Skip to content

Commit 17a3ef7

Browse files
scottaddiescottaddie
authored
Azure Identity README simplification (Azure#48370)
* Azure Identity README simplification * Delete old DAC flow diagram
1 parent 348deb0 commit 17a3ef7

File tree

4 files changed

+33
-149
lines changed

4 files changed

+33
-149
lines changed

‎sdk/identity/Azure.Identity/README.md‎

Lines changed: 31 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -83,15 +83,6 @@ This behavior allows for trying all of the developer tool credentials on your ma
8383

8484
## Examples
8585

86-
### Authenticate with `DefaultAzureCredential`
87-
88-
This example demonstrates authenticating `SecretClient` from the [Azure.Security.KeyVault.Secrets][secrets_client_library] client library with `DefaultAzureCredential`:
89-
90-
```C# Snippet:AuthenticatingWithDefaultAzureCredential
91-
// Create a secret client using the DefaultAzureCredential
92-
var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), new DefaultAzureCredential());
93-
```
94-
9586
### Specify a user-assigned managed identity with `DefaultAzureCredential`
9687

9788
Many Azure hosts allow the assignment of a user-assigned managed identity. The following examples demonstrate configuring `DefaultAzureCredential` to authenticate a user-assigned managed identity when deployed to an Azure host. The sample code uses the credential to authenticate a `BlobClient` from the [Azure.Storage.Blobs][blobs_client_library] client library. It also demonstrates how you can specify a user-assigned managed identity either by a client ID or a resource ID.
@@ -154,52 +145,6 @@ While `DefaultAzureCredential` is generally the quickest way to authenticate app
154145

155146
As of version 1.8.0, `ManagedIdentityCredential` supports [token caching](#token-caching).
156147

157-
### Examples
158-
159-
These examples demonstrate authenticating `SecretClient` from the [Azure.Security.KeyVault.Secrets][secrets_client_library] client library with `ManagedIdentityCredential`.
160-
161-
#### Authenticate with a user-assigned managed identity
162-
163-
To authenticate with a user-assigned managed identity, you must specify one of the following IDs for the managed identity.
164-
165-
**Client ID**
166-
167-
```C# Snippet:AuthenticatingWithManagedIdentityCredentialUserAssigned
168-
string userAssignedClientId = "some client ID";
169-
170-
var credential = new ManagedIdentityCredential(
171-
ManagedIdentityId.FromUserAssignedClientId(userAssignedClientId));
172-
var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), credential);
173-
```
174-
175-
**Resource ID**
176-
177-
```C# Snippet:AuthenticatingWithManagedIdentityCredentialUserAssignedResourceId
178-
ResourceIdentifier userAssignedResourceId = new ResourceIdentifier(
179-
"/subscriptions/<subscriptionID>/resourcegroups/<resource group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<MI name>");
180-
181-
var credential = new ManagedIdentityCredential(
182-
ManagedIdentityId.FromUserAssignedResourceId(userAssignedResourceId));
183-
var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), credential);
184-
```
185-
186-
**Object ID**
187-
188-
```C# Snippet:AuthenticatingWithManagedIdentityCredentialUserAssignedObjectId
189-
string userAssignedObjectId = "some object ID";
190-
191-
var credential = new ManagedIdentityCredential(
192-
ManagedIdentityId.FromUserAssignedObjectId(userAssignedObjectId));
193-
var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), credential);
194-
```
195-
196-
#### Authenticate with a system-assigned managed identity
197-
198-
```C# Snippet:AuthenticatingWithManagedIdentityCredentialSystemAssigned
199-
var credential = new ManagedIdentityCredential(ManagedIdentityId.SystemAssigned);
200-
var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), credential);
201-
```
202-
203148
## Sovereign cloud configuration
204149

205150
By default, credentials authenticate to the Microsoft Entra endpoint for the Azure Public Cloud. To access resources in other clouds, such as Azure US Government or a private cloud, use one of the following solutions:
@@ -224,47 +169,47 @@ Not all credentials require this configuration. Credentials that authenticate th
224169

225170
### Credential chains
226171

227-
|Credential | Usage | Reference
228-
|-|-|-
229-
|[`DefaultAzureCredential`][ref_DefaultAzureCredential]|Provides a simplified authentication experience to quickly start developing apps run in Azure.|[DefaultAzureCredential overview][dac_overview]
230-
|[`ChainedTokenCredential`][ref_ChainedTokenCredential]|Allows users to define custom authentication flows comprised of multiple credentials.|[ChainedTokenCredential overview][ctc_overview]
172+
|Credential | Usage | Reference|
173+
|-|-|-|
174+
|[`DefaultAzureCredential`][ref_DefaultAzureCredential]|Provides a simplified authentication experience to quickly start developing apps run in Azure.|[DefaultAzureCredential overview][dac_overview]|
175+
|[`ChainedTokenCredential`][ref_ChainedTokenCredential]|Allows users to define custom authentication flows comprised of multiple credentials.|[ChainedTokenCredential overview][ctc_overview]|
231176

232177
### Authenticate Azure-hosted apps
233178

234-
|Credential | Usage
235-
|-|-
236-
|[`EnvironmentCredential`][ref_EnvironmentCredential]|Authenticates a service principal or user via credential information specified in environment variables.
237-
|[`ManagedIdentityCredential`][ref_ManagedIdentityCredential]|Authenticates the managed identity of an Azure resource.
238-
|[`WorkloadIdentityCredential`][ref_WorkloadIdentityCredential]|Supports [Microsoft Entra Workload ID](https://learn.microsoft.com/azure/aks/workload-identity-overview) on Kubernetes.
179+
|Credential | Usage | Reference|
180+
|-|-|-|
181+
|[`EnvironmentCredential`][ref_EnvironmentCredential]|Authenticates a service principal or user via credential information specified in [environment variables](#environment-variables).||
182+
|[`ManagedIdentityCredential`][ref_ManagedIdentityCredential]|Authenticates the managed identity of an Azure resource.|[user-assigned managed identity][uami_doc]<br>[system-assigned managed identity][sami_doc]|
183+
|[`WorkloadIdentityCredential`][ref_WorkloadIdentityCredential]|Supports [Microsoft Entra Workload ID](https://learn.microsoft.com/azure/aks/workload-identity-overview) on Kubernetes.||
239184

240185
### Authenticate service principals
241186

242-
|Credential | Usage | Reference
243-
|-|-|-
244-
|[`AzurePipelinesCredential`][ref_AzurePipelinesCredential]|Supports [Microsoft Entra Workload ID](https://learn.microsoft.com/azure/devops/pipelines/release/configure-workload-identity?view=azure-devops) on Azure Pipelines.| [example](https://aka.ms/azsdk/net/identity/azurepipelinescredential/usage)
245-
|[`ClientAssertionCredential`][ref_ClientAssertionCredential]|Authenticates a service principal using a signed client assertion. |
246-
|[`ClientCertificateCredential`][ref_ClientCertificateCredential]|Authenticates a service principal using a certificate. | [Service principal authentication](https://learn.microsoft.com/entra/identity-platform/app-objects-and-service-principals)
247-
|[`ClientSecretCredential`][ref_ClientSecretCredential]|Authenticates a service principal using a secret. | [Service principal authentication](https://learn.microsoft.com/entra/identity-platform/app-objects-and-service-principals)
187+
|Credential | Usage | Reference|
188+
|-|-|-|
189+
|[`AzurePipelinesCredential`][ref_AzurePipelinesCredential]|Supports [Microsoft Entra Workload ID](https://learn.microsoft.com/azure/devops/pipelines/release/configure-workload-identity?view=azure-devops) on Azure Pipelines.| [example](https://aka.ms/azsdk/net/identity/azurepipelinescredential/usage)|
190+
|[`ClientAssertionCredential`][ref_ClientAssertionCredential]|Authenticates a service principal using a signed client assertion.||
191+
|[`ClientCertificateCredential`][ref_ClientCertificateCredential]|Authenticates a service principal using a certificate. | [Service principal authentication](https://learn.microsoft.com/entra/identity-platform/app-objects-and-service-principals)|
192+
|[`ClientSecretCredential`][ref_ClientSecretCredential]|Authenticates a service principal using a secret. | [Service principal authentication](https://learn.microsoft.com/entra/identity-platform/app-objects-and-service-principals)|
248193

249194
### Authenticate users
250195

251-
|Credential | Usage | Reference
252-
|-|-|-
253-
|[`AuthorizationCodeCredential`][ref_AuthorizationCodeCredential]|Authenticates a user with a previously obtained authorization code. | [OAuth2 authentication code](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-auth-code-flow)
254-
|[`DeviceCodeCredential`][ref_DeviceCodeCredential]|Interactively authenticates a user on devices with limited UI. | [Device code authentication](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-device-code)
255-
|[`InteractiveBrowserCredential`][ref_InteractiveBrowserCredential]|Interactively authenticates a user with the default system browser. | [OAuth2 authentication code](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-auth-code-flow)
256-
|[`OnBehalfOfCredential`][ref_OnBehalfOfCredential]|Propagates the delegated user identity and permissions through the request chain. | [On-behalf-of authentication](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-on-behalf-of-flow)
257-
|[`UsernamePasswordCredential`][ref_UsernamePasswordCredential]|Authenticates a user with a username and password. | [Username + password authentication](https://learn.microsoft.com/entra/identity-platform/v2-oauth-ropc)
196+
|Credential | Usage | Reference|
197+
|-|-|-|
198+
|[`AuthorizationCodeCredential`][ref_AuthorizationCodeCredential]|Authenticates a user with a previously obtained authorization code. | [OAuth2 authentication code](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-auth-code-flow)|
199+
|[`DeviceCodeCredential`][ref_DeviceCodeCredential]|Interactively authenticates a user on devices with limited UI. | [Device code authentication](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-device-code)|
200+
|[`InteractiveBrowserCredential`][ref_InteractiveBrowserCredential]|Interactively authenticates a user with the default system browser. | [OAuth2 authentication code](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-auth-code-flow)|
201+
|[`OnBehalfOfCredential`][ref_OnBehalfOfCredential]|Propagates the delegated user identity and permissions through the request chain. | [On-behalf-of authentication](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-on-behalf-of-flow)|
202+
|[`UsernamePasswordCredential`][ref_UsernamePasswordCredential]|Authenticates a user with a username and password. | [Username + password authentication](https://learn.microsoft.com/entra/identity-platform/v2-oauth-ropc)|
258203

259204
### Authenticate via development tools
260205

261-
|Credential | Usage | Reference
262-
|-|-|-
263-
|[`AzureCliCredential`][ref_AzureCliCredential]|Authenticates in a development environment with the Azure CLI. | [Azure CLI authentication](https://learn.microsoft.com/cli/azure/authenticate-azure-cli)
264-
|[`AzureDeveloperCliCredential`][ref_AzureDeveloperCliCredential]|Authenticates in a development environment with the Azure Developer CLI. | [Azure Developer CLI Reference](https://learn.microsoft.com/azure/developer/azure-developer-cli/reference)
265-
|[`AzurePowerShellCredential`][ref_AzurePowerShellCredential]|Authenticates in a development environment with the Azure PowerShell. | [Azure PowerShell authentication](https://learn.microsoft.com/powershell/azure/authenticate-azureps)
266-
|[`VisualStudioCredential`][ref_VisualStudioCredential]|Authenticates in a development environment with Visual Studio. | [Visual Studio configuration](https://learn.microsoft.com/dotnet/azure/configure-visual-studio)
267-
|[`VisualStudioCodeCredential`][ref_VisualStudioCodeCredential]|Authenticates as the user signed in to the Visual Studio Code Azure Account extension. | [VS Code Azure Account extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode.azure-account)
206+
|Credential | Usage | Reference|
207+
|-|-|-|
208+
|[`AzureCliCredential`][ref_AzureCliCredential]|Authenticates in a development environment with the Azure CLI. | [Azure CLI authentication](https://learn.microsoft.com/cli/azure/authenticate-azure-cli)|
209+
|[`AzureDeveloperCliCredential`][ref_AzureDeveloperCliCredential]|Authenticates in a development environment with the Azure Developer CLI. | [Azure Developer CLI Reference](https://learn.microsoft.com/azure/developer/azure-developer-cli/reference)|
210+
|[`AzurePowerShellCredential`][ref_AzurePowerShellCredential]|Authenticates in a development environment with the Azure PowerShell. | [Azure PowerShell authentication](https://learn.microsoft.com/powershell/azure/authenticate-azureps)|
211+
|[`VisualStudioCredential`][ref_VisualStudioCredential]|Authenticates in a development environment with Visual Studio. | [Visual Studio configuration](https://learn.microsoft.com/dotnet/azure/configure-visual-studio)|
212+
|[`VisualStudioCodeCredential`][ref_VisualStudioCodeCredential]|Authenticates as the user signed in to the Visual Studio Code Azure Account extension. | [VS Code Azure Account extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode.azure-account)|
268213

269214
> __Note:__ All credential implementations in the Azure Identity library are threadsafe, and a single credential instance can be used by multiple service clients.
270215
@@ -403,7 +348,6 @@ This project has adopted the [Microsoft Open Source Code of Conduct][code_of_con
403348
[entraid_err_doc]: https://learn.microsoft.com/entra/identity-platform/reference-error-codes
404349
[code_of_conduct]: https://opensource.microsoft.com/codeofconduct/
405350
[code_of_conduct_faq]: https://opensource.microsoft.com/codeofconduct/faq/
406-
[secrets_client_library]: https://github.com/Azure/azure-sdk-for-net/tree/main/sdk/keyvault/Azure.Security.KeyVault.Secrets
407351
[blobs_client_library]: https://github.com/Azure/azure-sdk-for-net/tree/main/sdk/storage/Azure.Storage.Blobs
408352
[azure_core_library]: https://github.com/Azure/azure-sdk-for-net/tree/main/sdk/core/Azure.Core
409353
[identity_api_docs]: https://learn.microsoft.com/dotnet/api/azure.identity?view=azure-dotnet
@@ -432,3 +376,5 @@ This project has adopted the [Microsoft Open Source Code of Conduct][code_of_con
432376
[ref_VisualStudioCodeCredential]: https://learn.microsoft.com/dotnet/api/azure.identity.visualstudiocodecredential?view=azure-dotnet
433377
[ref_WorkloadIdentityCredential]: https://learn.microsoft.com/dotnet/api/azure.identity.workloadidentitycredential?view=azure-dotnet
434378
[cae]: https://learn.microsoft.com/entra/identity/conditional-access/concept-continuous-access-evaluation
379+
[sami_doc]: https://learn.microsoft.com/dotnet/azure/sdk/authentication/system-assigned-managed-identity
380+
[uami_doc]: https://learn.microsoft.com/dotnet/azure/sdk/authentication/user-assigned-managed-identity

‎sdk/identity/Azure.Identity/images/DefaultAzureCredentialAuthenticationFlow.png‎

-25.2 KB
Binary file not shown.

‎sdk/identity/Azure.Identity/src/Credentials/ManagedIdentityCredential.cs‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@ namespace Azure.Identity
1414
{
1515
/// <summary>
1616
/// Attempts authentication using a managed identity that has been assigned to the deployment environment. This authentication type works for all Azure-hosted
17-
/// environments that support managed identity. More information about configuring managed identities can be found at
17+
/// environments that support managed identity. For end-to-end guidance, see <see href="https://learn.microsoft.com/dotnet/azure/sdk/authentication/user-assigned-managed-identity">user-assigned managed identity</see>
18+
/// or <see href="https://learn.microsoft.com/dotnet/azure/sdk/authentication/system-assigned-managed-identity">system-assigned managed identity</see>.
1819
/// <see href="https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/overview"/>.
1920
/// </summary>
2021
public class ManagedIdentityCredential : TokenCredential

‎sdk/identity/Azure.Identity/tests/samples/ReadmeSnippets.cs‎

Lines changed: 0 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -3,25 +3,13 @@
33

44
using System;
55
using Azure.Core;
6-
using Azure.Security.KeyVault.Secrets;
76
using Azure.Storage.Blobs;
87
using NUnit.Framework;
98

109
namespace Azure.Identity.Samples
1110
{
1211
public class ReadmeSnippets
1312
{
14-
[Test]
15-
public void AuthenticatingWithDefaultAzureCredential()
16-
{
17-
#region Snippet:AuthenticatingWithDefaultAzureCredential
18-
19-
// Create a secret client using the DefaultAzureCredential
20-
var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), new DefaultAzureCredential());
21-
22-
#endregion
23-
}
24-
2513
[Test]
2614
public void UserAssignedManagedIdentityWithClientId()
2715
{
@@ -73,56 +61,5 @@ public void AuthenticatingWithAuthorityHost()
7361
});
7462
#endregion
7563
}
76-
77-
[Test]
78-
public void AuthenticatingWithManagedIdentityCredentialUserAssigned()
79-
{
80-
#region Snippet:AuthenticatingWithManagedIdentityCredentialUserAssigned
81-
string userAssignedClientId = "some client ID";
82-
83-
var credential = new ManagedIdentityCredential(
84-
ManagedIdentityId.FromUserAssignedClientId(userAssignedClientId));
85-
var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), credential);
86-
87-
#endregion
88-
}
89-
90-
[Test]
91-
public void AuthenticatingWithManagedIdentityCredentialUserAssignedResourceId()
92-
{
93-
#region Snippet:AuthenticatingWithManagedIdentityCredentialUserAssignedResourceId
94-
ResourceIdentifier userAssignedResourceId = new ResourceIdentifier(
95-
"/subscriptions/<subscriptionID>/resourcegroups/<resource group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<MI name>");
96-
97-
var credential = new ManagedIdentityCredential(
98-
ManagedIdentityId.FromUserAssignedResourceId(userAssignedResourceId));
99-
var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), credential);
100-
101-
#endregion
102-
}
103-
104-
[Test]
105-
public void AuthenticatingWithManagedIdentityCredentialUserAssignedObjectId()
106-
{
107-
#region Snippet:AuthenticatingWithManagedIdentityCredentialUserAssignedObjectId
108-
string userAssignedObjectId = "some object ID";
109-
110-
var credential = new ManagedIdentityCredential(
111-
ManagedIdentityId.FromUserAssignedObjectId(userAssignedObjectId));
112-
var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), credential);
113-
114-
#endregion
115-
}
116-
117-
[Test]
118-
public void AuthenticatingWithManagedIdentityCredentialSystemAssigned()
119-
{
120-
#region Snippet:AuthenticatingWithManagedIdentityCredentialSystemAssigned
121-
122-
var credential = new ManagedIdentityCredential(ManagedIdentityId.SystemAssigned);
123-
var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), credential);
124-
125-
#endregion
126-
}
12764
}
12865
}

0 commit comments

Comments
 (0)