Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .openpublishing.publish.config.json
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
"moniker_ranges": [],
"open_to_public_contributors": false,
"type_mapping": {
"ZonePivotGroups": "Toc",
"Conceptual": "Content",
"ManagedReference": "Content",
"RestApi": "Content",
Expand Down
10 changes: 4 additions & 6 deletions msal-python-conceptual/TOC.yml
Original file line number Diff line number Diff line change
@@ -1,11 +1,10 @@
- name: Getting started
- name: Overview of MSAL Python
href: index.md
- name: Get started
items:
- name: Register your app with Microsoft Entra ID
href: /azure/active-directory/develop/active-directory-integrating-applications
- name: Client applications
href: getting-started/client-applications.md
- name: Acquiring tokens
- name: Acquire tokens
href: getting-started/acquiring-tokens.md

- name: Advanced topics
Expand All @@ -22,12 +21,11 @@
href: advanced/conditional-access.md
- name: Token cache serialization
href: advanced/msal-python-token-cache-serialization.md
- name: Developing an Azure AD B2C app with MSAL Python
- name: Develop an Azure AD B2C app with MSAL Python
href: advanced/aad-b2c.md
- name: Active Directory Federation Services (ADFS) Support
href: advanced/msal-python-adfs-support.md
- name: National clouds
href: /azure/active-directory/develop/msal-national-cloud?tabs=python
- name: Username and password authentication
href: advanced/username-password-authentication.md
- name: How to generate secret and/or certificate for Confidential Client
Expand Down
10 changes: 9 additions & 1 deletion msal-python-conceptual/advanced/aad-b2c.md
Original file line number Diff line number Diff line change
@@ -1,11 +1,19 @@
---
title: Use MSAL Python to work with Azure AD B2C
description: "You can use MSAL Python to sign-in users with social identities, acquire tokens, and customize the sign-in experience by using Azure AD B2C."
author: Dickson-Mwendia
manager: CelesteDG

ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
---

# Use MSAL Python to work with Azure AD B2C

## Summary

You can use MSAL Python to sign-in users with social identities, acquire tokens, and customize the sign-in experience by using [Azure AD B2C](https://aka.ms/aadb2c).

Expand Down
9 changes: 9 additions & 0 deletions msal-python-conceptual/advanced/best-practices.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
---
title: Best practices for a robust enterprise ready application
description: "You've seen that with MSAL Python you can quite simply acquire a token for a protected Web API. You also don't have to handle refreshing tokens yourself. However, to build robust, enterprise ready applications, you will need to do a bit more."
author: Dickson-Mwendia
manager: CelesteDG

ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
---

# Best practices for a robust enterprise ready application
Expand Down
9 changes: 9 additions & 0 deletions msal-python-conceptual/advanced/client-capabilities.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
---
title: Client capabilities
description: "The Microsoft Entra service provides features and policies which are applicable in certain scenarios, such as conditional access policies."
author: Dickson-Mwendia
manager: CelesteDG

ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
---

# Client capabilities
Expand Down
9 changes: 9 additions & 0 deletions msal-python-conceptual/advanced/client-credentials.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
---
title: Client credentials
description: There are two types of client credentials in MSAL Python - application secrets and certificates.
author: Dickson-Mwendia
manager: CelesteDG

ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
---

# Client credentials
Expand Down
9 changes: 9 additions & 0 deletions msal-python-conceptual/advanced/conditional-access.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
---
title: Conditional access and claims challenges
description: "When getting tokens silently, your application may receive errors when a Conditional Access claims challenge, such as MFA polic, is required by an API you're trying to access."
author: Dickson-Mwendia
manager: CelesteDG

ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
---

# Conditional access and claims challenges
Expand Down
9 changes: 9 additions & 0 deletions msal-python-conceptual/advanced/instance-metadata-caching.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
---
title: Instance metadata caching
description: "Every developer wants their program to run faster. In this article, we are going to show you how you can add a one-liner to make your MSAL Python powered app to acquire a token roughly 1.5x to 2x faster!"
author: Dickson-Mwendia
manager: CelesteDG

ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
---

# Instance metadata caching
Expand Down
9 changes: 9 additions & 0 deletions msal-python-conceptual/advanced/logging.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
---
title: Logging
description: "Logging in MSAL Python is designed to use the standard Python logging mechanisms, so all your previous knowledge of Python logging applies to MSAL Python."
author: Dickson-Mwendia
manager: CelesteDG

ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
---

# Logging
Expand Down
9 changes: 9 additions & 0 deletions msal-python-conceptual/advanced/migrate-python-adal-msal.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
---
title: Python ADAL to MSAL migration guide
description: Learn how to migrate your Azure Active Directory Authentication Library (ADAL) Python app to the Microsoft Authentication Library (MSAL) for Python.
author: Dickson-Mwendia
manager: CelesteDG

ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
---

# ADAL to MSAL migration guide for Python
Expand Down
9 changes: 9 additions & 0 deletions msal-python-conceptual/advanced/migrate.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
---
title: Migrate existing Refresh Tokens into MSAL Python
description: "MSAL is not a low-level OAuth2 library. MSAL wraps and hides the concept of Refresh Token (RT) away from you."
author: Dickson-Mwendia
manager: CelesteDG

ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
---

# Migrate existing Refresh Tokens into MSAL Python
Expand Down
9 changes: 9 additions & 0 deletions msal-python-conceptual/advanced/msal-error-handling-python.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
---
title: Handle errors and exceptions in MSAL for Python
description: Learn how to handle errors and exceptions, Conditional Access claims challenges, and retries in MSAL for Python applications.
author: Dickson-Mwendia
manager: CelesteDG

ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
---

# Handle errors and exceptions in MSAL for Python
Expand Down
9 changes: 9 additions & 0 deletions msal-python-conceptual/advanced/msal-logging-python.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
---
title: Logging errors and exceptions in MSAL for Python
description: Learn how to log errors and exceptions in MSAL for Python
author: Dickson-Mwendia
manager: CelesteDG

ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
---

# Logging in MSAL for Python
Expand Down
9 changes: 9 additions & 0 deletions msal-python-conceptual/advanced/msal-python-adfs-support.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
---
title: Azure AD FS support (MSAL Python)
description: Learn about Active Directory Federation Services (AD FS) support in the Microsoft Authentication Library for Python
author: Dickson-Mwendia
manager: CelesteDG

ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
---

# Active Directory Federation Services support in MSAL for Python
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
---
title: Custom token cache serialization (MSAL Python)
description: Learn how to serialize token cache using MSAL for Python
author: Dickson-Mwendia
manager: CelesteDG

ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
---

# Custom token cache serialization in MSAL for Python
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
---
title: Username and password authentication
description: "By design and policy, the username/password authentication works only for Work and school accounts, but not for Microsoft Accounts (MSA)."
author: Dickson-Mwendia
manager: CelesteDG

ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
---

# Username and password authentication
Expand Down
9 changes: 9 additions & 0 deletions msal-python-conceptual/advanced/wam.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
---
title: Using MSAL Python with Web Account Manager
description: "If you are building a Windows application, you might consider simplifying how users authenticate with the help of an authentication broker - the Web Account Manager."
author: Dickson-Mwendia
manager: CelesteDG

ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
---

# Using MSAL Python with Web Account Manager
Expand Down
4 changes: 2 additions & 2 deletions msal-python-conceptual/breadcrumb/toc.yml
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
- name: Docs
tocHref: /
topicHref: /
tocHref: /Learn/Microsoft Entra/MSAL
topicHref: /Learn/Microsoft Entra/MSAL
16 changes: 6 additions & 10 deletions msal-python-conceptual/docfx.json
Original file line number Diff line number Diff line change
Expand Up @@ -54,17 +54,13 @@
]
},
"fileMetadata": {
"author": {
"*.md": "localden",
"*/**.md": "localden"
},
"ms.author": {
"*.md": "ddelimarsky",
"*/**.md": "ddelimarsky"
},
"ms.service": {
"*.md": "active-directory",
"*/**.md": "active-directory"
"*.md": "msal",
"*/**.md": "msal"
},
"ms.subservice": {
"*.md": "msal-python",
"*/**.md": "msal-python"
},
"titleSuffix": {
"*.md": "Microsoft Authentication Library for Python",
Expand Down
22 changes: 20 additions & 2 deletions msal-python-conceptual/getting-started/acquiring-tokens.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
---
title: Acquiring tokens
description: "There are many ways of acquiring a token. Some require user interaction through a web browser. Some don't require any user interaction."
title: Acquire tokens for your app
description: Learn how to acquire tokens for your Python appliccation. You can acquire tokens silently or interactively through a web browser.
author: Dickson-Mwendia
manager: CelesteDG
ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
zone_pivot_groups: msal-python-acquire-token
---

# Acquiring tokens
Expand All @@ -15,6 +24,9 @@ Before acquiring tokens with MSAL Python, make sure to instantiate a [client app

The approach to acquiring a token is different depending on the application type - public client applications (desktop and mobile) or confidential client application (web app, web API, or a daemon application like a Windows service). Each of the individual approaches is described below.


:::zone pivot="pca"

### Public client applications

Public client applications cannot securely store a secret and can _only_ authenticate the user that is interacting with the product. MSAL Python exposes most of the token acquisition logic for public applications through [`PublicClientApplication`](xref:msal.application.PublicClientApplication). Using this class enables developers to:
Expand All @@ -23,6 +35,10 @@ Public client applications cannot securely store a secret and can _only_ authent
- It's also possible (but not recommended) to get a token with a [username and password](/azure/active-directory/develop/scenario-desktop-acquire-token?tabs=python#username--password).
- For applications running on devices which don't have a web browser, it's possible to acquire a token through the [device code flow](/azure/active-directory/develop/scenario-desktop-acquire-token?tabs=python#command-line-tool-without-web-browser), which provides the user with a URL and a code. The user goes to a web browser on another device, enters the code and signs in. On successful authentication, Microsoft Entra ID will return a token to the browser-less device.

:::zone-end

:::zone pivot="cca"

### Confidential client applications

Confidential client applications can securely store a secret and can authenticate both on behalf of an application as well as on behalf of a given user. With MSAL Python, developers can use [`ConfidentialClientApplication`](xref:msal.application.ConfidentialClientApplication) to access confidential client application capabilities, such as:
Expand All @@ -31,6 +47,8 @@ Confidential client applications can securely store a secret and can authenticat
- In the case of web Apps or web APIs **calling another downstream Web API in the name of the user**, use the [On Behalf Of flow](/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow) to acquire a token based on a user assertion (e.g., SAML, JWT).
- **For Web apps authenticating in the name of a user**, acquire tokens through [authorization code](/azure/active-directory/develop/scenario-web-app-call-api-acquire-token?tabs=python) after letting the user sign-in through the authorization request URL. This is typically the mechanism used by an application which lets the user sign-in using OpenID Connect but then wants to access Web APIs for this particular user.

:::zone-end

## MSAL Python token caching

Both public and confidential client applications support token caching, handled direclt by MSAL Python. Applications should try to get a token from the cache first before relying on any other means. Take a look at the [recommended token acquisition pattern](/azure/active-directory/develop/scenario-desktop-acquire-token?tabs=python) to learn more.
Expand Down
9 changes: 9 additions & 0 deletions msal-python-conceptual/getting-started/client-applications.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
---
title: Client applications
description: "How to instantiate client applications in MSAL Python."
author: Dickson-Mwendia
manager: CelesteDG

ms.service: msal
ms.subservice: msal-python
ms.topic: conceptual
ms.date: 02/07/2024
ms.author: dmwendia
ms.reviewer: shermanouko, rayluo
---

# Client applications
Expand Down
Loading