Skip to content

Commit 6e51f6c

Browse files
christotheschristothes
authored
Remove AllowMultiTenantAuthentication option (Azure#24264)
* Remove AllowMultiTenantAuthentication option
1 parent b04902e commit 6e51f6c

33 files changed

+141
-147
lines changed

‎sdk/identity/Azure.Identity/CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@
44

55
### Features Added
66

7-
### Breaking Changes
7+
### Breaking Changes from 1.5.0-beta.4
8+
- The `AllowMultiTenantAuthentication` option has been removed and the default behavior is now as if it were true. The multi-tenant discovery feature can be totally disabled by either setting an `AppContext` switch named "Azure.Identity.DisableTenantDiscovery" to `true` or by setting the environment variable "AZURE_IDENTITY_DISABLE_TENANTDISCOVERY" to "true".
89

910
### Bugs Fixed
1011

‎sdk/identity/Azure.Identity/api/Azure.Identity.netstandard2.0.cs‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -369,7 +369,6 @@ internal TokenCacheUpdatedArgs() { }
369369
public partial class TokenCredentialOptions : Azure.Core.ClientOptions
370370
{
371371
public TokenCredentialOptions() { }
372-
public bool AllowMultiTenantAuthentication { get { throw null; } set { } }
373372
public System.Uri AuthorityHost { get { throw null; } set { } }
374373
public bool IsLoggingPIIEnabled { get { throw null; } set { } }
375374
}

‎sdk/identity/Azure.Identity/src/AuthorizationCodeCredential.cs‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ public class AuthorizationCodeCredential : TokenCredential
2121
private readonly string _clientId;
2222
private readonly CredentialPipeline _pipeline;
2323
private AuthenticationRecord _record;
24-
private readonly bool _allowMultiTenantAuthentication;
2524
private readonly MsalConfidentialClient _client;
2625
private readonly string _redirectUri;
2726
private readonly string _tenantId;
@@ -85,7 +84,6 @@ internal AuthorizationCodeCredential(string tenantId, string clientId, string cl
8584
Argument.AssertNotNull(authorizationCode, nameof(authorizationCode));
8685
_clientId = clientId;
8786
_authCode = authorizationCode ;
88-
_allowMultiTenantAuthentication = options?.AllowMultiTenantAuthentication ?? false;
8987
_pipeline = CredentialPipeline.GetInstance(options ?? new TokenCredentialOptions());
9088
_redirectUri = options switch
9189
{
@@ -135,7 +133,7 @@ private async ValueTask<AccessToken> GetTokenImplAsync(bool async, TokenRequestC
135133
try
136134
{
137135
AccessToken token;
138-
var tenantId = TenantIdResolver.Resolve(_tenantId, requestContext, _allowMultiTenantAuthentication);
136+
var tenantId = TenantIdResolver.Resolve(_tenantId, requestContext);
139137

140138
if (_record is null)
141139
{

‎sdk/identity/Azure.Identity/src/AzureCliCredential.cs‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ namespace Azure.Identity
2020
/// </summary>
2121
public class AzureCliCredential : TokenCredential
2222
{
23-
private readonly bool _allowMultiTenantAuthentication;
2423
internal const string AzureCLINotInstalled = "Azure CLI not installed";
2524
internal const string AzNotLogIn = "Please run 'az login' to set up account";
2625
internal const string WinAzureCLIError = "'az' is not recognized";
@@ -69,7 +68,6 @@ internal AzureCliCredential(CredentialPipeline pipeline, IProcessService process
6968
_pipeline = pipeline;
7069
_path = !string.IsNullOrEmpty(EnvironmentVariables.Path) ? EnvironmentVariables.Path : DefaultPath;
7170
_processService = processService ?? ProcessService.Default;
72-
_allowMultiTenantAuthentication = options?.AllowMultiTenantAuthentication ?? false;
7371
_tenantId = options?.TenantId;
7472
}
7573

@@ -113,7 +111,7 @@ private async ValueTask<AccessToken> GetTokenImplAsync(bool async, TokenRequestC
113111
private async ValueTask<AccessToken> RequestCliAccessTokenAsync(bool async, TokenRequestContext context, CancellationToken cancellationToken)
114112
{
115113
string resource = ScopeUtilities.ScopesToResource(context.Scopes);
116-
string tenantId = TenantIdResolver.Resolve(_tenantId, context, _allowMultiTenantAuthentication);
114+
string tenantId = TenantIdResolver.Resolve(_tenantId, context);
117115

118116
ScopeUtilities.ValidateScope(resource);
119117

‎sdk/identity/Azure.Identity/src/AzureIdentityEventSource.cs‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,10 @@ internal sealed class AzureIdentityEventSource : AzureEventSource
3131
private const int ProcessRunnerErrorEvent = 14;
3232
private const int ProcessRunnerInfoEvent = 15;
3333
private const int UsernamePasswordCredentialAcquireTokenSilentFailedEvent = 16;
34+
private const int TenantIdDiscoveredAndNotUsedEvent = 17;
35+
private const int TenantIdDiscoveredAndUsedEvent = 18;
36+
internal const string TenantIdDiscoveredAndNotUsedEventMessage = "A token was request for a different tenant than was configured on the credential, but the configured value was used since multi tenant authentication has been disabled. Configured TenantId: {0}, Requested TenantId {1}";
37+
internal const string TenantIdDiscoveredAndUsedEventMessage = "A token was requested for a different tenant than was configured on the credential, and the requested tenant id was used to authenticate. Configured TenantId: {0}, Requested TenantId {1}";
3438

3539
private AzureIdentityEventSource() : base(EventSourceName) { }
3640

@@ -276,5 +280,23 @@ public void UsernamePasswordCredentialAcquireTokenSilentFailed(string error)
276280
{
277281
WriteEvent(UsernamePasswordCredentialAcquireTokenSilentFailedEvent, error);
278282
}
283+
284+
[Event(TenantIdDiscoveredAndNotUsedEvent, Level = EventLevel.Informational, Message = TenantIdDiscoveredAndNotUsedEventMessage)]
285+
public void TenantIdDiscoveredAndNotUsed(string explicitTenantId, string contextTenantId)
286+
{
287+
if (IsEnabled(EventLevel.Informational, EventKeywords.All))
288+
{
289+
WriteEvent(TenantIdDiscoveredAndNotUsedEvent, explicitTenantId, contextTenantId);
290+
}
291+
}
292+
293+
[Event(TenantIdDiscoveredAndUsedEvent, Level = EventLevel.Informational, Message = TenantIdDiscoveredAndUsedEventMessage)]
294+
public void TenantIdDiscoveredAndUsed(string explicitTenantId, string contextTenantId)
295+
{
296+
if (IsEnabled(EventLevel.Informational, EventKeywords.All))
297+
{
298+
WriteEvent(TenantIdDiscoveredAndUsedEvent, explicitTenantId, contextTenantId);
299+
}
300+
}
279301
}
280302
}

‎sdk/identity/Azure.Identity/src/AzurePowerShellCredential.cs‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,6 @@ public class AzurePowerShellCredential : TokenCredential
4040
private static readonly string DefaultWorkingDir =
4141
RuntimeInformation.IsOSPlatform(OSPlatform.Windows) ? DefaultWorkingDirWindows : DefaultWorkingDirNonWindows;
4242

43-
private readonly bool _allowMultiTenantAuthentication;
4443
private readonly string _tenantId;
4544

4645
private const int ERROR_FILE_NOT_FOUND = 2;
@@ -64,7 +63,6 @@ internal AzurePowerShellCredential(AzurePowerShellCredentialOptions options, Cre
6463
{
6564
UseLegacyPowerShell = false;
6665
_logPII = options?.IsLoggingPIIEnabled ?? false;
67-
_allowMultiTenantAuthentication = options?.AllowMultiTenantAuthentication ?? false;
6866
_tenantId = options?.TenantId;
6967
_pipeline = pipeline ?? CredentialPipeline.GetInstance(options);
7068
_processService = processService ?? ProcessService.Default;
@@ -125,7 +123,7 @@ private async ValueTask<AccessToken> RequestAzurePowerShellAccessTokenAsync(bool
125123
string resource = ScopeUtilities.ScopesToResource(context.Scopes);
126124

127125
ScopeUtilities.ValidateScope(resource);
128-
var tenantId = TenantIdResolver.Resolve(_tenantId, context, _allowMultiTenantAuthentication);
126+
var tenantId = TenantIdResolver.Resolve(_tenantId, context);
129127

130128
GetFileNameAndArguments(resource, tenantId, out string fileName, out string argument);
131129
ProcessStartInfo processStartInfo = GetAzurePowerShellProcessStartInfo(fileName, argument);

‎sdk/identity/Azure.Identity/src/ClientAssertionCredential.cs‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@ public ClientAssertionCredential(string tenantId, string clientId, Func<string>
2828
{
2929
TenantId = tenantId;
3030
ClientId = clientId;
31-
AllowMultiTenantAuthentication = options?.AllowMultiTenantAuthentication ?? false;
3231
Client = options?.MsalClient ?? new MsalConfidentialClient(options?.Pipeline ?? CredentialPipeline.GetInstance(options), tenantId, clientId, getAssertionCallback, null, null, options?.IsLoggingPIIEnabled ?? false);
3332
}
3433

@@ -38,7 +37,7 @@ public override AccessToken GetToken(TokenRequestContext requestContext, Cancell
3837

3938
try
4039
{
41-
var tenantId = TenantIdResolver.Resolve(TenantId, requestContext, AllowMultiTenantAuthentication);
40+
var tenantId = TenantIdResolver.Resolve(TenantId, requestContext);
4241

4342
AuthenticationResult result = Client.AcquireTokenForClientAsync(requestContext.Scopes, tenantId, false, cancellationToken).EnsureCompleted();
4443

@@ -56,7 +55,7 @@ public async override ValueTask<AccessToken> GetTokenAsync(TokenRequestContext r
5655

5756
try
5857
{
59-
var tenantId = TenantIdResolver.Resolve(TenantId, requestContext, AllowMultiTenantAuthentication);
58+
var tenantId = TenantIdResolver.Resolve(TenantId, requestContext);
6059

6160
AuthenticationResult result = await Client.AcquireTokenForClientAsync(requestContext.Scopes, tenantId, true, cancellationToken).ConfigureAwait(false);
6261

‎sdk/identity/Azure.Identity/src/ClientCertificateCredential.cs‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@ public class ClientCertificateCredential : TokenCredential
3535
internal MsalConfidentialClient Client { get; }
3636

3737
private readonly CredentialPipeline _pipeline;
38-
private readonly bool _allowMultiTenantAuthentication;
3938

4039
/// <summary>
4140
/// Protected constructor for mocking.
@@ -148,14 +147,9 @@ internal ClientCertificateCredential(
148147
MsalConfidentialClient client)
149148
{
150149
TenantId = Validations.ValidateTenantId(tenantId, nameof(tenantId));
151-
152150
ClientId = clientId ?? throw new ArgumentNullException(nameof(clientId));
153-
154151
ClientCertificateProvider = certificateProvider;
155-
_allowMultiTenantAuthentication = options?.AllowMultiTenantAuthentication ?? false;
156-
157152
_pipeline = pipeline ?? CredentialPipeline.GetInstance(options);
158-
159153
ClientCertificateCredentialOptions certCredOptions = (options as ClientCertificateCredentialOptions);
160154

161155
Client = client ??
@@ -182,7 +176,7 @@ public override AccessToken GetToken(TokenRequestContext requestContext, Cancell
182176

183177
try
184178
{
185-
var tenantId = TenantIdResolver.Resolve(TenantId, requestContext, _allowMultiTenantAuthentication);
179+
var tenantId = TenantIdResolver.Resolve(TenantId, requestContext);
186180
AuthenticationResult result = Client.AcquireTokenForClientAsync(requestContext.Scopes, tenantId, false, cancellationToken).EnsureCompleted();
187181

188182
return scope.Succeeded(new AccessToken(result.AccessToken, result.ExpiresOn));
@@ -205,7 +199,7 @@ public override async ValueTask<AccessToken> GetTokenAsync(TokenRequestContext r
205199

206200
try
207201
{
208-
var tenantId = TenantIdResolver.Resolve(TenantId, requestContext, _allowMultiTenantAuthentication);
202+
var tenantId = TenantIdResolver.Resolve(TenantId, requestContext);
209203
AuthenticationResult result = await Client
210204
.AcquireTokenForClientAsync(requestContext.Scopes, tenantId, true, cancellationToken)
211205
.ConfigureAwait(false);

‎sdk/identity/Azure.Identity/src/ClientSecretCredential.cs‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ namespace Azure.Identity
1919
public class ClientSecretCredential : TokenCredential
2020
{
2121
private readonly CredentialPipeline _pipeline;
22-
private readonly bool _allowMultiTenantAuthentication;
2322

2423
internal MsalConfidentialClient Client { get; }
2524

@@ -88,7 +87,6 @@ internal ClientSecretCredential(string tenantId, string clientId, string clientS
8887
ClientId = clientId ?? throw new ArgumentNullException(nameof(clientId));
8988

9089
ClientSecret = clientSecret;
91-
_allowMultiTenantAuthentication = options?.AllowMultiTenantAuthentication ?? false;
9290
_pipeline = pipeline ?? CredentialPipeline.GetInstance(options);
9391
Client = client ??
9492
new MsalConfidentialClient(
@@ -113,7 +111,7 @@ public override async ValueTask<AccessToken> GetTokenAsync(TokenRequestContext r
113111

114112
try
115113
{
116-
var tenantId = TenantIdResolver.Resolve(TenantId, requestContext, _allowMultiTenantAuthentication);
114+
var tenantId = TenantIdResolver.Resolve(TenantId, requestContext);
117115
AuthenticationResult result = await Client.AcquireTokenForClientAsync(requestContext.Scopes, tenantId, true, cancellationToken).ConfigureAwait(false);
118116

119117
return scope.Succeeded(new AccessToken(result.AccessToken, result.ExpiresOn));
@@ -136,7 +134,7 @@ public override AccessToken GetToken(TokenRequestContext requestContext, Cancell
136134

137135
try
138136
{
139-
var tenantId = TenantIdResolver.Resolve(TenantId, requestContext, _allowMultiTenantAuthentication);
137+
var tenantId = TenantIdResolver.Resolve(TenantId, requestContext);
140138
AuthenticationResult result = Client.AcquireTokenForClientAsync(requestContext.Scopes, tenantId, false, cancellationToken).EnsureCompleted();
141139

142140
return scope.Succeeded(new AccessToken(result.AccessToken, result.ExpiresOn));

‎sdk/identity/Azure.Identity/src/DeviceCodeCredential.cs‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ namespace Azure.Identity
1818
public class DeviceCodeCredential : TokenCredential
1919
{
2020
private readonly string _tenantId;
21-
private readonly bool _allowMultiTenantAuthentication;
2221
internal MsalPublicClient Client { get; set; }
2322
internal string ClientId { get; }
2423
internal bool DisableAutomaticAuthentication { get; }
@@ -86,7 +85,6 @@ internal DeviceCodeCredential(Func<DeviceCodeInfo, CancellationToken, Task> devi
8685
DeviceCodeCallback = deviceCodeCallback;
8786
DisableAutomaticAuthentication = (options as DeviceCodeCredentialOptions)?.DisableAutomaticAuthentication ?? false;
8887
Record = (options as DeviceCodeCredentialOptions)?.AuthenticationRecord;
89-
_allowMultiTenantAuthentication = options?.AllowMultiTenantAuthentication ?? false;
9088
Pipeline = pipeline ?? CredentialPipeline.GetInstance(options);
9189
Client = client ?? new MsalPublicClient(
9290
Pipeline,
@@ -204,7 +202,7 @@ private async ValueTask<AccessToken> GetTokenImplAsync(bool async, TokenRequestC
204202
{
205203
try
206204
{
207-
var tenantId = TenantIdResolver.Resolve(_tenantId, requestContext, _allowMultiTenantAuthentication);
205+
var tenantId = TenantIdResolver.Resolve(_tenantId, requestContext);
208206
AuthenticationResult result = await Client
209207
.AcquireTokenSilentAsync(requestContext.Scopes, requestContext.Claims, Record, tenantId, async, cancellationToken)
210208
.ConfigureAwait(false);

0 commit comments

Comments
 (0)