Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Identity] DefaultAzureCredential should properly handle the managedldentityClientId optional parameter #13973

Merged
4 commits merged into from
Feb 26, 2021
Merged

[Identity] DefaultAzureCredential should properly handle the managedldentityClientId optional parameter #13973

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
fd6cf14
[Identity] DefaultAzureCredential should properly handle the managedI…
sadasant Feb 25, 2021
3a9d020
Addressing Schaabs feedback
sadasant Feb 26, 2021
9ba84a4
changelog entry
sadasant Feb 26, 2021
19e1717
Merge remote-tracking branch 'Azure/master' into identity/fix13872
sadasant Feb 26, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 10 additions & 6 deletions sdk/identity/identity/src/credentials/defaultAzureCredential.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,15 +42,19 @@ export class DefaultAzureCredential extends ChainedTokenCredential {
constructor(tokenCredentialOptions?: DefaultAzureCredentialOptions) {
const credentials = [];
credentials.push(new EnvironmentCredential(tokenCredentialOptions));
credentials.push(new ManagedIdentityCredential(tokenCredentialOptions));
if (process.env.AZURE_CLIENT_ID) {

// In case a user assigned ID has been provided.
const managedIdentityClientId =
tokenCredentialOptions?.managedIdentityClientId || process.env.AZURE_CLIENT_ID;
if (managedIdentityClientId) {
credentials.push(
new ManagedIdentityCredential(
tokenCredentialOptions?.managedIdentityClientId || process.env.AZURE_CLIENT_ID,
tokenCredentialOptions
)
new ManagedIdentityCredential(managedIdentityClientId, tokenCredentialOptions)
);
}

// In case the user provided ID doesn't work, but the system assigned ID works.
credentials.push(new ManagedIdentityCredential(tokenCredentialOptions));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does the ordering of credentials in the chain matters? If so, it does look to me like we flipped the order here - is that on purpose?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Before, system managed credential had higher priority than user managed credential. I'll confirm with Scott if this is ok!

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@schaabs should user managed identities have preference over system managed identities?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If a user assigned client id is specified either through the managedIdentityClientId option or through the AZURE_CLIENT_ID environment variable we should ONLY give back token for the user assigned identity. In other words we shoudln't be adding both the credentials to the chain, the secon should only be added in an else clause.

    if (managedIdentityClientId) {
      credentials.push(
        new ManagedIdentityCredential(managedIdentityClientId, tokenCredentialOptions)
      );
    } else {
       credentials.push(new ManagedIdentityCredential(tokenCredentialOptions));
    }


credentials.push(new AzureCliCredential());
credentials.push(new VisualStudioCodeCredential(tokenCredentialOptions));

Expand Down