Support Subject Name/Issuer authentication #13350
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
chlowell
added
Client
xiangyan99
reviewed
Aug 28, 2020
| @@ -54,9 +56,30 @@ def __init__(self, tenant_id, client_id, certificate_path, **kwargs): | |||
|
|
|||
| # TODO: msal doesn't formally support passwords (but soon will); the below depends on an implementation detail | |||
| private_key = serialization.load_pem_private_key(pem_bytes, password=password, backend=default_backend()) | |||
| client_credential = {"private_key": private_key, "thumbprint": hexlify(fingerprint).decode("utf-8")} | |||
| if kwargs.pop("send_certificate", False): | |||
There was a problem hiding this comment.
Should we do this only in
if kwargs.pop("send_certificate", False):
else:
private_key = serialization.load_pem_private_key(pem_bytes, password=password, backend=default_backend())
client_credential = {"private_key": private_key, "thumbprint": hexlify(fingerprint).decode("utf-8")}
There was a problem hiding this comment.
We need the private key and fingerprint in both cases. send_certificate=True means we need to include the cert content as well.
xiangyan99
reviewed
Aug 28, 2020
| ) | ||
|
|
||
|
|
||
| def extract_cert_chain(pem_bytes): |
There was a problem hiding this comment.
Yes. But if we only want to use the method in this model, shouldn't we use _extract_cert_chain? Or we may want to use it in other models in the future?
xiangyan99
approved these changes
Aug 28, 2020
iscai-msft
added a commit
to iscai-msft/azure-sdk-for-python
that referenced
this pull request
Sep 2, 2020
…into link_om_sample * 'master' of https://github.com/Azure/azure-sdk-for-python: (23 commits) Int32 serialization (Azure#13452) add output to opinion mining sample (Azure#13494) Add Document w/ Eng Sys Checks (Azure#13492) update version (Azure#13495) Remove resources post test (Azure#13379) bing_id -> bing_entity_search_api_id (Azure#13491) [EventGrid] Read me + improve docstrings (Azure#13484) Build AuthenticationRecords from ADFS identity tokens (Azure#13341) Support Subject Name/Issuer authentication (Azure#13350) Add KeyVaultAccessControlClient for data plane RBAC (Azure#13372) [text analytics] Add redacted_text (Azure#13449) add python sdk sample (Azure#13338) [text analytics] add versionadded sphinx documentation (Azure#13450) [text analytics] add bing_id property to LinkedEntity class (Azure#13446) fix typing for paging methods (Azure#13410) [text analytics] add domain_filter param (Azure#13451) fix issue Azure#11658 for is_valid_resource_id (Azure#11709) added create_table_if_not_exists method to table service client (Azure#13385) [ServiceBus] Test and failure improvements (Azure#13345) Proper encoding and decoding of source URLs - Fixes special characters in source URL issue (Azure#13275) ...
rakshith91
pushed a commit
to rakshith91/azure-sdk-for-python
that referenced
this pull request
Sep 4, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This leverages MSAL to support SNI auth with the sync
CertificateCredential(closes #10816). I've tested this manually and will add a live test in a later PR. Adding equivalent support to the asyncCertificateCredentialis tracked by #13349.