Skip to content

Commit f30e269

Browse files
[Identity] Refining the Workload identity integration logic for ManagedIdentity Credential (Azure#25010)
### Packages impacted by this PR @azure/identity ### Issues associated with this PR None. Related PR - Azure#24830 ### Describe the problem that is addressed by this PR - This PR makes the workload identity credential skip the entire token-caching logic in in-house implemwntation of Managed Identity since it's already taken care of by the Client Assertion Credential. Doing this prevents the tenant id and authority host from being over-written by the in-house implementation of ManagedIdentity and msal integration from the ones user provided. ### What are the possible designs available to address the problem? If there are more than one possible design, why was the one in this PR chosen? ### Are there test cases added in this PR? _(If not, why?)_ ### Provide a list of related PRs _(if any)_ ### Command used to generate this PR:**_(Applicable only to SDK release request PRs)_ ### Checklists - [ ] Added impacted package name to the issue description - [ ] Does this PR needs any fixes in the SDK Generator?** _(If so, create an Issue in the [Autorest/typescript](https://github.com/Azure/autorest.typescript) repository and link it here)_ - [ ] Added a changelog (if necessary)
1 parent 2d981df commit f30e269

File tree

3 files changed

+67
-67
lines changed

3 files changed

+67
-67
lines changed

sdk/identity/identity/recordings/node/workloadidentitycredential/recording_authenticates_with_workloadidentity_credential.json

Lines changed: 19 additions & 19 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

sdk/identity/identity/src/credentials/managedIdentityCredential/index.ts

Lines changed: 48 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -231,57 +231,57 @@ export class ManagedIdentityCredential implements TokenCredential {
231231
// If it's null, it means we don't yet know whether
232232
// the endpoint is available and need to check for it.
233233
if (this.isEndpointUnavailable !== true) {
234-
const appTokenParameters: AppTokenProviderParameters = {
235-
correlationId: this.identityClient.getCorrelationId(),
236-
tenantId: options?.tenantId || "organizations",
237-
scopes: Array.isArray(scopes) ? scopes : [scopes],
238-
claims: options?.claims,
239-
};
240-
241-
this.confidentialApp.SetAppTokenProvider(
242-
async (appTokenProviderParameters = appTokenParameters) => {
243-
logger.info(
244-
`SetAppTokenProvider invoked with parameters- ${JSON.stringify(
245-
appTokenProviderParameters
246-
)}`
247-
);
248-
249-
const availableMSI = await this.cachedAvailableMSI(scopes, updatedOptions);
250-
const appTokenParams = { ...appTokenProviderParameters };
251-
if (availableMSI.name === "tokenExchangeMsi") {
252-
appTokenParams.tenantId = process.env.AZURE_TENANT_ID!;
253-
}
254-
const resultToken = await this.authenticateManagedIdentity(scopes, {
255-
...updatedOptions,
256-
...appTokenParams,
257-
});
258-
259-
if (resultToken) {
260-
logger.info(`SetAppTokenProvider has saved the token in cache`);
261-
262-
const expiresInSeconds = resultToken?.expiresOnTimestamp
263-
? Math.floor((resultToken.expiresOnTimestamp - Date.now()) / 1000)
264-
: 0;
265-
266-
return {
267-
accessToken: resultToken?.token,
268-
expiresInSeconds,
269-
};
270-
} else {
234+
const availableMSI = await this.cachedAvailableMSI(scopes, updatedOptions);
235+
if (availableMSI.name === "tokenExchangeMsi") {
236+
result = await this.authenticateManagedIdentity(scopes, updatedOptions);
237+
} else {
238+
const appTokenParameters: AppTokenProviderParameters = {
239+
correlationId: this.identityClient.getCorrelationId(),
240+
tenantId: options?.tenantId || "organizations",
241+
scopes: Array.isArray(scopes) ? scopes : [scopes],
242+
claims: options?.claims,
243+
};
244+
245+
this.confidentialApp.SetAppTokenProvider(
246+
async (appTokenProviderParameters = appTokenParameters) => {
271247
logger.info(
272-
`SetAppTokenProvider token has "no_access_token_returned" as the saved token`
248+
`SetAppTokenProvider invoked with parameters- ${JSON.stringify(
249+
appTokenProviderParameters
250+
)}`
273251
);
274-
return {
275-
accessToken: "no_access_token_returned",
276-
expiresInSeconds: 0,
277-
};
252+
253+
const resultToken = await this.authenticateManagedIdentity(scopes, {
254+
...updatedOptions,
255+
...appTokenProviderParameters,
256+
});
257+
258+
if (resultToken) {
259+
logger.info(`SetAppTokenProvider has saved the token in cache`);
260+
261+
const expiresInSeconds = resultToken?.expiresOnTimestamp
262+
? Math.floor((resultToken.expiresOnTimestamp - Date.now()) / 1000)
263+
: 0;
264+
265+
return {
266+
accessToken: resultToken?.token,
267+
expiresInSeconds,
268+
};
269+
} else {
270+
logger.info(
271+
`SetAppTokenProvider token has "no_access_token_returned" as the saved token`
272+
);
273+
return {
274+
accessToken: "no_access_token_returned",
275+
expiresInSeconds: 0,
276+
};
277+
}
278278
}
279-
}
280-
);
281-
const authenticationResult = await this.confidentialApp.acquireTokenByClientCredential({
282-
...appTokenParameters,
283-
});
284-
result = this.handleResult(scopes, authenticationResult || undefined);
279+
);
280+
const authenticationResult = await this.confidentialApp.acquireTokenByClientCredential({
281+
...appTokenParameters,
282+
});
283+
result = this.handleResult(scopes, authenticationResult || undefined);
284+
}
285285
if (result === null) {
286286
// If authenticateManagedIdentity returns null,
287287
// it means no MSI endpoints are available.

0 commit comments

Comments
 (0)