Skip to content

Commit c94a3dc

Browse files
JonathanCrdchristothes
JonathanCrd
and
christothes
authored
[Identity] Re-enable VisualStudioCodeCredential for SSO (Azure#51132)
* wip * wip * delete old tests * get broker options * working with manul test * CUE when AuthRecord is present in IBC * Use AuthenticationRecord.Deserialize for AuthRecord in VisualStudioCodeCredential * Enable VS Code Credential in DAC chain by default * Update XML comments * Remove obsolete and EditorBrowsable attributes * Suppressing API Compat issues * Export API * Remove obsolete warning supressions * Check if the Broker is available when instanciating, and throw at GetToken if it's not available. Also, fixes the constructor with options. * Simplify logic to read the authRecord file and add MacOS scenario with ".Azure" * Addressed comments on PR * Pass options when creating VisualStudioCodeCredential in DAC Factory * Update DAC Factory tests to expect VSCodeCredential by default * Fix DAC Tests by adding VSCodeCredential back to the expected chain on them and increase the expected number of creds by 1 * Add VisualStudioCodeCredentail() to dev chain * Fix ValidateDefaultAzureCredentialAZURE_TOKEN_CREDENTIALS_Honored tests * Fix InteractiveBrowserRefreshException tests * Implement VisualStudioCodeCredential unit tests * Changelog entry added --------- Co-authored-by: Christopher Scott <[email protected]> Co-authored-by: Christopher Scott <[email protected]>
1 parent 8eba242 commit c94a3dc

20 files changed

+344
-395
lines changed

‎sdk/identity/Azure.Identity.Broker/tests/DefaultAzureCredentialFactoryTests.cs‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
using System.Collections.Generic;
55
using System.Linq;
6+
using System.Runtime.InteropServices;
67
using Azure.Core.TestFramework;
78
using NUnit.Framework;
89

@@ -55,9 +56,8 @@ public void ValidateDefaultAzureCredentialAZURE_TOKEN_CREDENTIALS_Honored_WithBr
5556
Assert.IsTrue(chain.Any(cred => cred is AzurePowerShellCredential));
5657
Assert.IsTrue(chain.Any(cred => cred is VisualStudioCredential));
5758
Assert.IsTrue(chain.Any(cred => cred is AzureDeveloperCliCredential));
58-
// VS Code and InteractiveBrowser are always excluded by default.
59-
Assert.IsFalse(chain.Any(cred => cred is VisualStudioCodeCredential));
60-
Assert.IsFalse(chain.Any(cred => cred is InteractiveBrowserCredential));
59+
Assert.IsTrue(chain.Any(cred => cred.GetType() == typeof(VisualStudioCodeCredential)));
60+
Assert.IsFalse(chain.Any(cred => cred.GetType() == typeof(InteractiveBrowserCredential)));
6161
}
6262
else if (credSelection == Constants.ProdCredentials)
6363
{
@@ -115,8 +115,7 @@ public void ValidateDefaultAzureCredentialAZURE_TOKEN_CREDENTIALS_Honored_WithBr
115115
Assert.IsTrue(chain.Any(cred => cred is AzurePowerShellCredential), "AzurePowerShellCredential should be in the chain");
116116
Assert.IsTrue(chain.Any(cred => cred is VisualStudioCredential), "VisualStudioCredential should be in the chain");
117117
Assert.IsTrue(chain.Any(cred => cred is AzureDeveloperCliCredential), "AzureDeveloperCliCredential should be in the chain");
118-
// VS Code is always excluded.
119-
Assert.IsFalse(chain.Any(cred => cred is VisualStudioCodeCredential), "VisualStudioCodeCredential should not be in the chain");
118+
Assert.IsTrue(chain.Any(cred => cred is VisualStudioCodeCredential), "VisualStudioCodeCredential should be in the chain");
120119
});
121120
}
122121
}

‎sdk/identity/Azure.Identity.Broker/tests/VisualStudioCodeTests.cs‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
// Copyright (c) Microsoft Corporation. All rights reserved.
2+
// Licensed under the MIT License.
3+
4+
using Azure.Core;
5+
using NUnit.Framework;
6+
7+
namespace Azure.Identity.Broker.Tests
8+
{
9+
public class VisualStudioCodeTests
10+
{
11+
[Test]
12+
[Ignore("This test is an integration test which can only be run with user interaction")]
13+
public void CanGetTokenFromBroker()
14+
{
15+
var cred = new VisualStudioCodeCredential();
16+
var token = cred.GetToken(new TokenRequestContext(["https://management.azure.com/.default"]), default);
17+
Assert.IsNotNull(token);
18+
Assert.IsNotEmpty(token.Token);
19+
}
20+
}
21+
}

‎sdk/identity/Azure.Identity/CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66

77
- Expanded the set of acceptable values for environment variable `AZURE_TOKEN_CREDENTIALS` to allow for selection of a specific credential in the `DefaultAzureCredential` chain. The valid values now include any of the credential names available in the default chain (`VisualStudioCredential`, `VisualStudioCodeCredential`, `AzureCliCredential`, `AzurePowerShellCredential`, `AzureDeveloperCliCredential`, `EnvironmentCredential`, `WorkloadIdentityCredential`, `ManagedIdentityCredential`, `InteractiveBrowserCredential`, or `BrokerAuthenticationCredential`.) **Note:** `BrokerAuthenticationCredential` requires that the project include a reference to package Azure.Identity.Broker.
88

9+
- Re-introduced `VisualStudioCodeCredential` and included it in the `DefaultAzureCredential` authentication flow. This credential now supports Single Sign-On (SSO) through the authentication broker on Windows, macOS, and Linux using the Azure.Identity.Broker package.
10+
911
### Breaking Changes
1012

1113
### Bugs Fixed

‎sdk/identity/Azure.Identity/api/Azure.Identity.net8.0.cs‎

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -206,8 +206,6 @@ public DefaultAzureCredentialOptions() { }
206206
public bool ExcludeInteractiveBrowserCredential { get { throw null; } set { } }
207207
public bool ExcludeManagedIdentityCredential { get { throw null; } set { } }
208208
public bool ExcludeSharedTokenCacheCredential { get { throw null; } set { } }
209-
[System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
210-
[System.ObsoleteAttribute("VisualStudioCodeCredential is deprecated because the VS Code Azure Account extension on which this credential relies has been deprecated. Consider using other dev-time credentials, such as VisualStudioCredential, AzureCliCredential, AzureDeveloperCliCredential, AzurePowerShellCredential. See the Azure Account extension deprecation notice here: https://github.com/microsoft/vscode-azure-account/issues/964.")]
211209
public bool ExcludeVisualStudioCodeCredential { get { throw null; } set { } }
212210
public bool ExcludeVisualStudioCredential { get { throw null; } set { } }
213211
public bool ExcludeWorkloadIdentityCredential { get { throw null; } set { } }
@@ -220,8 +218,6 @@ public DefaultAzureCredentialOptions() { }
220218
public string SharedTokenCacheTenantId { get { throw null; } set { } }
221219
public string SharedTokenCacheUsername { get { throw null; } set { } }
222220
public string TenantId { get { throw null; } set { } }
223-
[System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
224-
[System.ObsoleteAttribute("VisualStudioCodeCredential is deprecated because the VS Code Azure Account extension on which this credential relies has been deprecated. Consider using other dev-time credentials, such as VisualStudioCredential, AzureCliCredential, AzureDeveloperCliCredential, AzurePowerShellCredential. See the Azure Account extension deprecation notice here: https://github.com/microsoft/vscode-azure-account/issues/964.")]
225221
public string VisualStudioCodeTenantId { get { throw null; } set { } }
226222
[System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
227223
public string VisualStudioTenantId { get { throw null; } set { } }
@@ -451,17 +447,13 @@ public UsernamePasswordCredentialOptions() { }
451447
public bool DisableInstanceDiscovery { get { throw null; } set { } }
452448
public Azure.Identity.TokenCachePersistenceOptions TokenCachePersistenceOptions { get { throw null; } set { } }
453449
}
454-
[System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
455-
[System.ObsoleteAttribute("This credential is deprecated because the VS Code Azure Account extension on which this credential relies has been deprecated. Consider using other dev-time credentials, such as VisualStudioCredential, AzureCliCredential, AzureDeveloperCliCredential, AzurePowerShellCredential. See the Azure Account extension deprecation notice here: https://github.com/microsoft/vscode-azure-account/issues/964.")]
456-
public partial class VisualStudioCodeCredential : Azure.Core.TokenCredential
450+
public partial class VisualStudioCodeCredential : Azure.Identity.InteractiveBrowserCredential
457451
{
458452
public VisualStudioCodeCredential() { }
459453
public VisualStudioCodeCredential(Azure.Identity.VisualStudioCodeCredentialOptions options) { }
460-
public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken) { throw null; }
461-
public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken) { throw null; }
454+
public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) { throw null; }
455+
public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) { throw null; }
462456
}
463-
[System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
464-
[System.ObsoleteAttribute("VisualStudioCodeCredential is deprecated because the VS Code Azure Account extension on which this credential relies has been deprecated. Consider using other dev-time credentials, such as VisualStudioCredential, AzureCliCredential, AzureDeveloperCliCredential, AzurePowerShellCredential. See the Azure Account extension deprecation notice here: https://github.com/microsoft/vscode-azure-account/issues/964.")]
465457
public partial class VisualStudioCodeCredentialOptions : Azure.Identity.TokenCredentialOptions
466458
{
467459
public VisualStudioCodeCredentialOptions() { }

‎sdk/identity/Azure.Identity/api/Azure.Identity.netstandard2.0.cs‎

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -203,8 +203,6 @@ public DefaultAzureCredentialOptions() { }
203203
public bool ExcludeInteractiveBrowserCredential { get { throw null; } set { } }
204204
public bool ExcludeManagedIdentityCredential { get { throw null; } set { } }
205205
public bool ExcludeSharedTokenCacheCredential { get { throw null; } set { } }
206-
[System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
207-
[System.ObsoleteAttribute("VisualStudioCodeCredential is deprecated because the VS Code Azure Account extension on which this credential relies has been deprecated. Consider using other dev-time credentials, such as VisualStudioCredential, AzureCliCredential, AzureDeveloperCliCredential, AzurePowerShellCredential. See the Azure Account extension deprecation notice here: https://github.com/microsoft/vscode-azure-account/issues/964.")]
208206
public bool ExcludeVisualStudioCodeCredential { get { throw null; } set { } }
209207
public bool ExcludeVisualStudioCredential { get { throw null; } set { } }
210208
public bool ExcludeWorkloadIdentityCredential { get { throw null; } set { } }
@@ -217,8 +215,6 @@ public DefaultAzureCredentialOptions() { }
217215
public string SharedTokenCacheTenantId { get { throw null; } set { } }
218216
public string SharedTokenCacheUsername { get { throw null; } set { } }
219217
public string TenantId { get { throw null; } set { } }
220-
[System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
221-
[System.ObsoleteAttribute("VisualStudioCodeCredential is deprecated because the VS Code Azure Account extension on which this credential relies has been deprecated. Consider using other dev-time credentials, such as VisualStudioCredential, AzureCliCredential, AzureDeveloperCliCredential, AzurePowerShellCredential. See the Azure Account extension deprecation notice here: https://github.com/microsoft/vscode-azure-account/issues/964.")]
222218
public string VisualStudioCodeTenantId { get { throw null; } set { } }
223219
[System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
224220
public string VisualStudioTenantId { get { throw null; } set { } }
@@ -448,17 +444,13 @@ public UsernamePasswordCredentialOptions() { }
448444
public bool DisableInstanceDiscovery { get { throw null; } set { } }
449445
public Azure.Identity.TokenCachePersistenceOptions TokenCachePersistenceOptions { get { throw null; } set { } }
450446
}
451-
[System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
452-
[System.ObsoleteAttribute("This credential is deprecated because the VS Code Azure Account extension on which this credential relies has been deprecated. Consider using other dev-time credentials, such as VisualStudioCredential, AzureCliCredential, AzureDeveloperCliCredential, AzurePowerShellCredential. See the Azure Account extension deprecation notice here: https://github.com/microsoft/vscode-azure-account/issues/964.")]
453-
public partial class VisualStudioCodeCredential : Azure.Core.TokenCredential
447+
public partial class VisualStudioCodeCredential : Azure.Identity.InteractiveBrowserCredential
454448
{
455449
public VisualStudioCodeCredential() { }
456450
public VisualStudioCodeCredential(Azure.Identity.VisualStudioCodeCredentialOptions options) { }
457-
public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken) { throw null; }
458-
public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken) { throw null; }
451+
public override Azure.Core.AccessToken GetToken(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) { throw null; }
452+
public override System.Threading.Tasks.ValueTask<Azure.Core.AccessToken> GetTokenAsync(Azure.Core.TokenRequestContext requestContext, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) { throw null; }
459453
}
460-
[System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
461-
[System.ObsoleteAttribute("VisualStudioCodeCredential is deprecated because the VS Code Azure Account extension on which this credential relies has been deprecated. Consider using other dev-time credentials, such as VisualStudioCredential, AzureCliCredential, AzureDeveloperCliCredential, AzurePowerShellCredential. See the Azure Account extension deprecation notice here: https://github.com/microsoft/vscode-azure-account/issues/964.")]
462454
public partial class VisualStudioCodeCredentialOptions : Azure.Identity.TokenCredentialOptions
463455
{
464456
public VisualStudioCodeCredentialOptions() { }

‎sdk/identity/Azure.Identity/src/ApiCompatBaseline.txt‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Baselining these as we are intentionally reintroduinc these obsolete types and properties.
2+
CannotRemoveAttribute : Attribute 'System.ComponentModel.EditorBrowsableAttribute' exists on 'Azure.Identity.DefaultAzureCredentialOptions.ExcludeVisualStudioCodeCredential' in the contract but not the implementation.
3+
CannotRemoveAttribute : Attribute 'System.ObsoleteAttribute' exists on 'Azure.Identity.DefaultAzureCredentialOptions.ExcludeVisualStudioCodeCredential' in the contract but not the implementation.
4+
CannotRemoveAttribute : Attribute 'System.ObsoleteAttribute' exists on 'Azure.Identity.DefaultAzureCredentialOptions.VisualStudioCodeTenantId' in the contract but not the implementation.
5+
CannotRemoveAttribute : Attribute 'System.ComponentModel.EditorBrowsableAttribute' exists on 'Azure.Identity.VisualStudioCodeCredential' in the contract but not the implementation.
6+
CannotRemoveAttribute : Attribute 'System.ObsoleteAttribute' exists on 'Azure.Identity.VisualStudioCodeCredential' in the contract but not the implementation.
7+
CannotRemoveAttribute : Attribute 'System.ComponentModel.EditorBrowsableAttribute' exists on 'Azure.Identity.VisualStudioCodeCredentialOptions' in the contract but not the implementation.
8+
CannotRemoveAttribute : Attribute 'System.ObsoleteAttribute' exists on 'Azure.Identity.VisualStudioCodeCredentialOptions' in the contract but not the implementation.
9+
CannotRemoveAttribute : Attribute 'System.ComponentModel.EditorBrowsableAttribute' exists on 'Azure.Identity.DefaultAzureCredentialOptions.VisualStudioCodeTenantId' in the contract but not the implementation.

‎sdk/identity/Azure.Identity/src/Credentials/DefaultAzureCredential.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ namespace Azure.Identity
2424
/// <item><description><see cref="ManagedIdentityCredential"/></description></item>
2525
/// <item><description><see cref="SharedTokenCacheCredential"/></description></item>
2626
/// <item><description><see cref="VisualStudioCredential"/></description></item>
27+
/// <item><description><see cref="VisualStudioCodeCredential"/> (enabled by default for SSO with VS Code on supported platforms when Azure.Identity.Broker is referenced)</description></item>
2728
/// <item><description><see cref="AzureCliCredential"/></description></item>
2829
/// <item><description><see cref="AzurePowerShellCredential"/></description></item>
2930
/// <item><description><see cref="AzureDeveloperCliCredential"/></description></item>

‎sdk/identity/Azure.Identity/src/Credentials/DefaultAzureCredentialOptions.cs‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -150,8 +150,6 @@ public string VisualStudioTenantId
150150
/// <see cref="VisualStudioCodeCredential"/>. The default is null and will authenticate users to their default tenant.
151151
/// The value can also be set by setting the environment variable AZURE_TENANT_ID.
152152
/// </summary>
153-
[EditorBrowsable(EditorBrowsableState.Never)]
154-
[Obsolete("VisualStudioCodeCredential is deprecated because the VS Code Azure Account extension on which this credential relies has been deprecated. Consider using other dev-time credentials, such as VisualStudioCredential, AzureCliCredential, AzureDeveloperCliCredential, AzurePowerShellCredential. See the Azure Account extension deprecation notice here: https://github.com/microsoft/vscode-azure-account/issues/964.")]
155153
public string VisualStudioCodeTenantId
156154
{
157155
get => _visualStudioCodeTenantId.Value;
@@ -279,11 +277,9 @@ public string VisualStudioCodeTenantId
279277

280278
/// <summary>
281279
/// Specifies whether the <see cref="VisualStudioCodeCredential"/> will be excluded from the <see cref="DefaultAzureCredential"/> authentication flow.
282-
/// The default is <c>true</c>.
280+
/// By default, VisualStudioCodeCredential is enabled to support SSO with VS Code on supported platforms when Azure.Identity.Broker is referenced.
283281
/// </summary>
284-
[EditorBrowsable(EditorBrowsableState.Never)]
285-
[Obsolete("VisualStudioCodeCredential is deprecated because the VS Code Azure Account extension on which this credential relies has been deprecated. Consider using other dev-time credentials, such as VisualStudioCredential, AzureCliCredential, AzureDeveloperCliCredential, AzurePowerShellCredential. See the Azure Account extension deprecation notice here: https://github.com/microsoft/vscode-azure-account/issues/964.")]
286-
public bool ExcludeVisualStudioCodeCredential { get; set; } = true;
282+
public bool ExcludeVisualStudioCodeCredential { get; set; }
287283

288284
/// <summary>
289285
/// Specifies whether the <see cref="AzurePowerShellCredential"/> will be excluded from the <see cref="DefaultAzureCredential"/> authentication flow.

‎sdk/identity/Azure.Identity/src/Credentials/InteractiveBrowserCredential.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -245,7 +245,7 @@ private async ValueTask<AccessToken> GetTokenImplAsync(bool async, TokenRequestC
245245
}
246246
catch (MsalUiRequiredException e)
247247
{
248-
if (UseOperatingSystemAccount && IsChainedCredential)
248+
if ((UseOperatingSystemAccount && IsChainedCredential) || (Record is not null && IsChainedCredential))
249249
{
250250
throw;
251251
}

0 commit comments

Comments
 (0)