diff --git a/sdk/identity/azure-identity/CHANGELOG.md b/sdk/identity/azure-identity/CHANGELOG.md index 7f18ff06dbc3..77986a48a14a 100644 --- a/sdk/identity/azure-identity/CHANGELOG.md +++ b/sdk/identity/azure-identity/CHANGELOG.md @@ -5,6 +5,22 @@ `AZURE_CLIENT_ID` to configure a user-assigned managed identity. ([#10931](https://github.com/Azure/azure-sdk-for-python/issues/10931)) +### Breaking Changes +- Removed application authentication APIs added in 1.4.0 beta versions. These + will be reintroduced in 1.5.0b1. Passing the keyword arguments below + generally won't cause a runtime error, but the arguments have no effect. + - Removed `authenticate` method from `DeviceCodeCredential`, + `InteractiveBrowserCredential`, and `UsernamePasswordCredential` + - Removed `allow_unencrypted_cache` and `enable_persistent_cache` keyword + arguments from `CertificateCredential`, `ClientSecretCredential`, + `DeviceCodeCredential`, `InteractiveBrowserCredential`, and + `UsernamePasswordCredential` + - Removed `disable_automatic_authentication` keyword argument from + `DeviceCodeCredential` and `InteractiveBrowserCredential` + - Removed `allow_unencrypted_cache` keyword argument from + `SharedTokenCacheCredential` + - Removed classes `AuthenticationRecord` and `AuthenticationRequiredError` + - Removed `identity_config` keyword argument from `ManagedIdentityCredential` ## 1.4.0b7 (2020-07-22) - `DefaultAzureCredential` has a new optional keyword argument, diff --git a/sdk/identity/azure-identity/MANIFEST.in b/sdk/identity/azure-identity/MANIFEST.in index 07b576fc0eb3..3eee8c39c7a7 100644 --- a/sdk/identity/azure-identity/MANIFEST.in +++ b/sdk/identity/azure-identity/MANIFEST.in @@ -1,4 +1,3 @@ -recursive-include samples *.py recursive-include tests *.py include *.md include azure/__init__.py diff --git a/sdk/identity/azure-identity/azure/identity/__init__.py b/sdk/identity/azure-identity/azure/identity/__init__.py index 2e3f9d639a24..dc29e2cffdc0 100644 --- a/sdk/identity/azure-identity/azure/identity/__init__.py +++ b/sdk/identity/azure-identity/azure/identity/__init__.py @@ -4,8 +4,7 @@ # ------------------------------------ """Credentials for Azure SDK clients.""" -from ._auth_record import AuthenticationRecord -from ._exceptions import AuthenticationRequiredError, CredentialUnavailableError +from ._exceptions import CredentialUnavailableError from ._constants import AzureAuthorityHosts, KnownAuthorities from ._credentials import ( AzureCliCredential, @@ -25,8 +24,6 @@ __all__ = [ - "AuthenticationRecord", - "AuthenticationRequiredError", "AuthorizationCodeCredential", "AzureAuthorityHosts", "AzureCliCredential", diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/browser.py b/sdk/identity/azure-identity/azure/identity/_credentials/browser.py index cf860f5b39f1..2726c425074a 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/browser.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/browser.py @@ -36,13 +36,6 @@ class InteractiveBrowserCredential(InteractiveCredential): authenticate work or school accounts. :keyword str client_id: Client ID of the Azure Active Directory application users will sign in to. If unspecified, the Azure CLI's ID will be used. - :keyword AuthenticationRecord authentication_record: :class:`AuthenticationRecord` returned by :func:`authenticate` - :keyword bool disable_automatic_authentication: if True, :func:`get_token` will raise - :class:`AuthenticationRequiredError` when user interaction is required to acquire a token. Defaults to False. - :keyword bool enable_persistent_cache: if True, the credential will store tokens in a persistent cache shared by - other user credentials. Defaults to False. - :keyword bool allow_unencrypted_cache: if True, the credential will fall back to a plaintext cache on platforms - where encryption is unavailable. Default to False. Has no effect when `enable_persistent_cache` is False. :keyword int timeout: seconds to wait for the user to complete authentication. Defaults to 300 (5 minutes). """ diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py b/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py index 35c81b2e3da5..8ae461c8ef78 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py @@ -25,10 +25,6 @@ class CertificateCredential(CertificateCredentialBase): :keyword password: The certificate's password. If a unicode string, it will be encoded as UTF-8. If the certificate requires a different encoding, pass appropriately encoded bytes instead. :paramtype password: str or bytes - :keyword bool enable_persistent_cache: if True, the credential will store tokens in a persistent cache. Defaults to - False. - :keyword bool allow_unencrypted_cache: if True, the credential will fall back to a plaintext cache when encryption - is unavailable. Default to False. Has no effect when `enable_persistent_cache` is False. """ @log_get_token("CertificateCredential") diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py b/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py index a327416cd731..54bce366781a 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py @@ -26,10 +26,6 @@ class ClientSecretCredential(ClientSecretCredentialBase): :keyword str authority: Authority of an Azure Active Directory endpoint, for example 'login.microsoftonline.com', the authority for Azure Public Cloud (which is the default). :class:`~azure.identity.AzureAuthorityHosts` defines authorities for other clouds. - :keyword bool enable_persistent_cache: if True, the credential will store tokens in a persistent cache. Defaults to - False. - :keyword bool allow_unencrypted_cache: if True, the credential will fall back to a plaintext cache when encryption - is unavailable. Default to False. Has no effect when `enable_persistent_cache` is False. """ @log_get_token("ClientSecretCredential") diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/device_code.py b/sdk/identity/azure-identity/azure/identity/_credentials/device_code.py index 87fc9e738a31..37278c2a7a16 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/device_code.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/device_code.py @@ -46,13 +46,6 @@ class DeviceCodeCredential(InteractiveCredential): - ``expires_on`` (datetime.datetime) the UTC time at which the code will expire If this argument isn't provided, the credential will print instructions to stdout. :paramtype prompt_callback: Callable[str, str, ~datetime.datetime] - :keyword AuthenticationRecord authentication_record: :class:`AuthenticationRecord` returned by :func:`authenticate` - :keyword bool disable_automatic_authentication: if True, :func:`get_token` will raise - :class:`AuthenticationRequiredError` when user interaction is required to acquire a token. Defaults to False. - :keyword bool enable_persistent_cache: if True, the credential will store tokens in a persistent cache shared by - other user credentials. Defaults to False. - :keyword bool allow_unencrypted_cache: if True, the credential will fall back to a plaintext cache on platforms - where encryption is unavailable. Default to False. Has no effect when `enable_persistent_cache` is False. """ def __init__(self, client_id, **kwargs): diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/managed_identity.py b/sdk/identity/azure-identity/azure/identity/_credentials/managed_identity.py index 8bdd46f5cba9..1205b1a083db 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/managed_identity.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/managed_identity.py @@ -44,10 +44,6 @@ class ManagedIdentityCredential(object): the keyword arguments. :keyword str client_id: a user-assigned identity's client ID. This is supported in all hosting environments. - :keyword identity_config: a mapping ``{parameter_name: value}`` specifying a user-assigned identity by its object - or resource ID, for example ``{"object_id": "..."}``. Check the documentation for your hosting environment to - learn what values it expects. - :paramtype identity_config: Mapping[str, str] """ def __init__(self, **kwargs): @@ -80,7 +76,7 @@ def get_token(self, *scopes, **kwargs): class _ManagedIdentityBase(object): def __init__(self, endpoint, client_cls, config=None, client_id=None, **kwargs): # type: (str, Type, Optional[Configuration], Optional[str], **Any) -> None - self._identity_config = kwargs.pop("identity_config", None) or {} + self._identity_config = kwargs.pop("_identity_config", None) or {} if client_id: if os.environ.get(EnvironmentVariables.MSI_ENDPOINT) and os.environ.get(EnvironmentVariables.MSI_SECRET): # App Service: version 2017-09-1 accepts client ID as parameter "clientid" diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/shared_cache.py b/sdk/identity/azure-identity/azure/identity/_credentials/shared_cache.py index 741dcc30bf03..59aa7728a8a2 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/shared_cache.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/shared_cache.py @@ -31,10 +31,6 @@ class SharedTokenCacheCredential(SharedTokenCacheBase): defines authorities for other clouds. :keyword str tenant_id: an Azure Active Directory tenant ID. Used to select an account when the cache contains tokens for multiple identities. - :keyword AuthenticationRecord authentication_record: an authentication record returned by a user credential such as - :class:`DeviceCodeCredential` or :class:`InteractiveBrowserCredential` - :keyword bool allow_unencrypted_cache: if True, the credential will fall back to a plaintext cache when encryption - is unavailable. Defaults to False. """ @log_get_token("SharedTokenCacheCredential") diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py b/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py index 1c6c1b3561d6..a5636855a6e1 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py @@ -33,10 +33,6 @@ class UsernamePasswordCredential(InteractiveCredential): defines authorities for other clouds. :keyword str tenant_id: tenant ID or a domain associated with a tenant. If not provided, defaults to the 'organizations' tenant, which supports only Azure Active Directory work or school accounts. - :keyword bool enable_persistent_cache: if True, the credential will store tokens in a persistent cache shared by - other user credentials. Defaults to False. - :keyword bool allow_unencrypted_cache: if True, the credential will fall back to a plaintext cache on platforms - where encryption is unavailable. Default to False. Has no effect when `enable_persistent_cache` is False. """ def __init__(self, client_id, username, password, **kwargs): @@ -46,7 +42,7 @@ def __init__(self, client_id, username, password, **kwargs): # first time it's asked for a token. However, we want to ensure this first authentication is not silent, to # validate the given password. This class therefore doesn't document the authentication_record argument, and we # discard it here. - kwargs.pop("authentication_record", None) + kwargs.pop("_authentication_record", None) super(UsernamePasswordCredential, self).__init__(client_id=client_id, **kwargs) self._username = username self._password = password diff --git a/sdk/identity/azure-identity/azure/identity/_internal/certificate_credential_base.py b/sdk/identity/azure-identity/azure/identity/_internal/certificate_credential_base.py index c13fe86d7a29..e799bce87adf 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/certificate_credential_base.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/certificate_credential_base.py @@ -44,9 +44,9 @@ def __init__(self, tenant_id, client_id, certificate_path, **kwargs): self._certificate = AadClientCertificate(pem_bytes, password=password) - enable_persistent_cache = kwargs.pop("enable_persistent_cache", False) + enable_persistent_cache = kwargs.pop("_enable_persistent_cache", False) if enable_persistent_cache: - allow_unencrypted = kwargs.pop("allow_unencrypted_cache", False) + allow_unencrypted = kwargs.pop("_allow_unencrypted_cache", False) cache = load_service_principal_cache(allow_unencrypted) else: cache = TokenCache() diff --git a/sdk/identity/azure-identity/azure/identity/_internal/client_secret_credential_base.py b/sdk/identity/azure-identity/azure/identity/_internal/client_secret_credential_base.py index 4854a396e84f..a8b0a1fdc4ce 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/client_secret_credential_base.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/client_secret_credential_base.py @@ -31,9 +31,9 @@ def __init__(self, tenant_id, client_id, client_secret, **kwargs): "tenant_id should be an Azure Active Directory tenant's id (also called its 'directory id')" ) - enable_persistent_cache = kwargs.pop("enable_persistent_cache", False) + enable_persistent_cache = kwargs.pop("_enable_persistent_cache", False) if enable_persistent_cache: - allow_unencrypted = kwargs.pop("allow_unencrypted_cache", False) + allow_unencrypted = kwargs.pop("_allow_unencrypted_cache", False) cache = load_service_principal_cache(allow_unencrypted) else: cache = TokenCache() diff --git a/sdk/identity/azure-identity/azure/identity/_internal/interactive.py b/sdk/identity/azure-identity/azure/identity/_internal/interactive.py index 4e226bc0c357..466c849f069b 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/interactive.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/interactive.py @@ -71,8 +71,8 @@ def _build_auth_record(response): class InteractiveCredential(MsalCredential): def __init__(self, **kwargs): - self._disable_automatic_authentication = kwargs.pop("disable_automatic_authentication", False) - self._auth_record = kwargs.pop("authentication_record", None) # type: Optional[AuthenticationRecord] + self._disable_automatic_authentication = kwargs.pop("_disable_automatic_authentication", False) + self._auth_record = kwargs.pop("_authentication_record", None) # type: Optional[AuthenticationRecord] if self._auth_record: kwargs.pop("client_id", None) # authentication_record overrides client_id argument tenant_id = kwargs.pop("tenant_id", None) or self._auth_record.tenant_id @@ -97,8 +97,6 @@ def get_token(self, *scopes, **kwargs): required data, state, or platform support :raises ~azure.core.exceptions.ClientAuthenticationError: authentication failed. The error's ``message`` attribute gives a reason. - :raises AuthenticationRequiredError: user interaction is necessary to acquire a token, and the credential is - configured not to begin this automatically. Call :func:`authenticate` to begin interactive authentication. """ if not scopes: message = "'get_token' requires at least one scope" @@ -140,7 +138,7 @@ def get_token(self, *scopes, **kwargs): _LOGGER.info("%s.get_token succeeded", self.__class__.__name__) return AccessToken(result["access_token"], now + int(result["expires_in"])) - def authenticate(self, **kwargs): + def _authenticate(self, **kwargs): # type: (**Any) -> AuthenticationRecord """Interactively authenticate a user. diff --git a/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py b/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py index fd5034acd4bb..65b8e6efaf83 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py @@ -40,8 +40,8 @@ def __init__(self, client_id, client_credential=None, **kwargs): self._cache = kwargs.pop("_cache", None) # internal, for use in tests if not self._cache: - if kwargs.pop("enable_persistent_cache", False): - allow_unencrypted = kwargs.pop("allow_unencrypted_cache", False) + if kwargs.pop("_enable_persistent_cache", False): + allow_unencrypted = kwargs.pop("_allow_unencrypted_cache", False) self._cache = load_user_cache(allow_unencrypted) else: self._cache = msal.TokenCache() diff --git a/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py b/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py index d28a7602fd5e..865ccf5e2273 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py @@ -30,7 +30,7 @@ # pylint:disable=unused-import,ungrouped-imports from typing import Any, Iterable, List, Mapping, Optional from .._internal import AadClientBase - from azure.identity import AuthenticationRecord + from azure.identity._auth_record import AuthenticationRecord CacheItem = Mapping[str, str] @@ -90,7 +90,7 @@ class SharedTokenCacheBase(ABC): def __init__(self, username=None, **kwargs): # pylint:disable=unused-argument # type: (Optional[str], **Any) -> None - self._auth_record = kwargs.pop("authentication_record", None) # type: Optional[AuthenticationRecord] + self._auth_record = kwargs.pop("_authentication_record", None) # type: Optional[AuthenticationRecord] if self._auth_record: # authenticate in the tenant that produced the record unless 'tenant_id' specifies another authenticating_tenant = kwargs.pop("tenant_id", None) or self._auth_record.tenant_id @@ -118,7 +118,7 @@ def _initialize(self): return if not self._cache and self.supported(): - allow_unencrypted = self._client_kwargs.get("allow_unencrypted_cache", False) + allow_unencrypted = self._client_kwargs.get("_allow_unencrypted_cache", True) try: self._cache = load_user_cache(allow_unencrypted) except Exception: # pylint:disable=broad-except diff --git a/sdk/identity/azure-identity/azure/identity/aio/_credentials/client_secret.py b/sdk/identity/azure-identity/azure/identity/aio/_credentials/client_secret.py index bbc0aa98e472..0f8c40cd1db4 100644 --- a/sdk/identity/azure-identity/azure/identity/aio/_credentials/client_secret.py +++ b/sdk/identity/azure-identity/azure/identity/aio/_credentials/client_secret.py @@ -24,10 +24,6 @@ class ClientSecretCredential(AsyncCredentialBase, ClientSecretCredentialBase): :keyword str authority: Authority of an Azure Active Directory endpoint, for example 'login.microsoftonline.com', the authority for Azure Public Cloud (which is the default). :class:`~azure.identity.AzureAuthorityHosts` defines authorities for other clouds. - :keyword bool enable_persistent_cache: if True, the credential will store tokens in a persistent cache. Defaults to - False. - :keyword bool allow_unencrypted_cache: if True, the credential will fall back to a plaintext cache when encryption - is unavailable. Default to False. Has no effect when `enable_persistent_cache` is False. """ async def __aenter__(self): diff --git a/sdk/identity/azure-identity/azure/identity/aio/_credentials/managed_identity.py b/sdk/identity/azure-identity/azure/identity/aio/_credentials/managed_identity.py index 7def20143526..c3b5a9520908 100644 --- a/sdk/identity/azure-identity/azure/identity/aio/_credentials/managed_identity.py +++ b/sdk/identity/azure-identity/azure/identity/aio/_credentials/managed_identity.py @@ -32,10 +32,6 @@ class ManagedIdentityCredential(AsyncCredentialBase): the keyword arguments. :keyword str client_id: a user-assigned identity's client ID. This is supported in all hosting environments. - :keyword identity_config: a mapping ``{parameter_name: value}`` specifying a user-assigned identity by its object - or resource ID, for example ``{"object_id": "..."}``. Check the documentation for your hosting environment to - learn what values it expects. - :paramtype identity_config: Mapping[str, str] """ def __init__(self, **kwargs: "Any") -> None: diff --git a/sdk/identity/azure-identity/azure/identity/aio/_credentials/shared_cache.py b/sdk/identity/azure-identity/azure/identity/aio/_credentials/shared_cache.py index a737b8bcecfc..de2fd404fc77 100644 --- a/sdk/identity/azure-identity/azure/identity/aio/_credentials/shared_cache.py +++ b/sdk/identity/azure-identity/azure/identity/aio/_credentials/shared_cache.py @@ -29,10 +29,6 @@ class SharedTokenCacheCredential(SharedTokenCacheBase, AsyncCredentialBase): defines authorities for other clouds. :keyword str tenant_id: an Azure Active Directory tenant ID. Used to select an account when the cache contains tokens for multiple identities. - :keyword AuthenticationRecord authentication_record: an authentication record returned by a user credential such as - :class:`DeviceCodeCredential` or :class:`InteractiveBrowserCredential` - :keyword bool allow_unencrypted_cache: if True, the credential will fall back to a plaintext cache when encryption - is unavailable. Defaults to False. """ async def __aenter__(self): diff --git a/sdk/identity/azure-identity/samples/README.md b/sdk/identity/azure-identity/samples/README.md deleted file mode 100644 index 35a9cd502650..000000000000 --- a/sdk/identity/azure-identity/samples/README.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -page_type: sample -languages: - - python -products: - - azure - - azure-identity -urlFragment: identity-samples ---- - -# Azure Identity Library Python Samples - -## Prerequisites - -You must have an [Azure subscription](https://azure.microsoft.com/free) and an -[Azure Key Vault](https://azure.microsoft.com/en-us/services/key-vault/) to run -these samples. You can create a Key Vault in the -[Azure Portal](https://portal.azure.com/#create/Microsoft.KeyVault) or with the -[Azure CLI](https://docs.microsoft.com/en-us/azure/key-vault/secrets/quick-create-cli). - -Azure Key Vault is used only to demonstrate authentication. Azure Identity has -the same API for all compatible client libraries. - -## Setup - -To run these samples, first install the Azure Identity and Key Vault Secrets -client libraries: - -```commandline -pip install azure-identity azure-keyvault-secrets -``` - -## Contents -| File | Description | -|-------------|-------------| -| control_interactive_prompts.py | demonstrates controlling when interactive credentials prompt for user interaction | -| user_authentication.py | demonstrates user authentication API for applications | diff --git a/sdk/identity/azure-identity/samples/control_interactive_prompts.py b/sdk/identity/azure-identity/samples/control_interactive_prompts.py deleted file mode 100644 index 10dabf65e9d2..000000000000 --- a/sdk/identity/azure-identity/samples/control_interactive_prompts.py +++ /dev/null @@ -1,38 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -"""Demonstrates controlling the timing of interactive authentication using InteractiveBrowserCredential. - -DeviceCodeCredential supports the same API. -""" - -import os -import sys -from azure.identity import AuthenticationRequiredError, InteractiveBrowserCredential -from azure.keyvault.secrets import SecretClient - - -# This sample uses Key Vault only for demonstration. Any client accepting azure-identity credentials will work the same. -VAULT_URL = os.environ.get("VAULT_URL") -if not VAULT_URL: - print("This sample expects environment variable 'VAULT_URL' to be set with the URL of a Key Vault.") - sys.exit(1) - - -# If it's important for your application to prompt for authentication only at certain times, -# create the credential with disable_automatic_authentication=True. This configures the credential to raise -# when interactive authentication is required, instead of immediately beginning that authentication. -credential = InteractiveBrowserCredential(disable_automatic_authentication=True) -client = SecretClient(VAULT_URL, credential) - -try: - secret_names = [s.name for s in client.list_properties_of_secrets()] -except AuthenticationRequiredError as ex: - # Interactive authentication is necessary to authorize the client's request. The exception carries the - # requested authentication scopes. If you pass these to 'authenticate', it will cache an access token - # for those scopes. - credential.authenticate(scopes=ex.scopes) - -# the client operation should now succeed -secret_names = [s.name for s in client.list_properties_of_secrets()] diff --git a/sdk/identity/azure-identity/samples/user_authentication.py b/sdk/identity/azure-identity/samples/user_authentication.py deleted file mode 100644 index 2c21c2a44973..000000000000 --- a/sdk/identity/azure-identity/samples/user_authentication.py +++ /dev/null @@ -1,43 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -"""Demonstrates user authentication using InteractiveBrowserCredential. DeviceCodeCredential supports the same API.""" - -import os -import sys -from azure.identity import AuthenticationRecord, InteractiveBrowserCredential -from azure.keyvault.secrets import SecretClient - - -# This sample uses Key Vault only for demonstration. Any client accepting azure-identity credentials will work the same. -VAULT_URL = os.environ.get("VAULT_URL") -if not VAULT_URL: - print("This sample expects environment variable 'VAULT_URL' to be set with the URL of a Key Vault.") - sys.exit(1) - - -# Persistent caching is optional. By default, interactive credentials cache in memory only. -credential = InteractiveBrowserCredential(enable_persistent_cache=True) - -# The 'authenticate' method begins interactive authentication. Call it whenever it's convenient -# for your application to authenticate a user. It returns a record of the authentication. -record = credential.authenticate() - -# The record contains no authentication secrets. You can serialize it to JSON for storage. -record_json = record.serialize() - -# An authenticated credential is ready for use with a client. This request should succeed -# without prompting for authentication again. -client = SecretClient(VAULT_URL, credential) -secret_names = [s.name for s in client.list_properties_of_secrets()] - -# With persistent caching enabled, an authentication record stored by your application enables -# credentials to access data from past authentications. If the cache contains sufficient data, -# this eliminates the need for your application to prompt for authentication every time it runs. -deserialized_record = AuthenticationRecord.deserialize(record_json) -new_credential = InteractiveBrowserCredential(enable_persistent_cache=True, authentication_record=deserialized_record) - -# This request should also succeed without prompting for authentication. -client = SecretClient(VAULT_URL, new_credential) -secret_names = [s.name for s in client.list_properties_of_secrets()] diff --git a/sdk/identity/azure-identity/tests/test_auth_record.py b/sdk/identity/azure-identity/tests/test_auth_record.py index 5daef9c5dec4..5b4ec83d6da2 100644 --- a/sdk/identity/azure-identity/tests/test_auth_record.py +++ b/sdk/identity/azure-identity/tests/test_auth_record.py @@ -4,7 +4,7 @@ # ------------------------------------ import json -from azure.identity import AuthenticationRecord +from azure.identity._auth_record import AuthenticationRecord def test_serialization(): diff --git a/sdk/identity/azure-identity/tests/test_browser_credential.py b/sdk/identity/azure-identity/tests/test_browser_credential.py index e07c69f30396..c8d4e9e7fef2 100644 --- a/sdk/identity/azure-identity/tests/test_browser_credential.py +++ b/sdk/identity/azure-identity/tests/test_browser_credential.py @@ -10,7 +10,8 @@ from azure.core.exceptions import ClientAuthenticationError from azure.core.pipeline.policies import SansIOHTTPPolicy -from azure.identity import AuthenticationRequiredError, CredentialUnavailableError, InteractiveBrowserCredential +from azure.identity import CredentialUnavailableError, InteractiveBrowserCredential +from azure.identity._exceptions import AuthenticationRequiredError from azure.identity._internal import AuthCodeRedirectServer from azure.identity._internal.user_agent import USER_AGENT from msal import TokenCache @@ -81,7 +82,7 @@ def test_authenticate(): tenant_id=tenant_id, transport=transport, ) - record = credential.authenticate(scopes=(scope,)) + record = credential._authenticate(scopes=(scope,)) assert record.authority == environment assert record.home_account_id == object_id + "." + home_tenant @@ -100,7 +101,7 @@ def test_disable_automatic_authentication(): empty_cache = TokenCache() # empty cache makes silent auth impossible transport = Mock(send=Mock(side_effect=Exception("no request should be sent"))) credential = InteractiveBrowserCredential( - disable_automatic_authentication=True, transport=transport, _cache=empty_cache + _disable_automatic_authentication=True, transport=transport, _cache=empty_cache ) with patch(WEBBROWSER_OPEN, Mock(side_effect=Exception("credential shouldn't try interactive authentication"))): diff --git a/sdk/identity/azure-identity/tests/test_certificate_credential.py b/sdk/identity/azure-identity/tests/test_certificate_credential.py index af0eee63c580..1d0c332cf7f6 100644 --- a/sdk/identity/azure-identity/tests/test_certificate_credential.py +++ b/sdk/identity/azure-identity/tests/test_certificate_credential.py @@ -157,20 +157,20 @@ def test_enable_persistent_cache(cert_path, cert_password): CertificateCredential(*required_arguments, password=cert_password) # allowing an unencrypted cache doesn't count as opting in to the persistent cache - CertificateCredential(*required_arguments, password=cert_password, allow_unencrypted_cache=True) + CertificateCredential(*required_arguments, password=cert_password, _allow_unencrypted_cache=True) # keyword argument opts in to persistent cache with patch(persistent_cache + ".msal_extensions") as mock_extensions: - CertificateCredential(*required_arguments, password=cert_password, enable_persistent_cache=True) + CertificateCredential(*required_arguments, password=cert_password, _enable_persistent_cache=True) assert mock_extensions.PersistedTokenCache.call_count == 1 # opting in on an unsupported platform raises an exception with patch(persistent_cache + ".sys.platform", "commodore64"): with pytest.raises(NotImplementedError): - CertificateCredential(*required_arguments, password=cert_password, enable_persistent_cache=True) + CertificateCredential(*required_arguments, password=cert_password, _enable_persistent_cache=True) with pytest.raises(NotImplementedError): CertificateCredential( - *required_arguments, password=cert_password, enable_persistent_cache=True, allow_unencrypted_cache=True + *required_arguments, password=cert_password, _enable_persistent_cache=True, _allow_unencrypted_cache=True ) @@ -187,7 +187,7 @@ def test_persistent_cache_linux(mock_extensions, cert_path, cert_password): # the credential should prefer an encrypted cache even when the user allows an unencrypted one CertificateCredential( - *required_arguments, password=cert_password, enable_persistent_cache=True, allow_unencrypted_cache=True + *required_arguments, password=cert_password, _enable_persistent_cache=True, _allow_unencrypted_cache=True ) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.LibsecretPersistence) mock_extensions.PersistedTokenCache.reset_mock() @@ -197,10 +197,10 @@ def test_persistent_cache_linux(mock_extensions, cert_path, cert_password): # encryption unavailable, no opt in to unencrypted cache -> credential should raise with pytest.raises(ValueError): - CertificateCredential(*required_arguments, password=cert_password, enable_persistent_cache=True) + CertificateCredential(*required_arguments, password=cert_password, _enable_persistent_cache=True) CertificateCredential( - *required_arguments, password=cert_password, enable_persistent_cache=True, allow_unencrypted_cache=True + *required_arguments, password=cert_password, _enable_persistent_cache=True, _allow_unencrypted_cache=True ) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.FilePersistence) @@ -222,11 +222,11 @@ def test_persistent_cache_multiple_clients(cert_path, cert_password): with patch("azure.identity._internal.persistent_cache._load_persistent_cache") as mock_cache_loader: mock_cache_loader.return_value = Mock(wraps=cache) credential_a = CertificateCredential( - "tenant", "client-a", cert_path, password=cert_password, enable_persistent_cache=True, transport=transport_a + "tenant", "client-a", cert_path, password=cert_password, _enable_persistent_cache=True, transport=transport_a ) assert mock_cache_loader.call_count == 1, "credential should load the persistent cache" credential_b = CertificateCredential( - "tenant", "client-b", cert_path, password=cert_password, enable_persistent_cache=True, transport=transport_b + "tenant", "client-b", cert_path, password=cert_password, _enable_persistent_cache=True, transport=transport_b ) assert mock_cache_loader.call_count == 2, "credential should load the persistent cache" diff --git a/sdk/identity/azure-identity/tests/test_certificate_credential_async.py b/sdk/identity/azure-identity/tests/test_certificate_credential_async.py index 01d2839fc2cc..9d0f5a2e08cb 100644 --- a/sdk/identity/azure-identity/tests/test_certificate_credential_async.py +++ b/sdk/identity/azure-identity/tests/test_certificate_credential_async.py @@ -149,20 +149,20 @@ def test_enable_persistent_cache(cert_path, cert_password): CertificateCredential(*required_arguments, password=cert_password) # allowing an unencrypted cache doesn't count as opting in to the persistent cache - CertificateCredential(*required_arguments, password=cert_password, allow_unencrypted_cache=True) + CertificateCredential(*required_arguments, password=cert_password, _allow_unencrypted_cache=True) # keyword argument opts in to persistent cache with patch(persistent_cache + ".msal_extensions") as mock_extensions: - CertificateCredential(*required_arguments, password=cert_password, enable_persistent_cache=True) + CertificateCredential(*required_arguments, password=cert_password, _enable_persistent_cache=True) assert mock_extensions.PersistedTokenCache.call_count == 1 # opting in on an unsupported platform raises an exception with patch(persistent_cache + ".sys.platform", "commodore64"): with pytest.raises(NotImplementedError): - CertificateCredential(*required_arguments, password=cert_password, enable_persistent_cache=True) + CertificateCredential(*required_arguments, password=cert_password, _enable_persistent_cache=True) with pytest.raises(NotImplementedError): CertificateCredential( - *required_arguments, password=cert_password, enable_persistent_cache=True, allow_unencrypted_cache=True + *required_arguments, password=cert_password, _enable_persistent_cache=True, _allow_unencrypted_cache=True ) @@ -179,7 +179,7 @@ def test_persistent_cache_linux(mock_extensions, cert_path, cert_password): # the credential should prefer an encrypted cache even when the user allows an unencrypted one CertificateCredential( - *required_arguments, password=cert_password, enable_persistent_cache=True, allow_unencrypted_cache=True + *required_arguments, password=cert_password, _enable_persistent_cache=True, _allow_unencrypted_cache=True ) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.LibsecretPersistence) mock_extensions.PersistedTokenCache.reset_mock() @@ -189,10 +189,10 @@ def test_persistent_cache_linux(mock_extensions, cert_path, cert_password): # encryption unavailable, no opt in to unencrypted cache -> credential should raise with pytest.raises(ValueError): - CertificateCredential(*required_arguments, password=cert_password, enable_persistent_cache=True) + CertificateCredential(*required_arguments, password=cert_password, _enable_persistent_cache=True) CertificateCredential( - *required_arguments, password=cert_password, enable_persistent_cache=True, allow_unencrypted_cache=True + *required_arguments, password=cert_password, _enable_persistent_cache=True, _allow_unencrypted_cache=True ) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.FilePersistence) @@ -215,11 +215,11 @@ async def test_persistent_cache_multiple_clients(cert_path, cert_password): with patch("azure.identity._internal.persistent_cache._load_persistent_cache") as mock_cache_loader: mock_cache_loader.return_value = Mock(wraps=cache) credential_a = CertificateCredential( - "tenant", "client-a", cert_path, password=cert_password, enable_persistent_cache=True, transport=transport_a + "tenant", "client-a", cert_path, password=cert_password, _enable_persistent_cache=True, transport=transport_a ) assert mock_cache_loader.call_count == 1, "credential should load the persistent cache" credential_b = CertificateCredential( - "tenant", "client-b", cert_path, password=cert_password, enable_persistent_cache=True, transport=transport_b + "tenant", "client-b", cert_path, password=cert_password, _enable_persistent_cache=True, transport=transport_b ) assert mock_cache_loader.call_count == 2, "credential should load the persistent cache" diff --git a/sdk/identity/azure-identity/tests/test_client_secret_credential.py b/sdk/identity/azure-identity/tests/test_client_secret_credential.py index ea3362a3f0ff..542ea203fe10 100644 --- a/sdk/identity/azure-identity/tests/test_client_secret_credential.py +++ b/sdk/identity/azure-identity/tests/test_client_secret_credential.py @@ -158,19 +158,19 @@ def test_enable_persistent_cache(): ClientSecretCredential(*required_arguments) # allowing an unencrypted cache doesn't count as opting in to the persistent cache - ClientSecretCredential(*required_arguments, allow_unencrypted_cache=True) + ClientSecretCredential(*required_arguments, _allow_unencrypted_cache=True) # keyword argument opts in to persistent cache with patch(persistent_cache + ".msal_extensions") as mock_extensions: - ClientSecretCredential(*required_arguments, enable_persistent_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True) assert mock_extensions.PersistedTokenCache.call_count == 1 # opting in on an unsupported platform raises an exception with patch(persistent_cache + ".sys.platform", "commodore64"): with pytest.raises(NotImplementedError): - ClientSecretCredential(*required_arguments, enable_persistent_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True) with pytest.raises(NotImplementedError): - ClientSecretCredential(*required_arguments, enable_persistent_cache=True, allow_unencrypted_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True, _allow_unencrypted_cache=True) @patch("azure.identity._internal.persistent_cache.sys.platform", "linux2") @@ -184,7 +184,7 @@ def test_persistent_cache_linux(mock_extensions): required_arguments = ("tenant-id", "client-id", "secret") # the credential should prefer an encrypted cache even when the user allows an unencrypted one - ClientSecretCredential(*required_arguments, enable_persistent_cache=True, allow_unencrypted_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True, _allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.LibsecretPersistence) mock_extensions.PersistedTokenCache.reset_mock() @@ -193,9 +193,9 @@ def test_persistent_cache_linux(mock_extensions): # encryption unavailable, no opt in to unencrypted cache -> credential should raise with pytest.raises(ValueError): - ClientSecretCredential(*required_arguments, enable_persistent_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True) - ClientSecretCredential(*required_arguments, enable_persistent_cache=True, allow_unencrypted_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True, _allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.FilePersistence) @@ -215,11 +215,11 @@ def test_persistent_cache_multiple_clients(): with patch("azure.identity._internal.persistent_cache._load_persistent_cache") as mock_cache_loader: mock_cache_loader.return_value = Mock(wraps=cache) credential_a = ClientSecretCredential( - "tenant-id", "client-a", "...", enable_persistent_cache=True, transport=transport_a + "tenant-id", "client-a", "...", _enable_persistent_cache=True, transport=transport_a ) assert mock_cache_loader.call_count == 1, "credential should load the persistent cache" credential_b = ClientSecretCredential( - "tenant-id", "client-b", "...", enable_persistent_cache=True, transport=transport_b + "tenant-id", "client-b", "...", _enable_persistent_cache=True, transport=transport_b ) assert mock_cache_loader.call_count == 2, "credential should load the persistent cache" diff --git a/sdk/identity/azure-identity/tests/test_client_secret_credential_async.py b/sdk/identity/azure-identity/tests/test_client_secret_credential_async.py index 4731f1cb7bc2..24ff4f3dc224 100644 --- a/sdk/identity/azure-identity/tests/test_client_secret_credential_async.py +++ b/sdk/identity/azure-identity/tests/test_client_secret_credential_async.py @@ -184,19 +184,19 @@ def test_enable_persistent_cache(): ClientSecretCredential(*required_arguments) # allowing an unencrypted cache doesn't count as opting in to the persistent cache - ClientSecretCredential(*required_arguments, allow_unencrypted_cache=True) + ClientSecretCredential(*required_arguments, _allow_unencrypted_cache=True) # keyword argument opts in to persistent cache with patch(persistent_cache + ".msal_extensions") as mock_extensions: - ClientSecretCredential(*required_arguments, enable_persistent_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True) assert mock_extensions.PersistedTokenCache.call_count == 1 # opting in on an unsupported platform raises an exception with patch(persistent_cache + ".sys.platform", "commodore64"): with pytest.raises(NotImplementedError): - ClientSecretCredential(*required_arguments, enable_persistent_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True) with pytest.raises(NotImplementedError): - ClientSecretCredential(*required_arguments, enable_persistent_cache=True, allow_unencrypted_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True, _allow_unencrypted_cache=True) @patch("azure.identity._internal.persistent_cache.sys.platform", "linux2") @@ -210,7 +210,7 @@ def test_persistent_cache_linux(mock_extensions): required_arguments = ("tenant-id", "client-id", "secret") # the credential should prefer an encrypted cache even when the user allows an unencrypted one - ClientSecretCredential(*required_arguments, enable_persistent_cache=True, allow_unencrypted_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True, _allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.LibsecretPersistence) mock_extensions.PersistedTokenCache.reset_mock() @@ -219,9 +219,9 @@ def test_persistent_cache_linux(mock_extensions): # encryption unavailable, no opt in to unencrypted cache -> credential should raise with pytest.raises(ValueError): - ClientSecretCredential(*required_arguments, enable_persistent_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True) - ClientSecretCredential(*required_arguments, enable_persistent_cache=True, allow_unencrypted_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True, _allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.FilePersistence) @@ -242,11 +242,11 @@ async def test_persistent_cache_multiple_clients(): with patch("azure.identity._internal.persistent_cache._load_persistent_cache") as mock_cache_loader: mock_cache_loader.return_value = Mock(wraps=cache) credential_a = ClientSecretCredential( - "tenant-id", "client-a", "...", enable_persistent_cache=True, transport=transport_a + "tenant-id", "client-a", "...", _enable_persistent_cache=True, transport=transport_a ) assert mock_cache_loader.call_count == 1, "credential should load the persistent cache" credential_b = ClientSecretCredential( - "tenant-id", "client-b", "...", enable_persistent_cache=True, transport=transport_b + "tenant-id", "client-b", "...", _enable_persistent_cache=True, transport=transport_b ) assert mock_cache_loader.call_count == 2, "credential should load the persistent cache" diff --git a/sdk/identity/azure-identity/tests/test_device_code_credential.py b/sdk/identity/azure-identity/tests/test_device_code_credential.py index f33553dcd6e3..896b3ef4e1b9 100644 --- a/sdk/identity/azure-identity/tests/test_device_code_credential.py +++ b/sdk/identity/azure-identity/tests/test_device_code_credential.py @@ -6,7 +6,8 @@ from azure.core.exceptions import ClientAuthenticationError from azure.core.pipeline.policies import SansIOHTTPPolicy -from azure.identity import AuthenticationRequiredError, DeviceCodeCredential +from azure.identity import DeviceCodeCredential +from azure.identity._exceptions import AuthenticationRequiredError from azure.identity._internal.user_agent import USER_AGENT from msal import TokenCache import pytest @@ -77,7 +78,7 @@ def test_authenticate(): tenant_id=tenant_id, _cache=TokenCache(), ) - record = credential.authenticate(scopes=(scope,)) + record = credential._authenticate(scopes=(scope,)) assert record.authority == environment assert record.home_account_id == object_id + "." + home_tenant assert record.tenant_id == home_tenant @@ -93,7 +94,7 @@ def test_disable_automatic_authentication(): empty_cache = TokenCache() # empty cache makes silent auth impossible transport = Mock(send=Mock(side_effect=Exception("no request should be sent"))) - credential = DeviceCodeCredential("client-id", disable_automatic_authentication=True, transport=transport, _cache=empty_cache) + credential = DeviceCodeCredential("client-id", _disable_automatic_authentication=True, transport=transport, _cache=empty_cache) with pytest.raises(AuthenticationRequiredError): credential.get_token("scope") diff --git a/sdk/identity/azure-identity/tests/test_imds_credential.py b/sdk/identity/azure-identity/tests/test_imds_credential.py index 95f53088b11a..8b040b769f55 100644 --- a/sdk/identity/azure-identity/tests/test_imds_credential.py +++ b/sdk/identity/azure-identity/tests/test_imds_credential.py @@ -169,7 +169,7 @@ def test_identity_config(): ], ) - credential = ImdsCredential(identity_config={param_name: param_value}, transport=transport) + credential = ImdsCredential(_identity_config={param_name: param_value}, transport=transport) token = credential.get_token(scope) assert token == expected_token diff --git a/sdk/identity/azure-identity/tests/test_imds_credential_async.py b/sdk/identity/azure-identity/tests/test_imds_credential_async.py index a4d056f399fc..8c42e643a855 100644 --- a/sdk/identity/azure-identity/tests/test_imds_credential_async.py +++ b/sdk/identity/azure-identity/tests/test_imds_credential_async.py @@ -198,7 +198,7 @@ async def test_identity_config(): ], ) - credential = ImdsCredential(client_id=client_id, identity_config={param_name: param_value}, transport=transport) + credential = ImdsCredential(client_id=client_id, _identity_config={param_name: param_value}, transport=transport) token = await credential.get_token(scope) assert token == expected_token diff --git a/sdk/identity/azure-identity/tests/test_interactive_credential.py b/sdk/identity/azure-identity/tests/test_interactive_credential.py index 645e74f21bd0..9573c7623632 100644 --- a/sdk/identity/azure-identity/tests/test_interactive_credential.py +++ b/sdk/identity/azure-identity/tests/test_interactive_credential.py @@ -3,12 +3,9 @@ # Licensed under the MIT License. # ------------------------------------ from azure.core.exceptions import ClientAuthenticationError -from azure.identity import ( - AuthenticationRequiredError, - AuthenticationRecord, - KnownAuthorities, - CredentialUnavailableError, -) +from azure.identity import KnownAuthorities, CredentialUnavailableError +from azure.identity._auth_record import AuthenticationRecord +from azure.identity._exceptions import AuthenticationRequiredError from azure.identity._internal import InteractiveCredential from msal import TokenCache import pytest @@ -67,7 +64,7 @@ def validate_app_parameters(authority, client_id, **_): app_factory = Mock(wraps=validate_app_parameters) credential = MockCredential( - authentication_record=record, disable_automatic_authentication=True, msal_app_factory=app_factory, + _authentication_record=record, _disable_automatic_authentication=True, msal_app_factory=app_factory, ) with pytest.raises(AuthenticationRequiredError): credential.get_token("scope") @@ -90,9 +87,9 @@ def validate_authority(authority, **_): return Mock(get_accounts=Mock(return_value=[])) credential = MockCredential( - authentication_record=record, + _authentication_record=record, tenant_id=expected_tenant, - disable_automatic_authentication=True, + _disable_automatic_authentication=True, msal_app_factory=validate_authority, ) with pytest.raises(AuthenticationRequiredError): @@ -110,8 +107,8 @@ def test_disable_automatic_authentication(): ) credential = MockCredential( - authentication_record=record, - disable_automatic_authentication=True, + _authentication_record=record, + _disable_automatic_authentication=True, msal_app_factory=lambda *_, **__: msal_app, request_token=Mock(side_effect=Exception("credential shouldn't begin interactive authentication")), ) @@ -135,11 +132,11 @@ def validate_scopes(*scopes, **_): return {"access_token": "**", "expires_in": 42} request_token = Mock(wraps=validate_scopes) - credential = MockCredential(disable_automatic_authentication=True, request_token=request_token) + credential = MockCredential(_disable_automatic_authentication=True, request_token=request_token) with pytest.raises(AuthenticationRequiredError) as ex: credential.get_token(scope) - credential.authenticate(scopes=ex.value.scopes) + credential._authenticate(scopes=ex.value.scopes) assert request_token.call_count == 1, "validation method wasn't called" @@ -161,7 +158,7 @@ def validate_scopes(*scopes): return {"access_token": "**", "expires_in": 42} request_token = Mock(wraps=validate_scopes) - MockCredential(authority=authority, request_token=request_token).authenticate() + MockCredential(authority=authority, request_token=request_token)._authenticate() assert request_token.call_count == 1 @@ -169,7 +166,7 @@ def test_authenticate_unknown_cloud(): """authenticate should raise when given no scopes in an unknown cloud""" with pytest.raises(CredentialUnavailableError): - MockCredential(authority="localhost").authenticate() + MockCredential(authority="localhost")._authenticate() @pytest.mark.parametrize("option", (True, False)) @@ -177,7 +174,7 @@ def test_authenticate_ignores_disable_automatic_authentication(option): """authenticate should prompt for authentication regardless of the credential's configuration""" request_token = Mock(return_value={"access_token": "**", "expires_in": 42}) - MockCredential(request_token=request_token, disable_automatic_authentication=option).authenticate() + MockCredential(request_token=request_token, _disable_automatic_authentication=option)._authenticate() assert request_token.call_count == 1, "credential didn't begin interactive authentication" @@ -193,7 +190,7 @@ class CustomException(Exception): acquire_token_silent_with_error=Mock(side_effect=CustomException(expected_message)), get_accounts=Mock(return_value=[{"home_account_id": record.home_account_id}]), ) - credential = MockCredential(msal_app_factory=lambda *_, **__: msal_app, authentication_record=record) + credential = MockCredential(msal_app_factory=lambda *_, **__: msal_app, _authentication_record=record) with pytest.raises(ClientAuthenticationError) as ex: credential.get_token("scope") @@ -223,20 +220,20 @@ def _request_token(self, *_, **__): assert credential._cache is in_memory_cache # allowing an unencrypted cache doesn't count as opting in to the persistent cache - credential = TestCredential(allow_unencrypted_cache=True) + credential = TestCredential(_allow_unencrypted_cache=True) assert credential._cache is in_memory_cache # keyword argument opts in to persistent cache with patch(persistent_cache + ".msal_extensions") as mock_extensions: - TestCredential(enable_persistent_cache=True) + TestCredential(_enable_persistent_cache=True) assert mock_extensions.PersistedTokenCache.call_count == 1 # opting in on an unsupported platform raises an exception with patch(persistent_cache + ".sys.platform", "commodore64"): with pytest.raises(NotImplementedError): - TestCredential(enable_persistent_cache=True) + TestCredential(_enable_persistent_cache=True) with pytest.raises(NotImplementedError): - TestCredential(enable_persistent_cache=True, allow_unencrypted_cache=True) + TestCredential(_enable_persistent_cache=True, _allow_unencrypted_cache=True) @patch("azure.identity._internal.persistent_cache.sys.platform", "linux2") @@ -255,7 +252,7 @@ def _request_token(self, *_, **__): pass # the credential should prefer an encrypted cache even when the user allows an unencrypted one - TestCredential(enable_persistent_cache=True, allow_unencrypted_cache=True) + TestCredential(_enable_persistent_cache=True, _allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.LibsecretPersistence) mock_extensions.PersistedTokenCache.reset_mock() @@ -264,9 +261,9 @@ def _request_token(self, *_, **__): # encryption unavailable, no opt in to unencrypted cache -> credential should raise with pytest.raises(ValueError): - TestCredential(enable_persistent_cache=True) + TestCredential(_enable_persistent_cache=True) - TestCredential(enable_persistent_cache=True, allow_unencrypted_cache=True) + TestCredential(_enable_persistent_cache=True, _allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.FilePersistence) @@ -292,7 +289,7 @@ def __init__(self, **kwargs): def _request_token(self, *_, **__): return msal_response - record = TestCredential().authenticate() + record = TestCredential()._authenticate() assert record.home_account_id == "{}.{}".format(object_id, home_tenant) @@ -317,5 +314,5 @@ def __init__(self, **kwargs): def _request_token(self, *_, **__): return msal_response - record = TestCredential().authenticate() + record = TestCredential()._authenticate() assert record.home_account_id == subject diff --git a/sdk/identity/azure-identity/tests/test_msi_credential.py b/sdk/identity/azure-identity/tests/test_msi_credential.py index 7536688774e2..28f67a357790 100644 --- a/sdk/identity/azure-identity/tests/test_msi_credential.py +++ b/sdk/identity/azure-identity/tests/test_msi_credential.py @@ -68,7 +68,7 @@ def test_identity_config_app_service(): {EnvironmentVariables.MSI_ENDPOINT: endpoint, EnvironmentVariables.MSI_SECRET: secret}, clear=True, ): - credential = MsiCredential(identity_config={param_name: param_value}, transport=transport) + credential = MsiCredential(_identity_config={param_name: param_value}, transport=transport) token = credential.get_token(scope) assert token == expected_token @@ -107,7 +107,7 @@ def test_identity_config_cloud_shell(): with mock.patch.dict( MsiCredential.__module__ + ".os.environ", {EnvironmentVariables.MSI_ENDPOINT: endpoint}, clear=True ): - credential = MsiCredential(identity_config={param_name: param_value}, transport=transport) + credential = MsiCredential(_identity_config={param_name: param_value}, transport=transport) token = credential.get_token(scope) assert token == expected_token diff --git a/sdk/identity/azure-identity/tests/test_msi_credential_async.py b/sdk/identity/azure-identity/tests/test_msi_credential_async.py index dfa038963536..b9ff2bf114f8 100644 --- a/sdk/identity/azure-identity/tests/test_msi_credential_async.py +++ b/sdk/identity/azure-identity/tests/test_msi_credential_async.py @@ -96,7 +96,7 @@ async def test_identity_config_app_service(): {EnvironmentVariables.MSI_ENDPOINT: endpoint, EnvironmentVariables.MSI_SECRET: secret}, clear=True, ): - credential = MsiCredential(identity_config={param_name: param_value}, transport=transport) + credential = MsiCredential(_identity_config={param_name: param_value}, transport=transport) token = await credential.get_token(scope) assert token == expected_token @@ -135,7 +135,7 @@ async def test_identity_config_cloud_shell(): with mock.patch.dict( MsiCredential.__module__ + ".os.environ", {EnvironmentVariables.MSI_ENDPOINT: endpoint}, clear=True ): - credential = MsiCredential(identity_config={param_name: param_value}, transport=transport) + credential = MsiCredential(_identity_config={param_name: param_value}, transport=transport) token = await credential.get_token(scope) assert token == expected_token diff --git a/sdk/identity/azure-identity/tests/test_shared_cache_credential.py b/sdk/identity/azure-identity/tests/test_shared_cache_credential.py index efb5bcc668af..e2b1713c9d07 100644 --- a/sdk/identity/azure-identity/tests/test_shared_cache_credential.py +++ b/sdk/identity/azure-identity/tests/test_shared_cache_credential.py @@ -4,11 +4,8 @@ # ------------------------------------ from azure.core.exceptions import ClientAuthenticationError from azure.core.pipeline.policies import SansIOHTTPPolicy -from azure.identity import ( - AuthenticationRecord, - CredentialUnavailableError, - SharedTokenCacheCredential, -) +from azure.identity import CredentialUnavailableError, SharedTokenCacheCredential +from azure.identity._auth_record import AuthenticationRecord from azure.identity._constants import AZURE_CLI_CLIENT_ID, EnvironmentVariables from azure.identity._internal.shared_token_cache import ( KNOWN_ALIASES, @@ -514,7 +511,7 @@ def test_authority_environment_variable(): def test_authentication_record_empty_cache(): record = AuthenticationRecord("tenant_id", "client_id", "authority", "home_account_id", "username") transport = Mock(side_effect=Exception("the credential shouldn't send a request")) - credential = SharedTokenCacheCredential(authentication_record=record, transport=transport, _cache=TokenCache()) + credential = SharedTokenCacheCredential(_authentication_record=record, transport=transport, _cache=TokenCache()) with pytest.raises(CredentialUnavailableError): credential.get_token("scope") @@ -535,7 +532,7 @@ def test_authentication_record_no_match(): "not-" + username, "not-" + object_id, "different-" + tenant_id, client_id="not-" + client_id, ), ) - credential = SharedTokenCacheCredential(authentication_record=record, transport=transport, _cache=cache) + credential = SharedTokenCacheCredential(_authentication_record=record, transport=transport, _cache=cache) with pytest.raises(CredentialUnavailableError): credential.get_token("scope") @@ -561,7 +558,7 @@ def test_authentication_record(): requests=[Request(authority=authority, required_data={"refresh_token": expected_refresh_token})], responses=[mock_response(json_payload=build_aad_response(access_token=expected_access_token))], ) - credential = SharedTokenCacheCredential(authentication_record=record, transport=transport, _cache=cache) + credential = SharedTokenCacheCredential(_authentication_record=record, transport=transport, _cache=cache) token = credential.get_token("scope") assert token.token == expected_access_token @@ -597,12 +594,13 @@ def test_auth_record_multiple_accounts_for_username(): requests=[Request(authority=authority, required_data={"refresh_token": expected_refresh_token})], responses=[mock_response(json_payload=build_aad_response(access_token=expected_access_token))], ) - credential = SharedTokenCacheCredential(authentication_record=record, transport=transport, _cache=cache) + credential = SharedTokenCacheCredential(_authentication_record=record, transport=transport, _cache=cache) token = credential.get_token("scope") assert token.token == expected_access_token +@pytest.mark.skip("in 1.4.0 allow_unencrypted_cache is private and defaults to True") @patch("azure.identity._internal.persistent_cache.sys.platform", "linux2") @patch("azure.identity._internal.persistent_cache.msal_extensions") def test_allow_unencrypted_cache(mock_extensions): @@ -612,7 +610,7 @@ def test_allow_unencrypted_cache(mock_extensions): """ # the credential should prefer an encrypted cache even when the user allows an unencrypted one - SharedTokenCacheCredential(allow_unencrypted_cache=True) + SharedTokenCacheCredential(_allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.LibsecretPersistence) mock_extensions.PersistedTokenCache.reset_mock() @@ -625,7 +623,7 @@ def test_allow_unencrypted_cache(mock_extensions): assert mock_extensions.PersistedTokenCache.call_count == 0 # still no encryption, but now we allow the unencrypted fallback - SharedTokenCacheCredential(allow_unencrypted_cache=True) + SharedTokenCacheCredential(_allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.FilePersistence) @@ -745,7 +743,7 @@ def test_authentication_record_authenticating_tenant(): with patch.object(SharedTokenCacheCredential, "_get_auth_client") as get_auth_client: credential = SharedTokenCacheCredential( - authentication_record=record, _cache=TokenCache(), tenant_id=expected_tenant_id + _authentication_record=record, _cache=TokenCache(), tenant_id=expected_tenant_id ) with pytest.raises(CredentialUnavailableError): # this raises because the cache is empty diff --git a/sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py b/sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py index 389ba606d482..518913db4eeb 100644 --- a/sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py +++ b/sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py @@ -7,8 +7,8 @@ from azure.core.exceptions import ClientAuthenticationError from azure.core.pipeline.policies import SansIOHTTPPolicy -from azure.identity import AuthenticationRecord, CredentialUnavailableError -from azure.identity.aio import SharedTokenCacheCredential +from azure.identity import CredentialUnavailableError +from azure.identity._auth_record import AuthenticationRecord from azure.identity._constants import EnvironmentVariables from azure.identity._internal.shared_token_cache import ( KNOWN_ALIASES, @@ -18,6 +18,7 @@ NO_MATCHING_ACCOUNTS, ) from azure.identity._internal.user_agent import USER_AGENT +from azure.identity.aio import SharedTokenCacheCredential from msal import TokenCache import pytest @@ -593,7 +594,7 @@ async def test_authority_environment_variable(): async def test_authentication_record_empty_cache(): record = AuthenticationRecord("tenant_id", "client_id", "authority", "home_account_id", "username") transport = Mock(side_effect=Exception("the credential shouldn't send a request")) - credential = SharedTokenCacheCredential(authentication_record=record, transport=transport, _cache=TokenCache()) + credential = SharedTokenCacheCredential(_authentication_record=record, transport=transport, _cache=TokenCache()) with pytest.raises(CredentialUnavailableError): await credential.get_token("scope") @@ -615,7 +616,7 @@ async def test_authentication_record_no_match(): "not-" + username, "not-" + object_id, "different-" + tenant_id, client_id="not-" + client_id, ), ) - credential = SharedTokenCacheCredential(authentication_record=record, transport=transport, _cache=cache) + credential = SharedTokenCacheCredential(_authentication_record=record, transport=transport, _cache=cache) with pytest.raises(CredentialUnavailableError): await credential.get_token("scope") @@ -642,7 +643,7 @@ async def test_authentication_record(): requests=[Request(authority=authority, required_data={"refresh_token": expected_refresh_token})], responses=[mock_response(json_payload=build_aad_response(access_token=expected_access_token))], ) - credential = SharedTokenCacheCredential(authentication_record=record, transport=transport, _cache=cache) + credential = SharedTokenCacheCredential(_authentication_record=record, transport=transport, _cache=cache) token = await credential.get_token("scope") assert token.token == expected_access_token @@ -679,7 +680,7 @@ async def test_auth_record_multiple_accounts_for_username(): requests=[Request(authority=authority, required_data={"refresh_token": expected_refresh_token})], responses=[mock_response(json_payload=build_aad_response(access_token=expected_access_token))], ) - credential = SharedTokenCacheCredential(authentication_record=record, transport=transport, _cache=cache) + credential = SharedTokenCacheCredential(_authentication_record=record, transport=transport, _cache=cache) token = await credential.get_token("scope") assert token.token == expected_access_token @@ -694,7 +695,7 @@ async def test_authentication_record_authenticating_tenant(): with patch.object(SharedTokenCacheCredential, "_get_auth_client") as get_auth_client: credential = SharedTokenCacheCredential( - authentication_record=record, _cache=TokenCache(), tenant_id=expected_tenant_id + _authentication_record=record, _cache=TokenCache(), tenant_id=expected_tenant_id ) with pytest.raises(CredentialUnavailableError): # this raises because the cache is empty @@ -705,6 +706,7 @@ async def test_authentication_record_authenticating_tenant(): assert kwargs["tenant_id"] == expected_tenant_id +@pytest.mark.skip("in 1.4.0 allow_unencrypted_cache is private and defaults to True") @pytest.mark.asyncio async def test_allow_unencrypted_cache(): """The credential should use an unencrypted cache when encryption is unavailable and the user explicitly allows it. @@ -719,7 +721,7 @@ async def test_allow_unencrypted_cache(): mock_extensions = msal_extensions_patch.start() # the credential should prefer an encrypted cache even when the user allows an unencrypted one - SharedTokenCacheCredential(allow_unencrypted_cache=True) + SharedTokenCacheCredential(_allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.LibsecretPersistence) mock_extensions.PersistedTokenCache.reset_mock() @@ -728,12 +730,12 @@ async def test_allow_unencrypted_cache(): # encryption unavailable, no opt in to unencrypted cache -> credential should be unavailable credential = SharedTokenCacheCredential() - assert mock_extensions.PersistedTokenCache.call_count == 0 with pytest.raises(CredentialUnavailableError): await credential.get_token("scope") + assert mock_extensions.PersistedTokenCache.call_count == 0 # still no encryption, but now we allow the unencrypted fallback - SharedTokenCacheCredential(allow_unencrypted_cache=True) + SharedTokenCacheCredential(_allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.FilePersistence) msal_extensions_patch.stop() diff --git a/sdk/identity/azure-identity/tests/test_username_password_credential.py b/sdk/identity/azure-identity/tests/test_username_password_credential.py index f82d251090b0..6a93b79d7827 100644 --- a/sdk/identity/azure-identity/tests/test_username_password_credential.py +++ b/sdk/identity/azure-identity/tests/test_username_password_credential.py @@ -125,7 +125,7 @@ def test_authenticate(): tenant_id=tenant_id, transport=transport, ) - record = credential.authenticate(scopes=(scope,)) + record = credential._authenticate(scopes=(scope,)) assert record.authority == environment assert record.home_account_id == object_id + "." + home_tenant assert record.tenant_id == home_tenant