client builders as the 'credential' parameter.</p>
3433
*
3534
* <!-- src_embed com.azure.identity.credential.chainedtokencredential.construct -->
3635
* <pre>
37-
* TokenCredential usernamePasswordCredential = new UsernamePasswordCredentialBuilder&#40;&#41;.clientId&#40;clientId&#41;
38-
* .username&#40;fakeUsernamePlaceholder&#41;
39-
* .password&#40;fakePasswordPlaceholder&#41;
40-
* .build&#40;&#41;;
36+
* TokenCredential managedIdentityCredential = new ManagedIdentityCredentialBuilder&#40;&#41;.build&#40;&#41;;
4137
* TokenCredential interactiveBrowserCredential = new InteractiveBrowserCredentialBuilder&#40;&#41;.clientId&#40;clientId&#41;
42-
* .port&#40;8765&#41;
38+
* .redirectUrl&#40;&quot;https:&#47;&#47;localhost:8765&quot;&#41;
4339
* .build&#40;&#41;;
44-
* TokenCredential credential = new ChainedTokenCredentialBuilder&#40;&#41;.addLast&#40;usernamePasswordCredential&#41;
40+
* TokenCredential credential = new ChainedTokenCredentialBuilder&#40;&#41;.addLast&#40;managedIdentityCredential&#41;
4541
* .addLast&#40;interactiveBrowserCredential&#41;
4642
* .build&#40;&#41;;
4743
* </pre>

0 commit comments

Comments
 (0)