Add support for authenticating using azureauth cli #1464

demoray · 2023-11-16T20:25:30Z

This PR adds support for calling out to the azureauth CLI.

https://github.com/AzureAD/microsoft-authentication-cli

sdk/identity/src/token_credentials/mod.rs

sdk/identity/src/token_credentials/azureauth_cli_credentials.rs

kyle-rader-msft

Thank you so much @demoray for jumping on this! This will unlock easy usage across a lot of developer tools!

sdk/identity/src/token_credentials/azureauth_cli_credentials.rs

sdk/identity/src/token_credentials/mod.rs

heaths · 2023-11-17T18:36:51Z

After discussing with some members of the Azure SDK Identity team, they have no plans to support azureauth at this time but are aware of it and have talked with the team; however, they were fine with the idea to make it an optional feature in rust - something our other languages don't enjoy. If/when we support azureauth we can revisit but our understanding is that this is mostly (only) an internal-only tool at this point.

So can you instead put this behind an optional off-by-default feature?

kyle-rader-msft · 2023-11-17T20:18:16Z

@heaths That is understandable, we very much appreciate the inclusion as an optional feature :) (ty, Rust).

AzureAuth is OSS and might be used outside the company, but we explicitly have no inherent telemetry as we care about data privacy first and foremost.

demoray · 2023-11-17T21:33:32Z

After discussing with some members of the Azure SDK Identity team, they have no plans to support azureauth at this time but are aware of it and have talked with the team; however, they were fine with the idea to make it an optional feature in rust - something our other languages don't enjoy. If/when we support azureauth we can revisit but our understanding is that this is mostly (only) an internal-only tool at this point.

So can you instead put this behind an optional off-by-default feature?

Done.

kyle-rader-msft

Thanks for the feature flag, 2 remaining small comments :)

kyle-rader-msft · 2023-11-20T22:40:51Z

sdk/identity/src/token_credentials/azureauth_cli_credentials.rs

+    All,
+    #[cfg(target_os = "windows")]
+    IntegratedWindowsAuth,
+    Broker,


Suggested change

Broker,

#[cfg(target_os = "windows")]

Broker,

Broker would also need it's own cfg atribute right?

@demoray ping.

kyle-rader-msft · 2023-11-20T22:42:08Z

sdk/identity/src/token_credentials/azureauth_cli_credentials.rs

+        self
+    }
+
+    fn get_access_token(&self, resource: &str) -> azure_core::Result<CliTokenResponse> {


Could we take scopes: &Vec<String> or similar here instead of a single resource?

@demoray After reading the TokenCredential trait source, I see that resource here is actually a space separated list of scopes, or potentially the concept of a resource as parsed by the az CLI. But MSAL only takes a list of scopes, which AzureAuth will turn --resource into, but we recommend passing --scope repeatedly for each scope needed.

I think we need to test this a little further and likely split this "resource" (maybe rename it scopes), and pass each value as it's own --scope for azureauth to correctly handle them.

I would prefer to do this as a follow-up PR, as I think the underlying trait should be updated to take a list of scopes.

So long as this doesn't ship, a follow up PR seems okay. I do not think this will work as is.

kyle-rader-msft · 2023-11-20T23:18:43Z

@demoray , One more flag we highly encourage passing when using AzureAuth is the --prompt-hint flag, which, if possible, when there is an auth prompt, will be added to the auth prompt title bar. This only works, at present for WAM dialogs on Windows, but it aides with telemetry (if using it) and in the future will hopefully have better display options on Mac/Linux.

Perhaps to future proof, we can add a with_args method to take an arbitrary list of extra args one might want to add to their usage?

kyle-rader-msft · 2023-11-20T23:30:29Z

Oh, @demoray sorry, I realized that method takes a resource, because the Trait requires it to do so... Perhaps, we can adhere to that, but internally pass --scope <resource/.default, and provide the extra args extensibility point to allow adding more scopes or any args you want.

demoray · 2023-11-21T19:00:59Z

@demoray , One more flag we highly encourage passing when using AzureAuth is the --prompt-hint flag, which, if possible, when there is an auth prompt, will be added to the auth prompt title bar. This only works, at present for WAM dialogs on Windows, but it aides with telemetry (if using it) and in the future will hopefully have better display options on Mac/Linux.

Perhaps to future proof, we can add a with_args method to take an arbitrary list of extra args one might want to add to their usage?

I've added --prompt-hint.

kyle-rader-msft · 2023-11-21T23:38:15Z

@demoray While testing this internally, we quickly found (and confirmed by reading the source for Credential, that each header construction invokes the get token method. So, internally we've tried adding to the AzureAuthTokenCredential a Mutex<Option<TokenCliResponse>> to cache the token in memory, and only proceed with calling azureauth if the token we have is valid for <= 2 minutes (which could be another ctor arg).

Calling AzureAuth can be expensive (300-1000ms depending on what's going on under the hood). So caching this will be important for performance in developer facing scenarios, which is exactly where AzureAuth is designed to be used :).

johnbatty · 2023-11-22T08:22:11Z

@kyle-rader-msft Regarding token caching, there's an existing wrapper for this - see AutoRefreshingTokenCredential.

See my azure_devops_rust_api example code for typical usage.

This is clearly not a great situation, as it is too easy for people to use the existing credential providers with no caching. Ideally we would integrate the token caching into the credential providers so that it is done by default (which the other Azure SDKs seem to do).

I raised an issue about this earlier this year, but have not yet had a chance to implement it:
#1228

One further snippet on token caching - we had an issue raised previously which observed that the token cache needs to be per-resource. I fixed this in AutoRefreshingTokenCredential, but worth being aware of it:
#1225

kyle-rader-msft

I think we still need 1 cfg on the broker mode (I could also see just leaving out the concept of modes and instead taking an arbitrary list of extra args to pass, so that as the args evolve over time this wrapper need not chance).

The other question I have is on the "resource" passed and it actually being a space separated list of scopes.

kyle-rader-msft · 2023-11-28T17:09:51Z

@johnbatty - Thank you for calling that out!!

demoray · 2023-11-28T17:33:45Z

I think we still need 1 cfg on the broker mode (I could also see just leaving out the concept of modes and instead taking an arbitrary list of extra args to pass, so that as the args evolve over time this wrapper need not chance).

The other question I have is on the "resource" passed and it actually being a space separated list of scopes.

kyle-rader-msft

👍 given impending follow up PR.

Functionality was placed behind a feature gate. utf8 encoding was verified.

cataggar · 2023-11-29T16:20:12Z

sdk/identity/Cargo.toml

@@ -50,6 +50,7 @@ development = []
 test_e2e = []
 client_certificate = ["openssl"]
 vendored_openssl = ["openssl/vendored"]
+azureauth-cli = []


nit: we use_ in the other features

Brian Caswell added 3 commits November 16, 2023 15:24

include setting the mode

7c192e8

fix lint issue from 1.74.0 in unrelated code

6a09a23

fix unit tests

7780f0e

demoray requested a review from johnbatty November 16, 2023 21:22

heaths previously requested changes Nov 16, 2023

View reviewed changes

sdk/identity/src/token_credentials/mod.rs Show resolved Hide resolved

sdk/identity/src/token_credentials/azureauth_cli_credentials.rs Show resolved Hide resolved

add aad subcommand

40c0186

kyle-rader-msft suggested changes Nov 16, 2023

View reviewed changes

IWA is only valid on windows

d8d1c77

demoray changed the title ~~Add support for authenticationg using azureauth cli~~ Add support for authenticating using azureauth cli Nov 17, 2023

wrap azureauth-cli in a feature

69eb5a5

demoray closed this Nov 17, 2023

demoray reopened this Nov 17, 2023

fix syntax

3d18828

demoray requested review from heaths and kyle-rader-msft November 17, 2023 21:36

kyle-rader-msft suggested changes Nov 20, 2023

View reviewed changes

Brian Caswell added 2 commits November 21, 2023 13:56

add support for prompt-hint

642ef26

use --scope instead of --resource

7b017d6

add prompt hint to default struct

54ae30f

kyle-rader-msft suggested changes Nov 28, 2023

View reviewed changes

demoray closed this Nov 28, 2023

demoray reopened this Nov 28, 2023

kyle-rader-msft approved these changes Nov 28, 2023

View reviewed changes

Brian Caswell added 2 commits November 28, 2023 12:47

only pass down windows auth modes when using azureauth.exe

7cf30e6

address clippy issue

7a52b53

cataggar approved these changes Nov 29, 2023

View reviewed changes

Brian Caswell added 3 commits November 29, 2023 11:25

Merge branch 'main' into add-azureauth-support

1e0ed15

address feedback

f11f043

Merge branch 'main' into add-azureauth-support

bd58766

demoray merged commit 88d55f4 into Azure:main Nov 29, 2023
19 checks passed

demoray deleted the add-azureauth-support branch November 29, 2023 17:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for authenticating using azureauth cli #1464

Add support for authenticating using azureauth cli #1464

demoray commented Nov 16, 2023

kyle-rader-msft left a comment

heaths commented Nov 17, 2023

kyle-rader-msft commented Nov 17, 2023 •

edited

demoray commented Nov 17, 2023

kyle-rader-msft left a comment

kyle-rader-msft Nov 20, 2023

kyle-rader-msft Nov 28, 2023

kyle-rader-msft Nov 20, 2023

kyle-rader-msft Nov 28, 2023 •

edited

demoray Nov 28, 2023

kyle-rader-msft Nov 28, 2023

kyle-rader-msft commented Nov 20, 2023 •

edited

kyle-rader-msft commented Nov 20, 2023

demoray commented Nov 21, 2023

kyle-rader-msft commented Nov 21, 2023

johnbatty commented Nov 22, 2023 •

edited

kyle-rader-msft left a comment

kyle-rader-msft commented Nov 28, 2023

demoray commented Nov 28, 2023

kyle-rader-msft left a comment

cataggar Nov 29, 2023

Add support for authenticating using azureauth cli #1464

Add support for authenticating using azureauth cli #1464

Conversation

demoray commented Nov 16, 2023

kyle-rader-msft left a comment

Choose a reason for hiding this comment

heaths commented Nov 17, 2023

kyle-rader-msft commented Nov 17, 2023 • edited

demoray commented Nov 17, 2023

kyle-rader-msft left a comment

Choose a reason for hiding this comment

kyle-rader-msft Nov 20, 2023

Choose a reason for hiding this comment

kyle-rader-msft Nov 28, 2023

Choose a reason for hiding this comment

kyle-rader-msft Nov 20, 2023

Choose a reason for hiding this comment

kyle-rader-msft Nov 28, 2023 • edited

Choose a reason for hiding this comment

demoray Nov 28, 2023

Choose a reason for hiding this comment

kyle-rader-msft Nov 28, 2023

Choose a reason for hiding this comment

kyle-rader-msft commented Nov 20, 2023 • edited

kyle-rader-msft commented Nov 20, 2023

demoray commented Nov 21, 2023

kyle-rader-msft commented Nov 21, 2023

johnbatty commented Nov 22, 2023 • edited

kyle-rader-msft left a comment

Choose a reason for hiding this comment

kyle-rader-msft commented Nov 28, 2023

demoray commented Nov 28, 2023

kyle-rader-msft left a comment

Choose a reason for hiding this comment

cataggar Nov 29, 2023

Choose a reason for hiding this comment

kyle-rader-msft commented Nov 17, 2023 •

edited

kyle-rader-msft Nov 28, 2023 •

edited

kyle-rader-msft commented Nov 20, 2023 •

edited

johnbatty commented Nov 22, 2023 •

edited