From ab3483201ef6ce035caa1877d2395ee08309fc14 Mon Sep 17 00:00:00 2001 From: JoshLozensky <103777376+JoshLozensky@users.noreply.github.com> Date: Fri, 8 Dec 2023 11:51:58 -0800 Subject: [PATCH] Simplify managed identity configuration (#113) Reducing complexity of managed identity implementation. --- .../ManagedIdentity/ManagedIdentityOptions.cs | 41 ------------------- .../ManagedIdentity/ManagedIdentityType.cs | 23 ----------- .../TokenAcquisition/AcquireTokenOptions.cs | 11 ++--- .../ManagedIdentityOptions.cs | 37 +++++++++++++++++ .../AquireTokenOptionsTests.cs | 25 ++++------- .../DownstreamApiTests.cs | 3 +- .../ManagedIdentityDescriptionTests.cs | 26 ------------ 7 files changed, 51 insertions(+), 115 deletions(-) delete mode 100644 src/Microsoft.Identity.Abstractions/ManagedIdentity/ManagedIdentityOptions.cs delete mode 100644 src/Microsoft.Identity.Abstractions/ManagedIdentity/ManagedIdentityType.cs create mode 100644 src/Microsoft.Identity.Abstractions/TokenAcquisition/ManagedIdentityOptions.cs delete mode 100644 test/Microsoft.Identity.Abstractions.Tests/ManagedIdentityDescriptionTests.cs diff --git a/src/Microsoft.Identity.Abstractions/ManagedIdentity/ManagedIdentityOptions.cs b/src/Microsoft.Identity.Abstractions/ManagedIdentity/ManagedIdentityOptions.cs deleted file mode 100644 index cc8cc7c..0000000 --- a/src/Microsoft.Identity.Abstractions/ManagedIdentity/ManagedIdentityOptions.cs +++ /dev/null @@ -1,41 +0,0 @@ -// Copyright (c) Microsoft Corporation. All rights reserved. -// Licensed under the MIT License. - -using System.ComponentModel; - -namespace Microsoft.Identity.Abstractions -{ - /// - /// Data object to hold the definition of a managed identity for an application to use for authentication. - /// See for more details. - /// - public class ManagedIdentityOptions - { - /// - /// Gets or sets whether the is system-assigned or user assigned. - /// Defaults to if not set. - /// See for details on these two types of managed identity. - /// - [DefaultValue(ManagedIdentityType.SystemAssigned)] - public ManagedIdentityType ManagedIdentityType { get; set; } - - /// - /// Gets or sets the value of the ClientID when is set to - /// . If not set, the default value is null. - /// - public string? ClientId { get; set; } - - /// - /// Makes a new object to avoid sharing the same reference. - /// - /// A new instance of with the same field values. - public ManagedIdentityOptions Clone() - { - return new ManagedIdentityOptions - { - ManagedIdentityType = ManagedIdentityType, - ClientId = ClientId - }; - } - } -} diff --git a/src/Microsoft.Identity.Abstractions/ManagedIdentity/ManagedIdentityType.cs b/src/Microsoft.Identity.Abstractions/ManagedIdentity/ManagedIdentityType.cs deleted file mode 100644 index 9a87b00..0000000 --- a/src/Microsoft.Identity.Abstractions/ManagedIdentity/ManagedIdentityType.cs +++ /dev/null @@ -1,23 +0,0 @@ -// Copyright (c) Microsoft Corporation. All rights reserved. -// Licensed under the MIT License. - -namespace Microsoft.Identity.Abstractions -{ - /// - /// Used by to specify the type of managed identity to use. - /// See for more details. - /// - public enum ManagedIdentityType - { - /// - /// The default value, indicating the managed identity to use is the one configured for the Azure resource on which the - /// application is running. - /// - SystemAssigned = 0, - - /// - /// Indicates the managed identity to use is a user-assigned identity which is defined in a standalone Azure resource. - /// - UserAssigned = 1, - } -} diff --git a/src/Microsoft.Identity.Abstractions/TokenAcquisition/AcquireTokenOptions.cs b/src/Microsoft.Identity.Abstractions/TokenAcquisition/AcquireTokenOptions.cs index 38b88e7..50f8df3 100644 --- a/src/Microsoft.Identity.Abstractions/TokenAcquisition/AcquireTokenOptions.cs +++ b/src/Microsoft.Identity.Abstractions/TokenAcquisition/AcquireTokenOptions.cs @@ -95,13 +95,10 @@ public AcquireTokenOptions(AcquireTokenOptions other) /// /// When is set, the application uses a managed identity instead of client credentials to /// acquire an app token. - /// The type of managed identity is defined by the field. When - /// using a identity, this is the only field that needs to be set and is - /// set by default. However, for readability it can be useful to set explicitly. - /// To use a user-assigned identity, select the that corresponds to the - /// you plan to use for authentication. - /// Using either form of managed identity requires the application to be deployed on Azure and - /// the managed identity to be configured. For more details, check the + /// To use a system-assigned identity, simply leave null. + /// To use a user-assigned identity, set to the ClientID of the + /// user-assigned identity you want to use. Using either form of managed identity requires the application to be deployed + /// on Azure and the managed identity to be configured. For more details, check the /// managed identities for Azure documentation. /// /// diff --git a/src/Microsoft.Identity.Abstractions/TokenAcquisition/ManagedIdentityOptions.cs b/src/Microsoft.Identity.Abstractions/TokenAcquisition/ManagedIdentityOptions.cs new file mode 100644 index 0000000..f7b5282 --- /dev/null +++ b/src/Microsoft.Identity.Abstractions/TokenAcquisition/ManagedIdentityOptions.cs @@ -0,0 +1,37 @@ +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. + +using System.ComponentModel; + +namespace Microsoft.Identity.Abstractions +{ + /// + /// Data object to hold the definition of a managed identity for an application to use for authentication. If + /// is null, the application will use the system-assigned managed identity. If + /// is set, the application will try to use the user-assigned managed identity associated + /// with the provided ClientID. See for more details. + /// + public class ManagedIdentityOptions + { + /// + /// Gets or sets the value of the ClientID for user-assigned managed identity. If not set, the default value is null + /// which will tell the application to use the system-assigned managed identity. + /// + [DefaultValue(null)] + public string? UserAssignedClientId { get; set; } + + /// + /// Makes a new object to avoid sharing the same reference. + /// + /// + /// New instance of with the same . + /// + public ManagedIdentityOptions Clone() + { + return new ManagedIdentityOptions + { + UserAssignedClientId = UserAssignedClientId + }; + } + } +} diff --git a/test/Microsoft.Identity.Abstractions.Tests/AquireTokenOptionsTests.cs b/test/Microsoft.Identity.Abstractions.Tests/AquireTokenOptionsTests.cs index 6a9291e..ee9ad31 100644 --- a/test/Microsoft.Identity.Abstractions.Tests/AquireTokenOptionsTests.cs +++ b/test/Microsoft.Identity.Abstractions.Tests/AquireTokenOptionsTests.cs @@ -17,9 +17,7 @@ public void ManagedIdentitySystemAssigned() // { "AquireTokenOptions": { - "ManagedIdentity": { - "ManagedIdentityType": "SystemAssigned" - } + "ManagedIdentity" } } // @@ -29,14 +27,11 @@ public void ManagedIdentitySystemAssigned() AcquireTokenOptions acquireTokenOptions = new AcquireTokenOptions { ManagedIdentity = new ManagedIdentityOptions() - { - // default: ManagedIdentityType = ManagedIdentityType.SystemAssigned - } }; // - Assert.Equal(ManagedIdentityType.SystemAssigned, acquireTokenOptions.ManagedIdentity.ManagedIdentityType); - Assert.Null(acquireTokenOptions.ManagedIdentity.ClientId); + Assert.NotNull(acquireTokenOptions.ManagedIdentity); + Assert.Null(acquireTokenOptions.ManagedIdentity.UserAssignedClientId); } [Fact] @@ -50,8 +45,7 @@ public void ManagedIdentityUserAssigned() { "AquireTokenOptions": { "ManagedIdentity": { - "ManagedIdentityType": "UserAssigned" - "ClientId": "[ClientIdForTheManagedIdentityResource]" + "UserAssignedClientId": "[ClientIdForTheManagedIdentityResource]" } } } @@ -59,20 +53,19 @@ public void ManagedIdentityUserAssigned() */ // - ManagedIdentityOptions managedIdentityDescription = new ManagedIdentityOptions + ManagedIdentityOptions managedIdentityOptions = new ManagedIdentityOptions { - ManagedIdentityType = ManagedIdentityType.UserAssigned, - ClientId = "[ClientIdForTheManagedIdentityResource]" + UserAssignedClientId = "[ClientIdForTheManagedIdentityResource]" }; AcquireTokenOptions acquireTokenOptions = new AcquireTokenOptions { - ManagedIdentity = managedIdentityDescription + ManagedIdentity = managedIdentityOptions }; // - Assert.Equal(ManagedIdentityType.UserAssigned, acquireTokenOptions.ManagedIdentity.ManagedIdentityType); - Assert.Equal(managedIdentityDescription.ClientId, acquireTokenOptions.ManagedIdentity.ClientId); + Assert.NotNull(acquireTokenOptions.ManagedIdentity); + Assert.Equal(managedIdentityOptions.UserAssignedClientId, acquireTokenOptions.ManagedIdentity.UserAssignedClientId); } } } diff --git a/test/Microsoft.Identity.Abstractions.Tests/DownstreamApiTests.cs b/test/Microsoft.Identity.Abstractions.Tests/DownstreamApiTests.cs index 218adc7..422eeb6 100644 --- a/test/Microsoft.Identity.Abstractions.Tests/DownstreamApiTests.cs +++ b/test/Microsoft.Identity.Abstractions.Tests/DownstreamApiTests.cs @@ -76,8 +76,7 @@ public void CloneClonesAllProperties() Assert.Equal(downstreamApiOptions.AcquireTokenOptions.ExtraQueryParameters, downstreamApiClone.AcquireTokenOptions.ExtraQueryParameters); Assert.Equal(downstreamApiOptions.AcquireTokenOptions.ForceRefresh, downstreamApiClone.AcquireTokenOptions.ForceRefresh); Assert.Equal(downstreamApiOptions.AcquireTokenOptions.LongRunningWebApiSessionKey, downstreamApiClone.AcquireTokenOptions.LongRunningWebApiSessionKey); - Assert.Equal(downstreamApiOptions.AcquireTokenOptions.ManagedIdentity.ManagedIdentityType, downstreamApiClone.AcquireTokenOptions.ManagedIdentity?.ManagedIdentityType); - Assert.Equal(downstreamApiOptions.AcquireTokenOptions.ManagedIdentity.ClientId, downstreamApiClone.AcquireTokenOptions.ManagedIdentity?.ClientId); + Assert.Equal(downstreamApiOptions.AcquireTokenOptions.ManagedIdentity.UserAssignedClientId, downstreamApiClone.AcquireTokenOptions.ManagedIdentity?.UserAssignedClientId); Assert.Equal(downstreamApiOptions.AcquireTokenOptions.PopPublicKey, downstreamApiClone.AcquireTokenOptions.PopPublicKey); Assert.Equal(downstreamApiOptions.AcquireTokenOptions.PopClaim, downstreamApiClone.AcquireTokenOptions.PopClaim); Assert.Equal(downstreamApiOptions.AcquireTokenOptions.Tenant, downstreamApiClone.AcquireTokenOptions.Tenant); diff --git a/test/Microsoft.Identity.Abstractions.Tests/ManagedIdentityDescriptionTests.cs b/test/Microsoft.Identity.Abstractions.Tests/ManagedIdentityDescriptionTests.cs deleted file mode 100644 index 0b9ed05..0000000 --- a/test/Microsoft.Identity.Abstractions.Tests/ManagedIdentityDescriptionTests.cs +++ /dev/null @@ -1,26 +0,0 @@ -// Copyright (c) Microsoft Corporation. All rights reserved. -// Licensed under the MIT License. - -using Xunit; - -namespace Microsoft.Identity.Abstractions.Tests -{ - public class ManagedIdentityDescriptionTests - { - /// - /// If no field is set for the - /// field needs to default to as other Microsoft.Identity libraries - /// will depend on this. - /// - [Fact] - public void ManagedIdentity_NoDescriptionFieldsSet() - { - // Arrange - ManagedIdentityOptions description = new(); - - // Assert - Assert.Equal(ManagedIdentityType.SystemAssigned, description.ManagedIdentityType); - Assert.Null(description.ClientId); - } - } -}