From d0a92168f7eab7a41c9ba2ce33d7247c3a0817da Mon Sep 17 00:00:00 2001 From: Charles Lowell Date: Wed, 29 Jul 2020 13:02:48 -0700 Subject: [PATCH 01/14] exclude samples from sdist --- sdk/identity/azure-identity/MANIFEST.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sdk/identity/azure-identity/MANIFEST.in b/sdk/identity/azure-identity/MANIFEST.in index 07b576fc0eb3..2dfaac2ca8aa 100644 --- a/sdk/identity/azure-identity/MANIFEST.in +++ b/sdk/identity/azure-identity/MANIFEST.in @@ -1,4 +1,4 @@ -recursive-include samples *.py +recursive-exclude samples *.py recursive-include tests *.py include *.md include azure/__init__.py From ca1a935f60d54585e1ab970976d8d38e28711343 Mon Sep 17 00:00:00 2001 From: Charles Lowell Date: Wed, 29 Jul 2020 13:10:25 -0700 Subject: [PATCH 02/14] authenticate -> _authenticate --- .../azure/identity/_internal/interactive.py | 2 +- .../azure-identity/tests/test_browser_credential.py | 2 +- .../tests/test_device_code_credential.py | 2 +- .../tests/test_interactive_credential.py | 12 ++++++------ .../tests/test_username_password_credential.py | 2 +- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/sdk/identity/azure-identity/azure/identity/_internal/interactive.py b/sdk/identity/azure-identity/azure/identity/_internal/interactive.py index 4e226bc0c357..ab69d252aeb7 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/interactive.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/interactive.py @@ -140,7 +140,7 @@ def get_token(self, *scopes, **kwargs): _LOGGER.info("%s.get_token succeeded", self.__class__.__name__) return AccessToken(result["access_token"], now + int(result["expires_in"])) - def authenticate(self, **kwargs): + def _authenticate(self, **kwargs): # type: (**Any) -> AuthenticationRecord """Interactively authenticate a user. diff --git a/sdk/identity/azure-identity/tests/test_browser_credential.py b/sdk/identity/azure-identity/tests/test_browser_credential.py index e07c69f30396..108022ec4ed2 100644 --- a/sdk/identity/azure-identity/tests/test_browser_credential.py +++ b/sdk/identity/azure-identity/tests/test_browser_credential.py @@ -81,7 +81,7 @@ def test_authenticate(): tenant_id=tenant_id, transport=transport, ) - record = credential.authenticate(scopes=(scope,)) + record = credential._authenticate(scopes=(scope,)) assert record.authority == environment assert record.home_account_id == object_id + "." + home_tenant diff --git a/sdk/identity/azure-identity/tests/test_device_code_credential.py b/sdk/identity/azure-identity/tests/test_device_code_credential.py index f33553dcd6e3..5d8b0e4a8778 100644 --- a/sdk/identity/azure-identity/tests/test_device_code_credential.py +++ b/sdk/identity/azure-identity/tests/test_device_code_credential.py @@ -77,7 +77,7 @@ def test_authenticate(): tenant_id=tenant_id, _cache=TokenCache(), ) - record = credential.authenticate(scopes=(scope,)) + record = credential._authenticate(scopes=(scope,)) assert record.authority == environment assert record.home_account_id == object_id + "." + home_tenant assert record.tenant_id == home_tenant diff --git a/sdk/identity/azure-identity/tests/test_interactive_credential.py b/sdk/identity/azure-identity/tests/test_interactive_credential.py index 645e74f21bd0..14ce9bf56e5f 100644 --- a/sdk/identity/azure-identity/tests/test_interactive_credential.py +++ b/sdk/identity/azure-identity/tests/test_interactive_credential.py @@ -139,7 +139,7 @@ def validate_scopes(*scopes, **_): with pytest.raises(AuthenticationRequiredError) as ex: credential.get_token(scope) - credential.authenticate(scopes=ex.value.scopes) + credential._authenticate(scopes=ex.value.scopes) assert request_token.call_count == 1, "validation method wasn't called" @@ -161,7 +161,7 @@ def validate_scopes(*scopes): return {"access_token": "**", "expires_in": 42} request_token = Mock(wraps=validate_scopes) - MockCredential(authority=authority, request_token=request_token).authenticate() + MockCredential(authority=authority, request_token=request_token)._authenticate() assert request_token.call_count == 1 @@ -169,7 +169,7 @@ def test_authenticate_unknown_cloud(): """authenticate should raise when given no scopes in an unknown cloud""" with pytest.raises(CredentialUnavailableError): - MockCredential(authority="localhost").authenticate() + MockCredential(authority="localhost")._authenticate() @pytest.mark.parametrize("option", (True, False)) @@ -177,7 +177,7 @@ def test_authenticate_ignores_disable_automatic_authentication(option): """authenticate should prompt for authentication regardless of the credential's configuration""" request_token = Mock(return_value={"access_token": "**", "expires_in": 42}) - MockCredential(request_token=request_token, disable_automatic_authentication=option).authenticate() + MockCredential(request_token=request_token, disable_automatic_authentication=option)._authenticate() assert request_token.call_count == 1, "credential didn't begin interactive authentication" @@ -292,7 +292,7 @@ def __init__(self, **kwargs): def _request_token(self, *_, **__): return msal_response - record = TestCredential().authenticate() + record = TestCredential()._authenticate() assert record.home_account_id == "{}.{}".format(object_id, home_tenant) @@ -317,5 +317,5 @@ def __init__(self, **kwargs): def _request_token(self, *_, **__): return msal_response - record = TestCredential().authenticate() + record = TestCredential()._authenticate() assert record.home_account_id == subject diff --git a/sdk/identity/azure-identity/tests/test_username_password_credential.py b/sdk/identity/azure-identity/tests/test_username_password_credential.py index f82d251090b0..6a93b79d7827 100644 --- a/sdk/identity/azure-identity/tests/test_username_password_credential.py +++ b/sdk/identity/azure-identity/tests/test_username_password_credential.py @@ -125,7 +125,7 @@ def test_authenticate(): tenant_id=tenant_id, transport=transport, ) - record = credential.authenticate(scopes=(scope,)) + record = credential._authenticate(scopes=(scope,)) assert record.authority == environment assert record.home_account_id == object_id + "." + home_tenant assert record.tenant_id == home_tenant From 505971c1a324e582cfbad4b84227246e5537adcf Mon Sep 17 00:00:00 2001 From: Charles Lowell Date: Wed, 29 Jul 2020 13:21:01 -0700 Subject: [PATCH 03/14] remove AuthenticationRecord and AuthenticationRequiredError from public API --- sdk/identity/azure-identity/azure/identity/__init__.py | 5 +---- .../azure/identity/_internal/shared_token_cache.py | 2 +- sdk/identity/azure-identity/tests/test_auth_record.py | 2 +- .../azure-identity/tests/test_browser_credential.py | 3 ++- .../azure-identity/tests/test_device_code_credential.py | 3 ++- .../azure-identity/tests/test_interactive_credential.py | 9 +++------ .../azure-identity/tests/test_shared_cache_credential.py | 7 ++----- .../tests/test_shared_cache_credential_async.py | 5 +++-- 8 files changed, 15 insertions(+), 21 deletions(-) diff --git a/sdk/identity/azure-identity/azure/identity/__init__.py b/sdk/identity/azure-identity/azure/identity/__init__.py index 2e3f9d639a24..dc29e2cffdc0 100644 --- a/sdk/identity/azure-identity/azure/identity/__init__.py +++ b/sdk/identity/azure-identity/azure/identity/__init__.py @@ -4,8 +4,7 @@ # ------------------------------------ """Credentials for Azure SDK clients.""" -from ._auth_record import AuthenticationRecord -from ._exceptions import AuthenticationRequiredError, CredentialUnavailableError +from ._exceptions import CredentialUnavailableError from ._constants import AzureAuthorityHosts, KnownAuthorities from ._credentials import ( AzureCliCredential, @@ -25,8 +24,6 @@ __all__ = [ - "AuthenticationRecord", - "AuthenticationRequiredError", "AuthorizationCodeCredential", "AzureAuthorityHosts", "AzureCliCredential", diff --git a/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py b/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py index d28a7602fd5e..1ee68bfe0649 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py @@ -30,7 +30,7 @@ # pylint:disable=unused-import,ungrouped-imports from typing import Any, Iterable, List, Mapping, Optional from .._internal import AadClientBase - from azure.identity import AuthenticationRecord + from azure.identity._auth_record import AuthenticationRecord CacheItem = Mapping[str, str] diff --git a/sdk/identity/azure-identity/tests/test_auth_record.py b/sdk/identity/azure-identity/tests/test_auth_record.py index 5daef9c5dec4..5b4ec83d6da2 100644 --- a/sdk/identity/azure-identity/tests/test_auth_record.py +++ b/sdk/identity/azure-identity/tests/test_auth_record.py @@ -4,7 +4,7 @@ # ------------------------------------ import json -from azure.identity import AuthenticationRecord +from azure.identity._auth_record import AuthenticationRecord def test_serialization(): diff --git a/sdk/identity/azure-identity/tests/test_browser_credential.py b/sdk/identity/azure-identity/tests/test_browser_credential.py index 108022ec4ed2..6f1be7319848 100644 --- a/sdk/identity/azure-identity/tests/test_browser_credential.py +++ b/sdk/identity/azure-identity/tests/test_browser_credential.py @@ -10,7 +10,8 @@ from azure.core.exceptions import ClientAuthenticationError from azure.core.pipeline.policies import SansIOHTTPPolicy -from azure.identity import AuthenticationRequiredError, CredentialUnavailableError, InteractiveBrowserCredential +from azure.identity import CredentialUnavailableError, InteractiveBrowserCredential +from azure.identity._exceptions import AuthenticationRequiredError from azure.identity._internal import AuthCodeRedirectServer from azure.identity._internal.user_agent import USER_AGENT from msal import TokenCache diff --git a/sdk/identity/azure-identity/tests/test_device_code_credential.py b/sdk/identity/azure-identity/tests/test_device_code_credential.py index 5d8b0e4a8778..76497329c076 100644 --- a/sdk/identity/azure-identity/tests/test_device_code_credential.py +++ b/sdk/identity/azure-identity/tests/test_device_code_credential.py @@ -6,7 +6,8 @@ from azure.core.exceptions import ClientAuthenticationError from azure.core.pipeline.policies import SansIOHTTPPolicy -from azure.identity import AuthenticationRequiredError, DeviceCodeCredential +from azure.identity import DeviceCodeCredential +from azure.identity._exceptions import AuthenticationRequiredError from azure.identity._internal.user_agent import USER_AGENT from msal import TokenCache import pytest diff --git a/sdk/identity/azure-identity/tests/test_interactive_credential.py b/sdk/identity/azure-identity/tests/test_interactive_credential.py index 14ce9bf56e5f..2eb5aa6e4eb7 100644 --- a/sdk/identity/azure-identity/tests/test_interactive_credential.py +++ b/sdk/identity/azure-identity/tests/test_interactive_credential.py @@ -3,12 +3,9 @@ # Licensed under the MIT License. # ------------------------------------ from azure.core.exceptions import ClientAuthenticationError -from azure.identity import ( - AuthenticationRequiredError, - AuthenticationRecord, - KnownAuthorities, - CredentialUnavailableError, -) +from azure.identity import KnownAuthorities, CredentialUnavailableError +from azure.identity._auth_record import AuthenticationRecord +from azure.identity._exceptions import AuthenticationRequiredError from azure.identity._internal import InteractiveCredential from msal import TokenCache import pytest diff --git a/sdk/identity/azure-identity/tests/test_shared_cache_credential.py b/sdk/identity/azure-identity/tests/test_shared_cache_credential.py index efb5bcc668af..a64288c9c40f 100644 --- a/sdk/identity/azure-identity/tests/test_shared_cache_credential.py +++ b/sdk/identity/azure-identity/tests/test_shared_cache_credential.py @@ -4,11 +4,8 @@ # ------------------------------------ from azure.core.exceptions import ClientAuthenticationError from azure.core.pipeline.policies import SansIOHTTPPolicy -from azure.identity import ( - AuthenticationRecord, - CredentialUnavailableError, - SharedTokenCacheCredential, -) +from azure.identity import CredentialUnavailableError, SharedTokenCacheCredential +from azure.identity._auth_record import AuthenticationRecord from azure.identity._constants import AZURE_CLI_CLIENT_ID, EnvironmentVariables from azure.identity._internal.shared_token_cache import ( KNOWN_ALIASES, diff --git a/sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py b/sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py index 389ba606d482..fd2d9fbb45c4 100644 --- a/sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py +++ b/sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py @@ -7,8 +7,8 @@ from azure.core.exceptions import ClientAuthenticationError from azure.core.pipeline.policies import SansIOHTTPPolicy -from azure.identity import AuthenticationRecord, CredentialUnavailableError -from azure.identity.aio import SharedTokenCacheCredential +from azure.identity import CredentialUnavailableError +from azure.identity._auth_record import AuthenticationRecord from azure.identity._constants import EnvironmentVariables from azure.identity._internal.shared_token_cache import ( KNOWN_ALIASES, @@ -18,6 +18,7 @@ NO_MATCHING_ACCOUNTS, ) from azure.identity._internal.user_agent import USER_AGENT +from azure.identity.aio import SharedTokenCacheCredential from msal import TokenCache import pytest From 23c6102b6b4b0e2191e34f7acccb687de6324b7f Mon Sep 17 00:00:00 2001 From: Charles Lowell Date: Wed, 29 Jul 2020 13:39:16 -0700 Subject: [PATCH 04/14] remove doc references --- .../azure-identity/azure/identity/_credentials/browser.py | 7 ------- .../azure/identity/_credentials/certificate.py | 4 ---- .../azure/identity/_credentials/client_secret.py | 4 ---- .../azure/identity/_credentials/device_code.py | 7 ------- .../azure/identity/_credentials/shared_cache.py | 4 ---- .../azure/identity/_credentials/user_password.py | 4 ---- .../azure-identity/azure/identity/_internal/interactive.py | 2 -- .../azure/identity/aio/_credentials/client_secret.py | 4 ---- .../azure/identity/aio/_credentials/shared_cache.py | 4 ---- 9 files changed, 40 deletions(-) diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/browser.py b/sdk/identity/azure-identity/azure/identity/_credentials/browser.py index cf860f5b39f1..2726c425074a 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/browser.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/browser.py @@ -36,13 +36,6 @@ class InteractiveBrowserCredential(InteractiveCredential): authenticate work or school accounts. :keyword str client_id: Client ID of the Azure Active Directory application users will sign in to. If unspecified, the Azure CLI's ID will be used. - :keyword AuthenticationRecord authentication_record: :class:`AuthenticationRecord` returned by :func:`authenticate` - :keyword bool disable_automatic_authentication: if True, :func:`get_token` will raise - :class:`AuthenticationRequiredError` when user interaction is required to acquire a token. Defaults to False. - :keyword bool enable_persistent_cache: if True, the credential will store tokens in a persistent cache shared by - other user credentials. Defaults to False. - :keyword bool allow_unencrypted_cache: if True, the credential will fall back to a plaintext cache on platforms - where encryption is unavailable. Default to False. Has no effect when `enable_persistent_cache` is False. :keyword int timeout: seconds to wait for the user to complete authentication. Defaults to 300 (5 minutes). """ diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py b/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py index 35c81b2e3da5..8ae461c8ef78 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py @@ -25,10 +25,6 @@ class CertificateCredential(CertificateCredentialBase): :keyword password: The certificate's password. If a unicode string, it will be encoded as UTF-8. If the certificate requires a different encoding, pass appropriately encoded bytes instead. :paramtype password: str or bytes - :keyword bool enable_persistent_cache: if True, the credential will store tokens in a persistent cache. Defaults to - False. - :keyword bool allow_unencrypted_cache: if True, the credential will fall back to a plaintext cache when encryption - is unavailable. Default to False. Has no effect when `enable_persistent_cache` is False. """ @log_get_token("CertificateCredential") diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py b/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py index a327416cd731..54bce366781a 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py @@ -26,10 +26,6 @@ class ClientSecretCredential(ClientSecretCredentialBase): :keyword str authority: Authority of an Azure Active Directory endpoint, for example 'login.microsoftonline.com', the authority for Azure Public Cloud (which is the default). :class:`~azure.identity.AzureAuthorityHosts` defines authorities for other clouds. - :keyword bool enable_persistent_cache: if True, the credential will store tokens in a persistent cache. Defaults to - False. - :keyword bool allow_unencrypted_cache: if True, the credential will fall back to a plaintext cache when encryption - is unavailable. Default to False. Has no effect when `enable_persistent_cache` is False. """ @log_get_token("ClientSecretCredential") diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/device_code.py b/sdk/identity/azure-identity/azure/identity/_credentials/device_code.py index 87fc9e738a31..37278c2a7a16 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/device_code.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/device_code.py @@ -46,13 +46,6 @@ class DeviceCodeCredential(InteractiveCredential): - ``expires_on`` (datetime.datetime) the UTC time at which the code will expire If this argument isn't provided, the credential will print instructions to stdout. :paramtype prompt_callback: Callable[str, str, ~datetime.datetime] - :keyword AuthenticationRecord authentication_record: :class:`AuthenticationRecord` returned by :func:`authenticate` - :keyword bool disable_automatic_authentication: if True, :func:`get_token` will raise - :class:`AuthenticationRequiredError` when user interaction is required to acquire a token. Defaults to False. - :keyword bool enable_persistent_cache: if True, the credential will store tokens in a persistent cache shared by - other user credentials. Defaults to False. - :keyword bool allow_unencrypted_cache: if True, the credential will fall back to a plaintext cache on platforms - where encryption is unavailable. Default to False. Has no effect when `enable_persistent_cache` is False. """ def __init__(self, client_id, **kwargs): diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/shared_cache.py b/sdk/identity/azure-identity/azure/identity/_credentials/shared_cache.py index 741dcc30bf03..59aa7728a8a2 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/shared_cache.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/shared_cache.py @@ -31,10 +31,6 @@ class SharedTokenCacheCredential(SharedTokenCacheBase): defines authorities for other clouds. :keyword str tenant_id: an Azure Active Directory tenant ID. Used to select an account when the cache contains tokens for multiple identities. - :keyword AuthenticationRecord authentication_record: an authentication record returned by a user credential such as - :class:`DeviceCodeCredential` or :class:`InteractiveBrowserCredential` - :keyword bool allow_unencrypted_cache: if True, the credential will fall back to a plaintext cache when encryption - is unavailable. Defaults to False. """ @log_get_token("SharedTokenCacheCredential") diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py b/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py index 1c6c1b3561d6..fa9448aa1bac 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py @@ -33,10 +33,6 @@ class UsernamePasswordCredential(InteractiveCredential): defines authorities for other clouds. :keyword str tenant_id: tenant ID or a domain associated with a tenant. If not provided, defaults to the 'organizations' tenant, which supports only Azure Active Directory work or school accounts. - :keyword bool enable_persistent_cache: if True, the credential will store tokens in a persistent cache shared by - other user credentials. Defaults to False. - :keyword bool allow_unencrypted_cache: if True, the credential will fall back to a plaintext cache on platforms - where encryption is unavailable. Default to False. Has no effect when `enable_persistent_cache` is False. """ def __init__(self, client_id, username, password, **kwargs): diff --git a/sdk/identity/azure-identity/azure/identity/_internal/interactive.py b/sdk/identity/azure-identity/azure/identity/_internal/interactive.py index ab69d252aeb7..0c35c55c789a 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/interactive.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/interactive.py @@ -97,8 +97,6 @@ def get_token(self, *scopes, **kwargs): required data, state, or platform support :raises ~azure.core.exceptions.ClientAuthenticationError: authentication failed. The error's ``message`` attribute gives a reason. - :raises AuthenticationRequiredError: user interaction is necessary to acquire a token, and the credential is - configured not to begin this automatically. Call :func:`authenticate` to begin interactive authentication. """ if not scopes: message = "'get_token' requires at least one scope" diff --git a/sdk/identity/azure-identity/azure/identity/aio/_credentials/client_secret.py b/sdk/identity/azure-identity/azure/identity/aio/_credentials/client_secret.py index bbc0aa98e472..0f8c40cd1db4 100644 --- a/sdk/identity/azure-identity/azure/identity/aio/_credentials/client_secret.py +++ b/sdk/identity/azure-identity/azure/identity/aio/_credentials/client_secret.py @@ -24,10 +24,6 @@ class ClientSecretCredential(AsyncCredentialBase, ClientSecretCredentialBase): :keyword str authority: Authority of an Azure Active Directory endpoint, for example 'login.microsoftonline.com', the authority for Azure Public Cloud (which is the default). :class:`~azure.identity.AzureAuthorityHosts` defines authorities for other clouds. - :keyword bool enable_persistent_cache: if True, the credential will store tokens in a persistent cache. Defaults to - False. - :keyword bool allow_unencrypted_cache: if True, the credential will fall back to a plaintext cache when encryption - is unavailable. Default to False. Has no effect when `enable_persistent_cache` is False. """ async def __aenter__(self): diff --git a/sdk/identity/azure-identity/azure/identity/aio/_credentials/shared_cache.py b/sdk/identity/azure-identity/azure/identity/aio/_credentials/shared_cache.py index a737b8bcecfc..de2fd404fc77 100644 --- a/sdk/identity/azure-identity/azure/identity/aio/_credentials/shared_cache.py +++ b/sdk/identity/azure-identity/azure/identity/aio/_credentials/shared_cache.py @@ -29,10 +29,6 @@ class SharedTokenCacheCredential(SharedTokenCacheBase, AsyncCredentialBase): defines authorities for other clouds. :keyword str tenant_id: an Azure Active Directory tenant ID. Used to select an account when the cache contains tokens for multiple identities. - :keyword AuthenticationRecord authentication_record: an authentication record returned by a user credential such as - :class:`DeviceCodeCredential` or :class:`InteractiveBrowserCredential` - :keyword bool allow_unencrypted_cache: if True, the credential will fall back to a plaintext cache when encryption - is unavailable. Defaults to False. """ async def __aenter__(self): From 5969ccdac3138532078da57719f92fa7f1be80ae Mon Sep 17 00:00:00 2001 From: Charles Lowell Date: Wed, 29 Jul 2020 14:49:50 -0700 Subject: [PATCH 05/14] _allow_unencrypted_cache, _authentication_record, _enable_persistent_cache --- .../identity/_credentials/user_password.py | 2 +- .../_internal/certificate_credential_base.py | 4 ++-- .../client_secret_credential_base.py | 4 ++-- .../azure/identity/_internal/interactive.py | 2 +- .../identity/_internal/msal_credentials.py | 4 ++-- .../identity/_internal/shared_token_cache.py | 4 ++-- .../tests/test_certificate_credential.py | 18 +++++++-------- .../test_certificate_credential_async.py | 18 +++++++-------- .../tests/test_client_secret_credential.py | 18 +++++++-------- .../test_client_secret_credential_async.py | 18 +++++++-------- .../tests/test_interactive_credential.py | 22 +++++++++---------- .../tests/test_shared_cache_credential.py | 14 ++++++------ .../test_shared_cache_credential_async.py | 14 ++++++------ 13 files changed, 71 insertions(+), 71 deletions(-) diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py b/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py index fa9448aa1bac..a5636855a6e1 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py @@ -42,7 +42,7 @@ def __init__(self, client_id, username, password, **kwargs): # first time it's asked for a token. However, we want to ensure this first authentication is not silent, to # validate the given password. This class therefore doesn't document the authentication_record argument, and we # discard it here. - kwargs.pop("authentication_record", None) + kwargs.pop("_authentication_record", None) super(UsernamePasswordCredential, self).__init__(client_id=client_id, **kwargs) self._username = username self._password = password diff --git a/sdk/identity/azure-identity/azure/identity/_internal/certificate_credential_base.py b/sdk/identity/azure-identity/azure/identity/_internal/certificate_credential_base.py index c13fe86d7a29..e799bce87adf 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/certificate_credential_base.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/certificate_credential_base.py @@ -44,9 +44,9 @@ def __init__(self, tenant_id, client_id, certificate_path, **kwargs): self._certificate = AadClientCertificate(pem_bytes, password=password) - enable_persistent_cache = kwargs.pop("enable_persistent_cache", False) + enable_persistent_cache = kwargs.pop("_enable_persistent_cache", False) if enable_persistent_cache: - allow_unencrypted = kwargs.pop("allow_unencrypted_cache", False) + allow_unencrypted = kwargs.pop("_allow_unencrypted_cache", False) cache = load_service_principal_cache(allow_unencrypted) else: cache = TokenCache() diff --git a/sdk/identity/azure-identity/azure/identity/_internal/client_secret_credential_base.py b/sdk/identity/azure-identity/azure/identity/_internal/client_secret_credential_base.py index 4854a396e84f..a8b0a1fdc4ce 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/client_secret_credential_base.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/client_secret_credential_base.py @@ -31,9 +31,9 @@ def __init__(self, tenant_id, client_id, client_secret, **kwargs): "tenant_id should be an Azure Active Directory tenant's id (also called its 'directory id')" ) - enable_persistent_cache = kwargs.pop("enable_persistent_cache", False) + enable_persistent_cache = kwargs.pop("_enable_persistent_cache", False) if enable_persistent_cache: - allow_unencrypted = kwargs.pop("allow_unencrypted_cache", False) + allow_unencrypted = kwargs.pop("_allow_unencrypted_cache", False) cache = load_service_principal_cache(allow_unencrypted) else: cache = TokenCache() diff --git a/sdk/identity/azure-identity/azure/identity/_internal/interactive.py b/sdk/identity/azure-identity/azure/identity/_internal/interactive.py index 0c35c55c789a..835b64bf0333 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/interactive.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/interactive.py @@ -72,7 +72,7 @@ def _build_auth_record(response): class InteractiveCredential(MsalCredential): def __init__(self, **kwargs): self._disable_automatic_authentication = kwargs.pop("disable_automatic_authentication", False) - self._auth_record = kwargs.pop("authentication_record", None) # type: Optional[AuthenticationRecord] + self._auth_record = kwargs.pop("_authentication_record", None) # type: Optional[AuthenticationRecord] if self._auth_record: kwargs.pop("client_id", None) # authentication_record overrides client_id argument tenant_id = kwargs.pop("tenant_id", None) or self._auth_record.tenant_id diff --git a/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py b/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py index fd5034acd4bb..65b8e6efaf83 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py @@ -40,8 +40,8 @@ def __init__(self, client_id, client_credential=None, **kwargs): self._cache = kwargs.pop("_cache", None) # internal, for use in tests if not self._cache: - if kwargs.pop("enable_persistent_cache", False): - allow_unencrypted = kwargs.pop("allow_unencrypted_cache", False) + if kwargs.pop("_enable_persistent_cache", False): + allow_unencrypted = kwargs.pop("_allow_unencrypted_cache", False) self._cache = load_user_cache(allow_unencrypted) else: self._cache = msal.TokenCache() diff --git a/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py b/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py index 1ee68bfe0649..d5ca344fa80b 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py @@ -90,7 +90,7 @@ class SharedTokenCacheBase(ABC): def __init__(self, username=None, **kwargs): # pylint:disable=unused-argument # type: (Optional[str], **Any) -> None - self._auth_record = kwargs.pop("authentication_record", None) # type: Optional[AuthenticationRecord] + self._auth_record = kwargs.pop("_authentication_record", None) # type: Optional[AuthenticationRecord] if self._auth_record: # authenticate in the tenant that produced the record unless 'tenant_id' specifies another authenticating_tenant = kwargs.pop("tenant_id", None) or self._auth_record.tenant_id @@ -118,7 +118,7 @@ def _initialize(self): return if not self._cache and self.supported(): - allow_unencrypted = self._client_kwargs.get("allow_unencrypted_cache", False) + allow_unencrypted = self._client_kwargs.get("_allow_unencrypted_cache", False) try: self._cache = load_user_cache(allow_unencrypted) except Exception: # pylint:disable=broad-except diff --git a/sdk/identity/azure-identity/tests/test_certificate_credential.py b/sdk/identity/azure-identity/tests/test_certificate_credential.py index af0eee63c580..1d0c332cf7f6 100644 --- a/sdk/identity/azure-identity/tests/test_certificate_credential.py +++ b/sdk/identity/azure-identity/tests/test_certificate_credential.py @@ -157,20 +157,20 @@ def test_enable_persistent_cache(cert_path, cert_password): CertificateCredential(*required_arguments, password=cert_password) # allowing an unencrypted cache doesn't count as opting in to the persistent cache - CertificateCredential(*required_arguments, password=cert_password, allow_unencrypted_cache=True) + CertificateCredential(*required_arguments, password=cert_password, _allow_unencrypted_cache=True) # keyword argument opts in to persistent cache with patch(persistent_cache + ".msal_extensions") as mock_extensions: - CertificateCredential(*required_arguments, password=cert_password, enable_persistent_cache=True) + CertificateCredential(*required_arguments, password=cert_password, _enable_persistent_cache=True) assert mock_extensions.PersistedTokenCache.call_count == 1 # opting in on an unsupported platform raises an exception with patch(persistent_cache + ".sys.platform", "commodore64"): with pytest.raises(NotImplementedError): - CertificateCredential(*required_arguments, password=cert_password, enable_persistent_cache=True) + CertificateCredential(*required_arguments, password=cert_password, _enable_persistent_cache=True) with pytest.raises(NotImplementedError): CertificateCredential( - *required_arguments, password=cert_password, enable_persistent_cache=True, allow_unencrypted_cache=True + *required_arguments, password=cert_password, _enable_persistent_cache=True, _allow_unencrypted_cache=True ) @@ -187,7 +187,7 @@ def test_persistent_cache_linux(mock_extensions, cert_path, cert_password): # the credential should prefer an encrypted cache even when the user allows an unencrypted one CertificateCredential( - *required_arguments, password=cert_password, enable_persistent_cache=True, allow_unencrypted_cache=True + *required_arguments, password=cert_password, _enable_persistent_cache=True, _allow_unencrypted_cache=True ) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.LibsecretPersistence) mock_extensions.PersistedTokenCache.reset_mock() @@ -197,10 +197,10 @@ def test_persistent_cache_linux(mock_extensions, cert_path, cert_password): # encryption unavailable, no opt in to unencrypted cache -> credential should raise with pytest.raises(ValueError): - CertificateCredential(*required_arguments, password=cert_password, enable_persistent_cache=True) + CertificateCredential(*required_arguments, password=cert_password, _enable_persistent_cache=True) CertificateCredential( - *required_arguments, password=cert_password, enable_persistent_cache=True, allow_unencrypted_cache=True + *required_arguments, password=cert_password, _enable_persistent_cache=True, _allow_unencrypted_cache=True ) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.FilePersistence) @@ -222,11 +222,11 @@ def test_persistent_cache_multiple_clients(cert_path, cert_password): with patch("azure.identity._internal.persistent_cache._load_persistent_cache") as mock_cache_loader: mock_cache_loader.return_value = Mock(wraps=cache) credential_a = CertificateCredential( - "tenant", "client-a", cert_path, password=cert_password, enable_persistent_cache=True, transport=transport_a + "tenant", "client-a", cert_path, password=cert_password, _enable_persistent_cache=True, transport=transport_a ) assert mock_cache_loader.call_count == 1, "credential should load the persistent cache" credential_b = CertificateCredential( - "tenant", "client-b", cert_path, password=cert_password, enable_persistent_cache=True, transport=transport_b + "tenant", "client-b", cert_path, password=cert_password, _enable_persistent_cache=True, transport=transport_b ) assert mock_cache_loader.call_count == 2, "credential should load the persistent cache" diff --git a/sdk/identity/azure-identity/tests/test_certificate_credential_async.py b/sdk/identity/azure-identity/tests/test_certificate_credential_async.py index 01d2839fc2cc..9d0f5a2e08cb 100644 --- a/sdk/identity/azure-identity/tests/test_certificate_credential_async.py +++ b/sdk/identity/azure-identity/tests/test_certificate_credential_async.py @@ -149,20 +149,20 @@ def test_enable_persistent_cache(cert_path, cert_password): CertificateCredential(*required_arguments, password=cert_password) # allowing an unencrypted cache doesn't count as opting in to the persistent cache - CertificateCredential(*required_arguments, password=cert_password, allow_unencrypted_cache=True) + CertificateCredential(*required_arguments, password=cert_password, _allow_unencrypted_cache=True) # keyword argument opts in to persistent cache with patch(persistent_cache + ".msal_extensions") as mock_extensions: - CertificateCredential(*required_arguments, password=cert_password, enable_persistent_cache=True) + CertificateCredential(*required_arguments, password=cert_password, _enable_persistent_cache=True) assert mock_extensions.PersistedTokenCache.call_count == 1 # opting in on an unsupported platform raises an exception with patch(persistent_cache + ".sys.platform", "commodore64"): with pytest.raises(NotImplementedError): - CertificateCredential(*required_arguments, password=cert_password, enable_persistent_cache=True) + CertificateCredential(*required_arguments, password=cert_password, _enable_persistent_cache=True) with pytest.raises(NotImplementedError): CertificateCredential( - *required_arguments, password=cert_password, enable_persistent_cache=True, allow_unencrypted_cache=True + *required_arguments, password=cert_password, _enable_persistent_cache=True, _allow_unencrypted_cache=True ) @@ -179,7 +179,7 @@ def test_persistent_cache_linux(mock_extensions, cert_path, cert_password): # the credential should prefer an encrypted cache even when the user allows an unencrypted one CertificateCredential( - *required_arguments, password=cert_password, enable_persistent_cache=True, allow_unencrypted_cache=True + *required_arguments, password=cert_password, _enable_persistent_cache=True, _allow_unencrypted_cache=True ) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.LibsecretPersistence) mock_extensions.PersistedTokenCache.reset_mock() @@ -189,10 +189,10 @@ def test_persistent_cache_linux(mock_extensions, cert_path, cert_password): # encryption unavailable, no opt in to unencrypted cache -> credential should raise with pytest.raises(ValueError): - CertificateCredential(*required_arguments, password=cert_password, enable_persistent_cache=True) + CertificateCredential(*required_arguments, password=cert_password, _enable_persistent_cache=True) CertificateCredential( - *required_arguments, password=cert_password, enable_persistent_cache=True, allow_unencrypted_cache=True + *required_arguments, password=cert_password, _enable_persistent_cache=True, _allow_unencrypted_cache=True ) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.FilePersistence) @@ -215,11 +215,11 @@ async def test_persistent_cache_multiple_clients(cert_path, cert_password): with patch("azure.identity._internal.persistent_cache._load_persistent_cache") as mock_cache_loader: mock_cache_loader.return_value = Mock(wraps=cache) credential_a = CertificateCredential( - "tenant", "client-a", cert_path, password=cert_password, enable_persistent_cache=True, transport=transport_a + "tenant", "client-a", cert_path, password=cert_password, _enable_persistent_cache=True, transport=transport_a ) assert mock_cache_loader.call_count == 1, "credential should load the persistent cache" credential_b = CertificateCredential( - "tenant", "client-b", cert_path, password=cert_password, enable_persistent_cache=True, transport=transport_b + "tenant", "client-b", cert_path, password=cert_password, _enable_persistent_cache=True, transport=transport_b ) assert mock_cache_loader.call_count == 2, "credential should load the persistent cache" diff --git a/sdk/identity/azure-identity/tests/test_client_secret_credential.py b/sdk/identity/azure-identity/tests/test_client_secret_credential.py index ea3362a3f0ff..542ea203fe10 100644 --- a/sdk/identity/azure-identity/tests/test_client_secret_credential.py +++ b/sdk/identity/azure-identity/tests/test_client_secret_credential.py @@ -158,19 +158,19 @@ def test_enable_persistent_cache(): ClientSecretCredential(*required_arguments) # allowing an unencrypted cache doesn't count as opting in to the persistent cache - ClientSecretCredential(*required_arguments, allow_unencrypted_cache=True) + ClientSecretCredential(*required_arguments, _allow_unencrypted_cache=True) # keyword argument opts in to persistent cache with patch(persistent_cache + ".msal_extensions") as mock_extensions: - ClientSecretCredential(*required_arguments, enable_persistent_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True) assert mock_extensions.PersistedTokenCache.call_count == 1 # opting in on an unsupported platform raises an exception with patch(persistent_cache + ".sys.platform", "commodore64"): with pytest.raises(NotImplementedError): - ClientSecretCredential(*required_arguments, enable_persistent_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True) with pytest.raises(NotImplementedError): - ClientSecretCredential(*required_arguments, enable_persistent_cache=True, allow_unencrypted_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True, _allow_unencrypted_cache=True) @patch("azure.identity._internal.persistent_cache.sys.platform", "linux2") @@ -184,7 +184,7 @@ def test_persistent_cache_linux(mock_extensions): required_arguments = ("tenant-id", "client-id", "secret") # the credential should prefer an encrypted cache even when the user allows an unencrypted one - ClientSecretCredential(*required_arguments, enable_persistent_cache=True, allow_unencrypted_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True, _allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.LibsecretPersistence) mock_extensions.PersistedTokenCache.reset_mock() @@ -193,9 +193,9 @@ def test_persistent_cache_linux(mock_extensions): # encryption unavailable, no opt in to unencrypted cache -> credential should raise with pytest.raises(ValueError): - ClientSecretCredential(*required_arguments, enable_persistent_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True) - ClientSecretCredential(*required_arguments, enable_persistent_cache=True, allow_unencrypted_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True, _allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.FilePersistence) @@ -215,11 +215,11 @@ def test_persistent_cache_multiple_clients(): with patch("azure.identity._internal.persistent_cache._load_persistent_cache") as mock_cache_loader: mock_cache_loader.return_value = Mock(wraps=cache) credential_a = ClientSecretCredential( - "tenant-id", "client-a", "...", enable_persistent_cache=True, transport=transport_a + "tenant-id", "client-a", "...", _enable_persistent_cache=True, transport=transport_a ) assert mock_cache_loader.call_count == 1, "credential should load the persistent cache" credential_b = ClientSecretCredential( - "tenant-id", "client-b", "...", enable_persistent_cache=True, transport=transport_b + "tenant-id", "client-b", "...", _enable_persistent_cache=True, transport=transport_b ) assert mock_cache_loader.call_count == 2, "credential should load the persistent cache" diff --git a/sdk/identity/azure-identity/tests/test_client_secret_credential_async.py b/sdk/identity/azure-identity/tests/test_client_secret_credential_async.py index 4731f1cb7bc2..24ff4f3dc224 100644 --- a/sdk/identity/azure-identity/tests/test_client_secret_credential_async.py +++ b/sdk/identity/azure-identity/tests/test_client_secret_credential_async.py @@ -184,19 +184,19 @@ def test_enable_persistent_cache(): ClientSecretCredential(*required_arguments) # allowing an unencrypted cache doesn't count as opting in to the persistent cache - ClientSecretCredential(*required_arguments, allow_unencrypted_cache=True) + ClientSecretCredential(*required_arguments, _allow_unencrypted_cache=True) # keyword argument opts in to persistent cache with patch(persistent_cache + ".msal_extensions") as mock_extensions: - ClientSecretCredential(*required_arguments, enable_persistent_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True) assert mock_extensions.PersistedTokenCache.call_count == 1 # opting in on an unsupported platform raises an exception with patch(persistent_cache + ".sys.platform", "commodore64"): with pytest.raises(NotImplementedError): - ClientSecretCredential(*required_arguments, enable_persistent_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True) with pytest.raises(NotImplementedError): - ClientSecretCredential(*required_arguments, enable_persistent_cache=True, allow_unencrypted_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True, _allow_unencrypted_cache=True) @patch("azure.identity._internal.persistent_cache.sys.platform", "linux2") @@ -210,7 +210,7 @@ def test_persistent_cache_linux(mock_extensions): required_arguments = ("tenant-id", "client-id", "secret") # the credential should prefer an encrypted cache even when the user allows an unencrypted one - ClientSecretCredential(*required_arguments, enable_persistent_cache=True, allow_unencrypted_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True, _allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.LibsecretPersistence) mock_extensions.PersistedTokenCache.reset_mock() @@ -219,9 +219,9 @@ def test_persistent_cache_linux(mock_extensions): # encryption unavailable, no opt in to unencrypted cache -> credential should raise with pytest.raises(ValueError): - ClientSecretCredential(*required_arguments, enable_persistent_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True) - ClientSecretCredential(*required_arguments, enable_persistent_cache=True, allow_unencrypted_cache=True) + ClientSecretCredential(*required_arguments, _enable_persistent_cache=True, _allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.FilePersistence) @@ -242,11 +242,11 @@ async def test_persistent_cache_multiple_clients(): with patch("azure.identity._internal.persistent_cache._load_persistent_cache") as mock_cache_loader: mock_cache_loader.return_value = Mock(wraps=cache) credential_a = ClientSecretCredential( - "tenant-id", "client-a", "...", enable_persistent_cache=True, transport=transport_a + "tenant-id", "client-a", "...", _enable_persistent_cache=True, transport=transport_a ) assert mock_cache_loader.call_count == 1, "credential should load the persistent cache" credential_b = ClientSecretCredential( - "tenant-id", "client-b", "...", enable_persistent_cache=True, transport=transport_b + "tenant-id", "client-b", "...", _enable_persistent_cache=True, transport=transport_b ) assert mock_cache_loader.call_count == 2, "credential should load the persistent cache" diff --git a/sdk/identity/azure-identity/tests/test_interactive_credential.py b/sdk/identity/azure-identity/tests/test_interactive_credential.py index 2eb5aa6e4eb7..dbce35f5f9b2 100644 --- a/sdk/identity/azure-identity/tests/test_interactive_credential.py +++ b/sdk/identity/azure-identity/tests/test_interactive_credential.py @@ -64,7 +64,7 @@ def validate_app_parameters(authority, client_id, **_): app_factory = Mock(wraps=validate_app_parameters) credential = MockCredential( - authentication_record=record, disable_automatic_authentication=True, msal_app_factory=app_factory, + _authentication_record=record, disable_automatic_authentication=True, msal_app_factory=app_factory, ) with pytest.raises(AuthenticationRequiredError): credential.get_token("scope") @@ -87,7 +87,7 @@ def validate_authority(authority, **_): return Mock(get_accounts=Mock(return_value=[])) credential = MockCredential( - authentication_record=record, + _authentication_record=record, tenant_id=expected_tenant, disable_automatic_authentication=True, msal_app_factory=validate_authority, @@ -107,7 +107,7 @@ def test_disable_automatic_authentication(): ) credential = MockCredential( - authentication_record=record, + _authentication_record=record, disable_automatic_authentication=True, msal_app_factory=lambda *_, **__: msal_app, request_token=Mock(side_effect=Exception("credential shouldn't begin interactive authentication")), @@ -190,7 +190,7 @@ class CustomException(Exception): acquire_token_silent_with_error=Mock(side_effect=CustomException(expected_message)), get_accounts=Mock(return_value=[{"home_account_id": record.home_account_id}]), ) - credential = MockCredential(msal_app_factory=lambda *_, **__: msal_app, authentication_record=record) + credential = MockCredential(msal_app_factory=lambda *_, **__: msal_app, _authentication_record=record) with pytest.raises(ClientAuthenticationError) as ex: credential.get_token("scope") @@ -220,20 +220,20 @@ def _request_token(self, *_, **__): assert credential._cache is in_memory_cache # allowing an unencrypted cache doesn't count as opting in to the persistent cache - credential = TestCredential(allow_unencrypted_cache=True) + credential = TestCredential(_allow_unencrypted_cache=True) assert credential._cache is in_memory_cache # keyword argument opts in to persistent cache with patch(persistent_cache + ".msal_extensions") as mock_extensions: - TestCredential(enable_persistent_cache=True) + TestCredential(_enable_persistent_cache=True) assert mock_extensions.PersistedTokenCache.call_count == 1 # opting in on an unsupported platform raises an exception with patch(persistent_cache + ".sys.platform", "commodore64"): with pytest.raises(NotImplementedError): - TestCredential(enable_persistent_cache=True) + TestCredential(_enable_persistent_cache=True) with pytest.raises(NotImplementedError): - TestCredential(enable_persistent_cache=True, allow_unencrypted_cache=True) + TestCredential(_enable_persistent_cache=True, _allow_unencrypted_cache=True) @patch("azure.identity._internal.persistent_cache.sys.platform", "linux2") @@ -252,7 +252,7 @@ def _request_token(self, *_, **__): pass # the credential should prefer an encrypted cache even when the user allows an unencrypted one - TestCredential(enable_persistent_cache=True, allow_unencrypted_cache=True) + TestCredential(_enable_persistent_cache=True, _allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.LibsecretPersistence) mock_extensions.PersistedTokenCache.reset_mock() @@ -261,9 +261,9 @@ def _request_token(self, *_, **__): # encryption unavailable, no opt in to unencrypted cache -> credential should raise with pytest.raises(ValueError): - TestCredential(enable_persistent_cache=True) + TestCredential(_enable_persistent_cache=True) - TestCredential(enable_persistent_cache=True, allow_unencrypted_cache=True) + TestCredential(_enable_persistent_cache=True, _allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.FilePersistence) diff --git a/sdk/identity/azure-identity/tests/test_shared_cache_credential.py b/sdk/identity/azure-identity/tests/test_shared_cache_credential.py index a64288c9c40f..55b6c87e70ae 100644 --- a/sdk/identity/azure-identity/tests/test_shared_cache_credential.py +++ b/sdk/identity/azure-identity/tests/test_shared_cache_credential.py @@ -511,7 +511,7 @@ def test_authority_environment_variable(): def test_authentication_record_empty_cache(): record = AuthenticationRecord("tenant_id", "client_id", "authority", "home_account_id", "username") transport = Mock(side_effect=Exception("the credential shouldn't send a request")) - credential = SharedTokenCacheCredential(authentication_record=record, transport=transport, _cache=TokenCache()) + credential = SharedTokenCacheCredential(_authentication_record=record, transport=transport, _cache=TokenCache()) with pytest.raises(CredentialUnavailableError): credential.get_token("scope") @@ -532,7 +532,7 @@ def test_authentication_record_no_match(): "not-" + username, "not-" + object_id, "different-" + tenant_id, client_id="not-" + client_id, ), ) - credential = SharedTokenCacheCredential(authentication_record=record, transport=transport, _cache=cache) + credential = SharedTokenCacheCredential(_authentication_record=record, transport=transport, _cache=cache) with pytest.raises(CredentialUnavailableError): credential.get_token("scope") @@ -558,7 +558,7 @@ def test_authentication_record(): requests=[Request(authority=authority, required_data={"refresh_token": expected_refresh_token})], responses=[mock_response(json_payload=build_aad_response(access_token=expected_access_token))], ) - credential = SharedTokenCacheCredential(authentication_record=record, transport=transport, _cache=cache) + credential = SharedTokenCacheCredential(_authentication_record=record, transport=transport, _cache=cache) token = credential.get_token("scope") assert token.token == expected_access_token @@ -594,7 +594,7 @@ def test_auth_record_multiple_accounts_for_username(): requests=[Request(authority=authority, required_data={"refresh_token": expected_refresh_token})], responses=[mock_response(json_payload=build_aad_response(access_token=expected_access_token))], ) - credential = SharedTokenCacheCredential(authentication_record=record, transport=transport, _cache=cache) + credential = SharedTokenCacheCredential(_authentication_record=record, transport=transport, _cache=cache) token = credential.get_token("scope") assert token.token == expected_access_token @@ -609,7 +609,7 @@ def test_allow_unencrypted_cache(mock_extensions): """ # the credential should prefer an encrypted cache even when the user allows an unencrypted one - SharedTokenCacheCredential(allow_unencrypted_cache=True) + SharedTokenCacheCredential(_allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.LibsecretPersistence) mock_extensions.PersistedTokenCache.reset_mock() @@ -622,7 +622,7 @@ def test_allow_unencrypted_cache(mock_extensions): assert mock_extensions.PersistedTokenCache.call_count == 0 # still no encryption, but now we allow the unencrypted fallback - SharedTokenCacheCredential(allow_unencrypted_cache=True) + SharedTokenCacheCredential(_allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.FilePersistence) @@ -742,7 +742,7 @@ def test_authentication_record_authenticating_tenant(): with patch.object(SharedTokenCacheCredential, "_get_auth_client") as get_auth_client: credential = SharedTokenCacheCredential( - authentication_record=record, _cache=TokenCache(), tenant_id=expected_tenant_id + _authentication_record=record, _cache=TokenCache(), tenant_id=expected_tenant_id ) with pytest.raises(CredentialUnavailableError): # this raises because the cache is empty diff --git a/sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py b/sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py index fd2d9fbb45c4..aafc59b22b71 100644 --- a/sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py +++ b/sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py @@ -594,7 +594,7 @@ async def test_authority_environment_variable(): async def test_authentication_record_empty_cache(): record = AuthenticationRecord("tenant_id", "client_id", "authority", "home_account_id", "username") transport = Mock(side_effect=Exception("the credential shouldn't send a request")) - credential = SharedTokenCacheCredential(authentication_record=record, transport=transport, _cache=TokenCache()) + credential = SharedTokenCacheCredential(_authentication_record=record, transport=transport, _cache=TokenCache()) with pytest.raises(CredentialUnavailableError): await credential.get_token("scope") @@ -616,7 +616,7 @@ async def test_authentication_record_no_match(): "not-" + username, "not-" + object_id, "different-" + tenant_id, client_id="not-" + client_id, ), ) - credential = SharedTokenCacheCredential(authentication_record=record, transport=transport, _cache=cache) + credential = SharedTokenCacheCredential(_authentication_record=record, transport=transport, _cache=cache) with pytest.raises(CredentialUnavailableError): await credential.get_token("scope") @@ -643,7 +643,7 @@ async def test_authentication_record(): requests=[Request(authority=authority, required_data={"refresh_token": expected_refresh_token})], responses=[mock_response(json_payload=build_aad_response(access_token=expected_access_token))], ) - credential = SharedTokenCacheCredential(authentication_record=record, transport=transport, _cache=cache) + credential = SharedTokenCacheCredential(_authentication_record=record, transport=transport, _cache=cache) token = await credential.get_token("scope") assert token.token == expected_access_token @@ -680,7 +680,7 @@ async def test_auth_record_multiple_accounts_for_username(): requests=[Request(authority=authority, required_data={"refresh_token": expected_refresh_token})], responses=[mock_response(json_payload=build_aad_response(access_token=expected_access_token))], ) - credential = SharedTokenCacheCredential(authentication_record=record, transport=transport, _cache=cache) + credential = SharedTokenCacheCredential(_authentication_record=record, transport=transport, _cache=cache) token = await credential.get_token("scope") assert token.token == expected_access_token @@ -695,7 +695,7 @@ async def test_authentication_record_authenticating_tenant(): with patch.object(SharedTokenCacheCredential, "_get_auth_client") as get_auth_client: credential = SharedTokenCacheCredential( - authentication_record=record, _cache=TokenCache(), tenant_id=expected_tenant_id + _authentication_record=record, _cache=TokenCache(), tenant_id=expected_tenant_id ) with pytest.raises(CredentialUnavailableError): # this raises because the cache is empty @@ -720,7 +720,7 @@ async def test_allow_unencrypted_cache(): mock_extensions = msal_extensions_patch.start() # the credential should prefer an encrypted cache even when the user allows an unencrypted one - SharedTokenCacheCredential(allow_unencrypted_cache=True) + SharedTokenCacheCredential(_allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.LibsecretPersistence) mock_extensions.PersistedTokenCache.reset_mock() @@ -734,7 +734,7 @@ async def test_allow_unencrypted_cache(): await credential.get_token("scope") # still no encryption, but now we allow the unencrypted fallback - SharedTokenCacheCredential(allow_unencrypted_cache=True) + SharedTokenCacheCredential(_allow_unencrypted_cache=True) assert mock_extensions.PersistedTokenCache.called_with(mock_extensions.FilePersistence) msal_extensions_patch.stop() From ea94fbc00f3f5d368105cb23f97c0d5c9e89b2ab Mon Sep 17 00:00:00 2001 From: Charles Lowell Date: Wed, 29 Jul 2020 15:27:21 -0700 Subject: [PATCH 06/14] SharedTokenCacheCredential allows unencrypted cache by default --- .../azure/identity/_internal/shared_token_cache.py | 2 +- .../azure-identity/tests/test_shared_cache_credential.py | 1 + .../azure-identity/tests/test_shared_cache_credential_async.py | 3 ++- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py b/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py index d5ca344fa80b..865ccf5e2273 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py @@ -118,7 +118,7 @@ def _initialize(self): return if not self._cache and self.supported(): - allow_unencrypted = self._client_kwargs.get("_allow_unencrypted_cache", False) + allow_unencrypted = self._client_kwargs.get("_allow_unencrypted_cache", True) try: self._cache = load_user_cache(allow_unencrypted) except Exception: # pylint:disable=broad-except diff --git a/sdk/identity/azure-identity/tests/test_shared_cache_credential.py b/sdk/identity/azure-identity/tests/test_shared_cache_credential.py index 55b6c87e70ae..e2b1713c9d07 100644 --- a/sdk/identity/azure-identity/tests/test_shared_cache_credential.py +++ b/sdk/identity/azure-identity/tests/test_shared_cache_credential.py @@ -600,6 +600,7 @@ def test_auth_record_multiple_accounts_for_username(): assert token.token == expected_access_token +@pytest.mark.skip("in 1.4.0 allow_unencrypted_cache is private and defaults to True") @patch("azure.identity._internal.persistent_cache.sys.platform", "linux2") @patch("azure.identity._internal.persistent_cache.msal_extensions") def test_allow_unencrypted_cache(mock_extensions): diff --git a/sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py b/sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py index aafc59b22b71..518913db4eeb 100644 --- a/sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py +++ b/sdk/identity/azure-identity/tests/test_shared_cache_credential_async.py @@ -706,6 +706,7 @@ async def test_authentication_record_authenticating_tenant(): assert kwargs["tenant_id"] == expected_tenant_id +@pytest.mark.skip("in 1.4.0 allow_unencrypted_cache is private and defaults to True") @pytest.mark.asyncio async def test_allow_unencrypted_cache(): """The credential should use an unencrypted cache when encryption is unavailable and the user explicitly allows it. @@ -729,9 +730,9 @@ async def test_allow_unencrypted_cache(): # encryption unavailable, no opt in to unencrypted cache -> credential should be unavailable credential = SharedTokenCacheCredential() - assert mock_extensions.PersistedTokenCache.call_count == 0 with pytest.raises(CredentialUnavailableError): await credential.get_token("scope") + assert mock_extensions.PersistedTokenCache.call_count == 0 # still no encryption, but now we allow the unencrypted fallback SharedTokenCacheCredential(_allow_unencrypted_cache=True) From 9697e03693a6d60c4df76da3e164cc3f1c006393 Mon Sep 17 00:00:00 2001 From: Charles Lowell Date: Wed, 29 Jul 2020 16:35:14 -0700 Subject: [PATCH 07/14] remove SharedTokenCacheCredential from DefaultAzureCredential on Linux --- .../azure/identity/_internal/shared_token_cache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py b/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py index 865ccf5e2273..5c355a834a97 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py @@ -243,4 +243,4 @@ def supported(): :rtype: bool """ - return platform.system() in {"Darwin", "Linux", "Windows"} + return platform.system() in {"Darwin", "Windows"} From 0899e7d9806c80280e1c8176391767190ace5e21 Mon Sep 17 00:00:00 2001 From: Charles Lowell Date: Wed, 29 Jul 2020 15:23:56 -0700 Subject: [PATCH 08/14] update changelog --- sdk/identity/azure-identity/CHANGELOG.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/sdk/identity/azure-identity/CHANGELOG.md b/sdk/identity/azure-identity/CHANGELOG.md index 7f18ff06dbc3..334ce3faead6 100644 --- a/sdk/identity/azure-identity/CHANGELOG.md +++ b/sdk/identity/azure-identity/CHANGELOG.md @@ -5,6 +5,21 @@ `AZURE_CLIENT_ID` to configure a user-assigned managed identity. ([#10931](https://github.com/Azure/azure-sdk-for-python/issues/10931)) +### Breaking Changes +- Removed application authentication APIs added in 1.4.0 beta versions. These + will be reintroduced in 1.5.0b1. + - Changes to `DeviceCodeCredential`, `InteractiveBrowserCredential`, and + `UsernamePasswordCredential`: + - Removed `authenticate` method + - Removed `allow_unencrypted_cache` and `enable_persistent_cache` keyword + arguments + - Removed `allow_unencrypted_cache` and `enable_persistent_cache` keyword + arguments from `CertificateCredential` and `ClientSecretCredential` + - Changes to `SharedTokenCacheCredential`: + - Removed `allow_unencrypted_cache` keyword argument + - On Linux, `SharedTokenCacheCredential.supported()` returns `False` and + this credential is not part of `DefaultAzureCredential` + - Removed classes `AuthenticationRecord` and `AuthenticationRequiredError` ## 1.4.0b7 (2020-07-22) - `DefaultAzureCredential` has a new optional keyword argument, From a00805eb72ea40ea3eb42209811801b298ca4379 Mon Sep 17 00:00:00 2001 From: Charles Lowell Date: Wed, 29 Jul 2020 16:49:12 -0700 Subject: [PATCH 09/14] _disable_automatic_authentication --- .../azure/identity/_internal/interactive.py | 2 +- .../azure-identity/tests/test_browser_credential.py | 2 +- .../tests/test_device_code_credential.py | 2 +- .../tests/test_interactive_credential.py | 10 +++++----- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/sdk/identity/azure-identity/azure/identity/_internal/interactive.py b/sdk/identity/azure-identity/azure/identity/_internal/interactive.py index 835b64bf0333..466c849f069b 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/interactive.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/interactive.py @@ -71,7 +71,7 @@ def _build_auth_record(response): class InteractiveCredential(MsalCredential): def __init__(self, **kwargs): - self._disable_automatic_authentication = kwargs.pop("disable_automatic_authentication", False) + self._disable_automatic_authentication = kwargs.pop("_disable_automatic_authentication", False) self._auth_record = kwargs.pop("_authentication_record", None) # type: Optional[AuthenticationRecord] if self._auth_record: kwargs.pop("client_id", None) # authentication_record overrides client_id argument diff --git a/sdk/identity/azure-identity/tests/test_browser_credential.py b/sdk/identity/azure-identity/tests/test_browser_credential.py index 6f1be7319848..c8d4e9e7fef2 100644 --- a/sdk/identity/azure-identity/tests/test_browser_credential.py +++ b/sdk/identity/azure-identity/tests/test_browser_credential.py @@ -101,7 +101,7 @@ def test_disable_automatic_authentication(): empty_cache = TokenCache() # empty cache makes silent auth impossible transport = Mock(send=Mock(side_effect=Exception("no request should be sent"))) credential = InteractiveBrowserCredential( - disable_automatic_authentication=True, transport=transport, _cache=empty_cache + _disable_automatic_authentication=True, transport=transport, _cache=empty_cache ) with patch(WEBBROWSER_OPEN, Mock(side_effect=Exception("credential shouldn't try interactive authentication"))): diff --git a/sdk/identity/azure-identity/tests/test_device_code_credential.py b/sdk/identity/azure-identity/tests/test_device_code_credential.py index 76497329c076..896b3ef4e1b9 100644 --- a/sdk/identity/azure-identity/tests/test_device_code_credential.py +++ b/sdk/identity/azure-identity/tests/test_device_code_credential.py @@ -94,7 +94,7 @@ def test_disable_automatic_authentication(): empty_cache = TokenCache() # empty cache makes silent auth impossible transport = Mock(send=Mock(side_effect=Exception("no request should be sent"))) - credential = DeviceCodeCredential("client-id", disable_automatic_authentication=True, transport=transport, _cache=empty_cache) + credential = DeviceCodeCredential("client-id", _disable_automatic_authentication=True, transport=transport, _cache=empty_cache) with pytest.raises(AuthenticationRequiredError): credential.get_token("scope") diff --git a/sdk/identity/azure-identity/tests/test_interactive_credential.py b/sdk/identity/azure-identity/tests/test_interactive_credential.py index dbce35f5f9b2..9573c7623632 100644 --- a/sdk/identity/azure-identity/tests/test_interactive_credential.py +++ b/sdk/identity/azure-identity/tests/test_interactive_credential.py @@ -64,7 +64,7 @@ def validate_app_parameters(authority, client_id, **_): app_factory = Mock(wraps=validate_app_parameters) credential = MockCredential( - _authentication_record=record, disable_automatic_authentication=True, msal_app_factory=app_factory, + _authentication_record=record, _disable_automatic_authentication=True, msal_app_factory=app_factory, ) with pytest.raises(AuthenticationRequiredError): credential.get_token("scope") @@ -89,7 +89,7 @@ def validate_authority(authority, **_): credential = MockCredential( _authentication_record=record, tenant_id=expected_tenant, - disable_automatic_authentication=True, + _disable_automatic_authentication=True, msal_app_factory=validate_authority, ) with pytest.raises(AuthenticationRequiredError): @@ -108,7 +108,7 @@ def test_disable_automatic_authentication(): credential = MockCredential( _authentication_record=record, - disable_automatic_authentication=True, + _disable_automatic_authentication=True, msal_app_factory=lambda *_, **__: msal_app, request_token=Mock(side_effect=Exception("credential shouldn't begin interactive authentication")), ) @@ -132,7 +132,7 @@ def validate_scopes(*scopes, **_): return {"access_token": "**", "expires_in": 42} request_token = Mock(wraps=validate_scopes) - credential = MockCredential(disable_automatic_authentication=True, request_token=request_token) + credential = MockCredential(_disable_automatic_authentication=True, request_token=request_token) with pytest.raises(AuthenticationRequiredError) as ex: credential.get_token(scope) @@ -174,7 +174,7 @@ def test_authenticate_ignores_disable_automatic_authentication(option): """authenticate should prompt for authentication regardless of the credential's configuration""" request_token = Mock(return_value={"access_token": "**", "expires_in": 42}) - MockCredential(request_token=request_token, disable_automatic_authentication=option)._authenticate() + MockCredential(request_token=request_token, _disable_automatic_authentication=option)._authenticate() assert request_token.call_count == 1, "credential didn't begin interactive authentication" From c430f0479686f3b7268c6c44387a5710c7a0ddf5 Mon Sep 17 00:00:00 2001 From: Charles Lowell Date: Wed, 29 Jul 2020 16:54:53 -0700 Subject: [PATCH 10/14] second draft of changelog entry --- sdk/identity/azure-identity/CHANGELOG.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/sdk/identity/azure-identity/CHANGELOG.md b/sdk/identity/azure-identity/CHANGELOG.md index 334ce3faead6..e5f9c8acc01f 100644 --- a/sdk/identity/azure-identity/CHANGELOG.md +++ b/sdk/identity/azure-identity/CHANGELOG.md @@ -8,13 +8,14 @@ ### Breaking Changes - Removed application authentication APIs added in 1.4.0 beta versions. These will be reintroduced in 1.5.0b1. - - Changes to `DeviceCodeCredential`, `InteractiveBrowserCredential`, and - `UsernamePasswordCredential`: - - Removed `authenticate` method - - Removed `allow_unencrypted_cache` and `enable_persistent_cache` keyword - arguments + - Removed `authenticate` method from `DeviceCodeCredential`, + `InteractiveBrowserCredential`, and `UsernamePasswordCredential` - Removed `allow_unencrypted_cache` and `enable_persistent_cache` keyword - arguments from `CertificateCredential` and `ClientSecretCredential` + arguments from `CertificateCredential`, `ClientSecretCredential`, + `DeviceCodeCredential`, `InteractiveBrowserCredential`, and + `UsernamePasswordCredential` + - Removed `disable_automatic_authentication` keyword argument from + `DeviceCodeCredential` and `InteractiveBrowserCredential` - Changes to `SharedTokenCacheCredential`: - Removed `allow_unencrypted_cache` keyword argument - On Linux, `SharedTokenCacheCredential.supported()` returns `False` and From 965bbcb4c0eff01ed0b6e13190102838a49cf1c7 Mon Sep 17 00:00:00 2001 From: Charles Lowell Date: Thu, 30 Jul 2020 08:04:09 -0700 Subject: [PATCH 11/14] Revert "remove SharedTokenCacheCredential from DefaultAzureCredential on Linux" --- sdk/identity/azure-identity/CHANGELOG.md | 6 ++---- .../azure/identity/_internal/shared_token_cache.py | 2 +- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/sdk/identity/azure-identity/CHANGELOG.md b/sdk/identity/azure-identity/CHANGELOG.md index e5f9c8acc01f..d811e4ef6e92 100644 --- a/sdk/identity/azure-identity/CHANGELOG.md +++ b/sdk/identity/azure-identity/CHANGELOG.md @@ -16,10 +16,8 @@ `UsernamePasswordCredential` - Removed `disable_automatic_authentication` keyword argument from `DeviceCodeCredential` and `InteractiveBrowserCredential` - - Changes to `SharedTokenCacheCredential`: - - Removed `allow_unencrypted_cache` keyword argument - - On Linux, `SharedTokenCacheCredential.supported()` returns `False` and - this credential is not part of `DefaultAzureCredential` + - Removed `allow_unencrypted_cache` keyword argument from + `SharedTokenCacheCredential` - Removed classes `AuthenticationRecord` and `AuthenticationRequiredError` ## 1.4.0b7 (2020-07-22) diff --git a/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py b/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py index 5c355a834a97..865ccf5e2273 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/shared_token_cache.py @@ -243,4 +243,4 @@ def supported(): :rtype: bool """ - return platform.system() in {"Darwin", "Windows"} + return platform.system() in {"Darwin", "Linux", "Windows"} From bddbb4e096ed9378e42050f62a3cfcf0af498fc4 Mon Sep 17 00:00:00 2001 From: Charles Lowell Date: Thu, 30 Jul 2020 08:46:33 -0700 Subject: [PATCH 12/14] remove samples --- sdk/identity/azure-identity/MANIFEST.in | 1 - sdk/identity/azure-identity/samples/README.md | 37 ---------------- .../samples/control_interactive_prompts.py | 38 ---------------- .../samples/user_authentication.py | 43 ------------------- 4 files changed, 119 deletions(-) delete mode 100644 sdk/identity/azure-identity/samples/README.md delete mode 100644 sdk/identity/azure-identity/samples/control_interactive_prompts.py delete mode 100644 sdk/identity/azure-identity/samples/user_authentication.py diff --git a/sdk/identity/azure-identity/MANIFEST.in b/sdk/identity/azure-identity/MANIFEST.in index 2dfaac2ca8aa..3eee8c39c7a7 100644 --- a/sdk/identity/azure-identity/MANIFEST.in +++ b/sdk/identity/azure-identity/MANIFEST.in @@ -1,4 +1,3 @@ -recursive-exclude samples *.py recursive-include tests *.py include *.md include azure/__init__.py diff --git a/sdk/identity/azure-identity/samples/README.md b/sdk/identity/azure-identity/samples/README.md deleted file mode 100644 index 35a9cd502650..000000000000 --- a/sdk/identity/azure-identity/samples/README.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -page_type: sample -languages: - - python -products: - - azure - - azure-identity -urlFragment: identity-samples ---- - -# Azure Identity Library Python Samples - -## Prerequisites - -You must have an [Azure subscription](https://azure.microsoft.com/free) and an -[Azure Key Vault](https://azure.microsoft.com/en-us/services/key-vault/) to run -these samples. You can create a Key Vault in the -[Azure Portal](https://portal.azure.com/#create/Microsoft.KeyVault) or with the -[Azure CLI](https://docs.microsoft.com/en-us/azure/key-vault/secrets/quick-create-cli). - -Azure Key Vault is used only to demonstrate authentication. Azure Identity has -the same API for all compatible client libraries. - -## Setup - -To run these samples, first install the Azure Identity and Key Vault Secrets -client libraries: - -```commandline -pip install azure-identity azure-keyvault-secrets -``` - -## Contents -| File | Description | -|-------------|-------------| -| control_interactive_prompts.py | demonstrates controlling when interactive credentials prompt for user interaction | -| user_authentication.py | demonstrates user authentication API for applications | diff --git a/sdk/identity/azure-identity/samples/control_interactive_prompts.py b/sdk/identity/azure-identity/samples/control_interactive_prompts.py deleted file mode 100644 index 10dabf65e9d2..000000000000 --- a/sdk/identity/azure-identity/samples/control_interactive_prompts.py +++ /dev/null @@ -1,38 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -"""Demonstrates controlling the timing of interactive authentication using InteractiveBrowserCredential. - -DeviceCodeCredential supports the same API. -""" - -import os -import sys -from azure.identity import AuthenticationRequiredError, InteractiveBrowserCredential -from azure.keyvault.secrets import SecretClient - - -# This sample uses Key Vault only for demonstration. Any client accepting azure-identity credentials will work the same. -VAULT_URL = os.environ.get("VAULT_URL") -if not VAULT_URL: - print("This sample expects environment variable 'VAULT_URL' to be set with the URL of a Key Vault.") - sys.exit(1) - - -# If it's important for your application to prompt for authentication only at certain times, -# create the credential with disable_automatic_authentication=True. This configures the credential to raise -# when interactive authentication is required, instead of immediately beginning that authentication. -credential = InteractiveBrowserCredential(disable_automatic_authentication=True) -client = SecretClient(VAULT_URL, credential) - -try: - secret_names = [s.name for s in client.list_properties_of_secrets()] -except AuthenticationRequiredError as ex: - # Interactive authentication is necessary to authorize the client's request. The exception carries the - # requested authentication scopes. If you pass these to 'authenticate', it will cache an access token - # for those scopes. - credential.authenticate(scopes=ex.scopes) - -# the client operation should now succeed -secret_names = [s.name for s in client.list_properties_of_secrets()] diff --git a/sdk/identity/azure-identity/samples/user_authentication.py b/sdk/identity/azure-identity/samples/user_authentication.py deleted file mode 100644 index 2c21c2a44973..000000000000 --- a/sdk/identity/azure-identity/samples/user_authentication.py +++ /dev/null @@ -1,43 +0,0 @@ -# ------------------------------------ -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. -# ------------------------------------ -"""Demonstrates user authentication using InteractiveBrowserCredential. DeviceCodeCredential supports the same API.""" - -import os -import sys -from azure.identity import AuthenticationRecord, InteractiveBrowserCredential -from azure.keyvault.secrets import SecretClient - - -# This sample uses Key Vault only for demonstration. Any client accepting azure-identity credentials will work the same. -VAULT_URL = os.environ.get("VAULT_URL") -if not VAULT_URL: - print("This sample expects environment variable 'VAULT_URL' to be set with the URL of a Key Vault.") - sys.exit(1) - - -# Persistent caching is optional. By default, interactive credentials cache in memory only. -credential = InteractiveBrowserCredential(enable_persistent_cache=True) - -# The 'authenticate' method begins interactive authentication. Call it whenever it's convenient -# for your application to authenticate a user. It returns a record of the authentication. -record = credential.authenticate() - -# The record contains no authentication secrets. You can serialize it to JSON for storage. -record_json = record.serialize() - -# An authenticated credential is ready for use with a client. This request should succeed -# without prompting for authentication again. -client = SecretClient(VAULT_URL, credential) -secret_names = [s.name for s in client.list_properties_of_secrets()] - -# With persistent caching enabled, an authentication record stored by your application enables -# credentials to access data from past authentications. If the cache contains sufficient data, -# this eliminates the need for your application to prompt for authentication every time it runs. -deserialized_record = AuthenticationRecord.deserialize(record_json) -new_credential = InteractiveBrowserCredential(enable_persistent_cache=True, authentication_record=deserialized_record) - -# This request should also succeed without prompting for authentication. -client = SecretClient(VAULT_URL, new_credential) -secret_names = [s.name for s in client.list_properties_of_secrets()] From a34dc78f1d4c88e363c42c0f56e94890c19f66b6 Mon Sep 17 00:00:00 2001 From: Charles Lowell Date: Mon, 3 Aug 2020 13:30:24 -0700 Subject: [PATCH 13/14] identity_config -> _identity_config --- sdk/identity/azure-identity/CHANGELOG.md | 1 + .../azure/identity/_credentials/managed_identity.py | 6 +----- .../azure/identity/aio/_credentials/managed_identity.py | 4 ---- sdk/identity/azure-identity/tests/test_imds_credential.py | 2 +- .../azure-identity/tests/test_imds_credential_async.py | 2 +- sdk/identity/azure-identity/tests/test_msi_credential.py | 4 ++-- .../azure-identity/tests/test_msi_credential_async.py | 4 ++-- 7 files changed, 8 insertions(+), 15 deletions(-) diff --git a/sdk/identity/azure-identity/CHANGELOG.md b/sdk/identity/azure-identity/CHANGELOG.md index d811e4ef6e92..1e172bcd2eb1 100644 --- a/sdk/identity/azure-identity/CHANGELOG.md +++ b/sdk/identity/azure-identity/CHANGELOG.md @@ -19,6 +19,7 @@ - Removed `allow_unencrypted_cache` keyword argument from `SharedTokenCacheCredential` - Removed classes `AuthenticationRecord` and `AuthenticationRequiredError` + - Removed `identity_config` keyword argument from `ManagedIdentityCredential` ## 1.4.0b7 (2020-07-22) - `DefaultAzureCredential` has a new optional keyword argument, diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/managed_identity.py b/sdk/identity/azure-identity/azure/identity/_credentials/managed_identity.py index 8bdd46f5cba9..1205b1a083db 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/managed_identity.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/managed_identity.py @@ -44,10 +44,6 @@ class ManagedIdentityCredential(object): the keyword arguments. :keyword str client_id: a user-assigned identity's client ID. This is supported in all hosting environments. - :keyword identity_config: a mapping ``{parameter_name: value}`` specifying a user-assigned identity by its object - or resource ID, for example ``{"object_id": "..."}``. Check the documentation for your hosting environment to - learn what values it expects. - :paramtype identity_config: Mapping[str, str] """ def __init__(self, **kwargs): @@ -80,7 +76,7 @@ def get_token(self, *scopes, **kwargs): class _ManagedIdentityBase(object): def __init__(self, endpoint, client_cls, config=None, client_id=None, **kwargs): # type: (str, Type, Optional[Configuration], Optional[str], **Any) -> None - self._identity_config = kwargs.pop("identity_config", None) or {} + self._identity_config = kwargs.pop("_identity_config", None) or {} if client_id: if os.environ.get(EnvironmentVariables.MSI_ENDPOINT) and os.environ.get(EnvironmentVariables.MSI_SECRET): # App Service: version 2017-09-1 accepts client ID as parameter "clientid" diff --git a/sdk/identity/azure-identity/azure/identity/aio/_credentials/managed_identity.py b/sdk/identity/azure-identity/azure/identity/aio/_credentials/managed_identity.py index 7def20143526..c3b5a9520908 100644 --- a/sdk/identity/azure-identity/azure/identity/aio/_credentials/managed_identity.py +++ b/sdk/identity/azure-identity/azure/identity/aio/_credentials/managed_identity.py @@ -32,10 +32,6 @@ class ManagedIdentityCredential(AsyncCredentialBase): the keyword arguments. :keyword str client_id: a user-assigned identity's client ID. This is supported in all hosting environments. - :keyword identity_config: a mapping ``{parameter_name: value}`` specifying a user-assigned identity by its object - or resource ID, for example ``{"object_id": "..."}``. Check the documentation for your hosting environment to - learn what values it expects. - :paramtype identity_config: Mapping[str, str] """ def __init__(self, **kwargs: "Any") -> None: diff --git a/sdk/identity/azure-identity/tests/test_imds_credential.py b/sdk/identity/azure-identity/tests/test_imds_credential.py index 95f53088b11a..8b040b769f55 100644 --- a/sdk/identity/azure-identity/tests/test_imds_credential.py +++ b/sdk/identity/azure-identity/tests/test_imds_credential.py @@ -169,7 +169,7 @@ def test_identity_config(): ], ) - credential = ImdsCredential(identity_config={param_name: param_value}, transport=transport) + credential = ImdsCredential(_identity_config={param_name: param_value}, transport=transport) token = credential.get_token(scope) assert token == expected_token diff --git a/sdk/identity/azure-identity/tests/test_imds_credential_async.py b/sdk/identity/azure-identity/tests/test_imds_credential_async.py index a4d056f399fc..8c42e643a855 100644 --- a/sdk/identity/azure-identity/tests/test_imds_credential_async.py +++ b/sdk/identity/azure-identity/tests/test_imds_credential_async.py @@ -198,7 +198,7 @@ async def test_identity_config(): ], ) - credential = ImdsCredential(client_id=client_id, identity_config={param_name: param_value}, transport=transport) + credential = ImdsCredential(client_id=client_id, _identity_config={param_name: param_value}, transport=transport) token = await credential.get_token(scope) assert token == expected_token diff --git a/sdk/identity/azure-identity/tests/test_msi_credential.py b/sdk/identity/azure-identity/tests/test_msi_credential.py index 7536688774e2..28f67a357790 100644 --- a/sdk/identity/azure-identity/tests/test_msi_credential.py +++ b/sdk/identity/azure-identity/tests/test_msi_credential.py @@ -68,7 +68,7 @@ def test_identity_config_app_service(): {EnvironmentVariables.MSI_ENDPOINT: endpoint, EnvironmentVariables.MSI_SECRET: secret}, clear=True, ): - credential = MsiCredential(identity_config={param_name: param_value}, transport=transport) + credential = MsiCredential(_identity_config={param_name: param_value}, transport=transport) token = credential.get_token(scope) assert token == expected_token @@ -107,7 +107,7 @@ def test_identity_config_cloud_shell(): with mock.patch.dict( MsiCredential.__module__ + ".os.environ", {EnvironmentVariables.MSI_ENDPOINT: endpoint}, clear=True ): - credential = MsiCredential(identity_config={param_name: param_value}, transport=transport) + credential = MsiCredential(_identity_config={param_name: param_value}, transport=transport) token = credential.get_token(scope) assert token == expected_token diff --git a/sdk/identity/azure-identity/tests/test_msi_credential_async.py b/sdk/identity/azure-identity/tests/test_msi_credential_async.py index dfa038963536..b9ff2bf114f8 100644 --- a/sdk/identity/azure-identity/tests/test_msi_credential_async.py +++ b/sdk/identity/azure-identity/tests/test_msi_credential_async.py @@ -96,7 +96,7 @@ async def test_identity_config_app_service(): {EnvironmentVariables.MSI_ENDPOINT: endpoint, EnvironmentVariables.MSI_SECRET: secret}, clear=True, ): - credential = MsiCredential(identity_config={param_name: param_value}, transport=transport) + credential = MsiCredential(_identity_config={param_name: param_value}, transport=transport) token = await credential.get_token(scope) assert token == expected_token @@ -135,7 +135,7 @@ async def test_identity_config_cloud_shell(): with mock.patch.dict( MsiCredential.__module__ + ".os.environ", {EnvironmentVariables.MSI_ENDPOINT: endpoint}, clear=True ): - credential = MsiCredential(identity_config={param_name: param_value}, transport=transport) + credential = MsiCredential(_identity_config={param_name: param_value}, transport=transport) token = await credential.get_token(scope) assert token == expected_token From 5df1b40fb816b1b23be42cc0dbc0000eb7611148 Mon Sep 17 00:00:00 2001 From: Charles Lowell Date: Tue, 4 Aug 2020 09:57:31 -0700 Subject: [PATCH 14/14] mention the silent acceptance of removed kwargs --- sdk/identity/azure-identity/CHANGELOG.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sdk/identity/azure-identity/CHANGELOG.md b/sdk/identity/azure-identity/CHANGELOG.md index 1e172bcd2eb1..77986a48a14a 100644 --- a/sdk/identity/azure-identity/CHANGELOG.md +++ b/sdk/identity/azure-identity/CHANGELOG.md @@ -7,7 +7,8 @@ ### Breaking Changes - Removed application authentication APIs added in 1.4.0 beta versions. These - will be reintroduced in 1.5.0b1. + will be reintroduced in 1.5.0b1. Passing the keyword arguments below + generally won't cause a runtime error, but the arguments have no effect. - Removed `authenticate` method from `DeviceCodeCredential`, `InteractiveBrowserCredential`, and `UsernamePasswordCredential` - Removed `allow_unencrypted_cache` and `enable_persistent_cache` keyword