diff --git a/sdk/identity/azure-identity/CHANGELOG.md b/sdk/identity/azure-identity/CHANGELOG.md index a6c44363fe54..169a031ff4af 100644 --- a/sdk/identity/azure-identity/CHANGELOG.md +++ b/sdk/identity/azure-identity/CHANGELOG.md @@ -4,6 +4,8 @@ ### Features Added +- Added Windows Web Account Manager (WAM) Brokered Authentication support. ([#23687](https://github.com/Azure/azure-sdk-for-python/issues/23687)) + ### Breaking Changes ### Bugs Fixed diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/browser.py b/sdk/identity/azure-identity/azure/identity/_credentials/browser.py index 2d380342d229..670ee0299fcb 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/browser.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/browser.py @@ -39,6 +39,10 @@ class InteractiveBrowserCredential(InteractiveCredential): will cache tokens in memory. :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions :keyword int timeout: seconds to wait for the user to complete authentication. Defaults to 300 (5 minutes). + :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification + verification. If this parameter is set to True, the broker will be used when possible. Defaults to False. + Check https://learn.microsoft.com/azure/active-directory/develop/scenario-desktop-acquire-token-wam + for more WAM information. :raises ValueError: invalid **redirect_uri** """ diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py b/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py index 977c663a87a0..3fd8025fb2b1 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py @@ -58,7 +58,10 @@ def __init__( client_credential = get_client_credential(certificate_path, **kwargs) super(CertificateCredential, self).__init__( - client_id=client_id, client_credential=client_credential, tenant_id=tenant_id, **kwargs + client_id=client_id, + client_credential=client_credential, + tenant_id=tenant_id, + **kwargs ) diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py b/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py index c7c3685d8ab8..fc86cbf1886f 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/client_secret.py @@ -40,5 +40,8 @@ def __init__( ) super(ClientSecretCredential, self).__init__( - client_id=client_id, client_credential=client_secret, tenant_id=tenant_id, **kwargs + client_id=client_id, + client_credential=client_secret, + tenant_id=tenant_id, + **kwargs ) diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/on_behalf_of.py b/sdk/identity/azure-identity/azure/identity/_credentials/on_behalf_of.py index 06a63958efdc..3c39e0af0e3a 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/on_behalf_of.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/on_behalf_of.py @@ -82,7 +82,11 @@ def __init__( else: raise TypeError('Either "client_certificate" or "client_secret" must be provided') - super(OnBehalfOfCredential, self).__init__(client_id, credential, tenant_id=tenant_id, **kwargs) + super(OnBehalfOfCredential, self).__init__( + client_id=client_id, + client_credential=credential, + tenant_id=tenant_id, + **kwargs) self._auth_record = None # type: Optional[AuthenticationRecord] @wrap_exceptions diff --git a/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py b/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py index c85d71631565..37e2e115950c 100644 --- a/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py +++ b/sdk/identity/azure-identity/azure/identity/_credentials/user_password.py @@ -34,6 +34,10 @@ class UsernamePasswordCredential(InteractiveCredential): :keyword cache_persistence_options: Configuration for persistent token caching. If unspecified, the credential will cache tokens in memory. :paramtype cache_persistence_options: ~azure.identity.TokenCachePersistenceOptions + :keyword bool allow_broker: Brokers provide single sign-on, device identification, and application identification + verification. If this parameter is set to True, the broker will be used when possible. Defaults to False. + Check https://learn.microsoft.com/azure/active-directory/develop/scenario-desktop-acquire-token-wam + for more WAM information. :keyword List[str] additionally_allowed_tenants: Specifies tenants in addition to the specified "tenant_id" for which the credential may acquire tokens. Add the wildcard value "*" to allow the credential to acquire tokens for any tenant the application can access. diff --git a/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py b/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py index 384d3176781d..1cb898a476b6 100644 --- a/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py +++ b/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py @@ -22,6 +22,7 @@ def __init__( client_credential: Union[str, Dict] = None, *, additionally_allowed_tenants: List[str] = None, + allow_broker: bool = None, **kwargs ) -> None: authority = kwargs.pop("authority", None) @@ -34,6 +35,7 @@ def __init__( self._client_applications = {} # type: Dict[str, msal.ClientApplication] self._client_credential = client_credential self._client_id = client_id + self._allow_broker = allow_broker self._additionally_allowed_tenants = additionally_allowed_tenants or [] self._cache = kwargs.pop("_cache", None) @@ -76,7 +78,8 @@ def _get_app(self, **kwargs): azure_region=self._regional_authority, token_cache=self._cache, http_client=self._client, - # validate_authority=self._validate_authority + # validate_authority=self._validate_authority, + allow_broker=self._allow_broker ) return self._client_applications[tenant_id]