Skip to content

Commit 5c863e3

Browse files
scottaddiescottaddie
authored
Document how to use user-assigned MI resource ID with DefaultAzureCredential (Azure#43835)
1 parent 1422660 commit 5c863e3

File tree

3 files changed

+80
-21
lines changed

3 files changed

+80
-21
lines changed

‎sdk/identity/Azure.Identity/README.md

Lines changed: 36 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -125,18 +125,47 @@ var eventHubClient = new EventHubProducerClient("myeventhub.eventhubs.windows.ne
125125

126126
### Specify a user-assigned managed identity with `DefaultAzureCredential`
127127

128-
Many Azure hosts allow the assignment of a user-assigned managed identity. This example demonstrates configuring the `DefaultAzureCredential` to authenticate a user-assigned identity when deployed to an Azure host. It then authenticates a `BlobClient` from the [Azure.Storage.Blobs][blobs_client_library] client library with credential.
128+
Many Azure hosts allow the assignment of a user-assigned managed identity. The following examples demonstrate configuring `DefaultAzureCredential` to authenticate a user-assigned managed identity when deployed to an Azure host. The sample code uses the credential to authenticate a `BlobClient` from the [Azure.Storage.Blobs][blobs_client_library] client library. To do this, you can specify a user-assigned managed identity either by a client ID or a resource ID.
129129

130-
```C# Snippet:UserAssignedManagedIdentity
131-
// When deployed to an azure host, the default azure credential will authenticate the specified user assigned managed identity.
130+
#### Client ID
132131

133-
string userAssignedClientId = "<your managed identity client Id>";
134-
var credential = new DefaultAzureCredential(new DefaultAzureCredentialOptions { ManagedIdentityClientId = userAssignedClientId });
132+
To use a client ID, take one of the following approaches:
135133

136-
var blobClient = new BlobClient(new Uri("https://myaccount.blob.core.windows.net/mycontainer/myblob"), credential);
134+
1. Set the [DefaultAzureCredentialOptions.ManagedIdentityClientId](https://learn.microsoft.com/dotnet/api/azure.identity.defaultazurecredentialoptions.managedidentityclientid?view=azure-dotnet) property. For example:
135+
136+
```C# Snippet:UserAssignedManagedIdentityWithClientId
137+
// When deployed to an Azure host, DefaultAzureCredential will authenticate the specified user-assigned managed identity.
138+
139+
string userAssignedClientId = "<your managed identity client ID>";
140+
var credential = new DefaultAzureCredential(
141+
new DefaultAzureCredentialOptions
142+
{
143+
ManagedIdentityClientId = userAssignedClientId
144+
});
145+
146+
var blobClient = new BlobClient(
147+
new Uri("https://myaccount.blob.core.windows.net/mycontainer/myblob"),
148+
credential);
137149
```
138150

139-
In addition to configuring the `ManagedIdentityClientId` via code, it can also be set using the `AZURE_CLIENT_ID` environment variable. These two approaches are equivalent when using the `DefaultAzureCredential`.
151+
1. Set the `AZURE_CLIENT_ID` environment variable.
152+
153+
#### Resource ID
154+
155+
To use a resource ID, set the [DefaultAzureCredentialOptions.ManagedIdentityResourceId](https://learn.microsoft.com/dotnet/api/azure.identity.defaultazurecredentialoptions.managedidentityresourceid?view=azure-dotnet) property. The resource ID takes the form `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}`. For example:
156+
157+
```C# Snippet:UserAssignedManagedIdentityWithResourceId
158+
string userAssignedResourceId = "<your managed identity resource ID>";
159+
var credential = new DefaultAzureCredential(
160+
new DefaultAzureCredentialOptions
161+
{
162+
ManagedIdentityResourceId = new ResourceIdentifier(userAssignedResourceId)
163+
});
164+
165+
var blobClient = new BlobClient(
166+
new Uri("https://myaccount.blob.core.windows.net/mycontainer/myblob"),
167+
credential);
168+
```
140169

141170
### Define a custom authentication flow with `ChainedTokenCredential`
142171

‎sdk/identity/Azure.Identity/src/Credentials/DefaultAzureCredential.cs

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@
1212
namespace Azure.Identity
1313
{
1414
/// <summary>
15-
/// Provides a default <see cref="TokenCredential"/> authentication flow for applications that will be deployed to Azure. The following credential
16-
/// types if enabled will be tried, in order:
15+
/// Provides a default <see cref="TokenCredential"/> authentication flow for applications that will be deployed to Azure. The following credential
16+
/// types, if enabled, will be tried, in order:
1717
/// <list type="bullet">
1818
/// <item><description><see cref="EnvironmentCredential"/></description></item>
1919
/// <item><description><see cref="WorkloadIdentityCredential"/></description></item>
@@ -36,15 +36,21 @@ namespace Azure.Identity
3636
/// <example>
3737
/// <para>
3838
/// This example demonstrates authenticating the BlobClient from the Azure.Storage.Blobs client library using the DefaultAzureCredential,
39-
/// deployed to an Azure resource with a user assigned managed identity configured.
39+
/// deployed to an Azure resource with a user-assigned managed identity configured.
4040
/// </para>
41-
/// <code snippet="Snippet:UserAssignedManagedIdentity" language="csharp">
42-
/// // When deployed to an azure host, the default azure credential will authenticate the specified user assigned managed identity.
41+
/// <code snippet="Snippet:UserAssignedManagedIdentityWithClientId" language="csharp">
42+
/// // When deployed to an Azure host, DefaultAzureCredential will authenticate the specified user-assigned managed identity.
4343
///
44-
/// string userAssignedClientId = &quot;&lt;your managed identity client Id&gt;&quot;;
45-
/// var credential = new DefaultAzureCredential(new DefaultAzureCredentialOptions { ManagedIdentityClientId = userAssignedClientId });
44+
/// string userAssignedClientId = &quot;&lt;your managed identity client ID&gt;&quot;;
45+
/// var credential = new DefaultAzureCredential(
46+
/// new DefaultAzureCredentialOptions
47+
/// {
48+
/// ManagedIdentityClientId = userAssignedClientId
49+
/// });
4650
///
47-
/// var blobClient = new BlobClient(new Uri(&quot;https://myaccount.blob.core.windows.net/mycontainer/myblob&quot;), credential);
51+
/// var blobClient = new BlobClient(
52+
/// new Uri(&quot;https://myaccount.blob.core.windows.net/mycontainer/myblob&quot;),
53+
/// credential);
4854
/// </code>
4955
/// </example>
5056
public class DefaultAzureCredential : TokenCredential

‎sdk/identity/Azure.Identity/tests/samples/ReadmeSnippets.cs

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
// Licensed under the MIT License.
33

44
using System;
5+
using Azure.Core;
56
using Azure.Messaging.EventHubs.Producer;
67
using Azure.Security.KeyVault.Secrets;
78
using Azure.Storage.Blobs;
@@ -36,22 +37,45 @@ public void EnableInteractiveAuthentication()
3637
}
3738

3839
[Test]
39-
public void UserAssignedManagedIdentity()
40+
public void UserAssignedManagedIdentityWithClientId()
4041
{
4142
string userAssignedClientId = "";
4243

43-
#region Snippet:UserAssignedManagedIdentity
44+
#region Snippet:UserAssignedManagedIdentityWithClientId
4445

45-
// When deployed to an azure host, the default azure credential will authenticate the specified user assigned managed identity.
46+
// When deployed to an Azure host, DefaultAzureCredential will authenticate the specified user-assigned managed identity.
4647

47-
//@@string userAssignedClientId = "<your managed identity client Id>";
48-
var credential = new DefaultAzureCredential(new DefaultAzureCredentialOptions { ManagedIdentityClientId = userAssignedClientId });
48+
//@@string userAssignedClientId = "<your managed identity client ID>";
49+
var credential = new DefaultAzureCredential(
50+
new DefaultAzureCredentialOptions
51+
{
52+
ManagedIdentityClientId = userAssignedClientId
53+
});
4954

50-
var blobClient = new BlobClient(new Uri("https://myaccount.blob.core.windows.net/mycontainer/myblob"), credential);
55+
var blobClient = new BlobClient(
56+
new Uri("https://myaccount.blob.core.windows.net/mycontainer/myblob"),
57+
credential);
5158

5259
#endregion
5360
}
5461

62+
[Test]
63+
public void UserAssignedManagedIdentityWithResourceId()
64+
{
65+
#region Snippet:UserAssignedManagedIdentityWithResourceId
66+
string userAssignedResourceId = "<your managed identity resource ID>";
67+
var credential = new DefaultAzureCredential(
68+
new DefaultAzureCredentialOptions
69+
{
70+
ManagedIdentityResourceId = new ResourceIdentifier(userAssignedResourceId)
71+
});
72+
73+
var blobClient = new BlobClient(
74+
new Uri("https://myaccount.blob.core.windows.net/mycontainer/myblob"),
75+
credential);
76+
#endregion
77+
}
78+
5579
[Test]
5680
public void CustomChainedTokenCredential()
5781
{

0 commit comments

Comments
 (0)