Skip to content

Commit 7c62728

Browse files
schaabsschaabs
authored
[Identity] Adding ClientCertificateCredential and custom credential samples (Azure#18722)
1 parent fa3e4b9 commit 7c62728

File tree

5 files changed

+528
-0
lines changed

5 files changed

+528
-0
lines changed

‎sdk/identity/Azure.Identity/samples/ClientCertificateCredentialSamples.md‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
# Using the ClientCertificateCredential
2+
3+
Applications which execute in a protected environment can authenticate using a client assertion signed by a private key whose public key or root certificate is registered with AAD. The Azure.Identity library provides the `ClientCertificateCredential` for applications choosing to authenticate this way. Below are some examples of how applications can utilize the `ClientCertificateCredential` to authenticate clients.
4+
5+
6+
## Loading certificates from disk
7+
8+
Applications commonly need to load a client certificate from disk. One approach is for the application to construct the `ClientCertificateCredential` by specifying the applications tenant id, client id, and the path to the certificate.
9+
10+
```C# Snippet:Identity_CertificateCredenetial_CreateWithPath
11+
var credential = new ClientCertificateCredential(tenantId, clientId, "./certs/cert.pfx");
12+
```
13+
Alternatively, the application can construct the `X509Certificate2` themselves, such as in the following example, where the certificate key is password protected.
14+
15+
```C# Snippet:Identity_CertificateCredenetial_CreateWithX509Cert
16+
var certificate = new X509Certificate2("./certs/cert-password-protected.pfx", "password");
17+
18+
var credential = new ClientCertificateCredential(tenantId, clientId, certificate);
19+
```
20+
21+
## Loading certificates from an X509Store
22+
23+
Applications running on platforms which provide a secure certificate store might prefer to store and retrieve certificates from there. While the `ClientCertificateCredential` doesn't directly provide a mechanism for this, the application can retrieve the appropriate certificate from the store and use it to construct the `ClientCertificateCredential`.
24+
25+
Consider the scenario where a pinned certificate used for development authentication is stored in the Personal certificate store. Since the certificate is pinned it can be identified by its thumbprint, which the application might read from configuration or the environment.
26+
27+
```C# Snippet:Identity_CertificateCredenetial_CreateFromStore
28+
using var store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
29+
30+
store.Open(OpenFlags.ReadOnly);
31+
32+
var certificate = store.Certificates.Cast<X509Certificate2>().FirstOrDefault(cert => cert.Thumbprint == thumbprint);
33+
34+
var credential = new ClientCertificateCredential(tenantId, clientId, certificate);
35+
```
36+
37+
## Rolling Certificates
38+
39+
Long running applications may have the need to roll certificates during process execution. Certificate rotation is not currently supported by the `ClientCertficateCredential` which treats the certificate used to construct the credential as immutable. This means that any clients constructed with an `ClientCertificateCredential` using a particular cert would fail to authenticate requests after that cert has been rolled and the original is no longer valid.
40+
41+
However, if an application wants to roll this certificate without creating new service clients, it can accomplish this by creating its own `TokenCredential` implementation which wraps the `ClientCertificateCredential`. The implementation of this custom credential `TokenCredential` would somewhat depend on how the application handles certificate rotation.
42+
43+
### Explicit rotation
44+
45+
If the application get's notified of certificate rotations and it can directly respond, it might choose to wrap the `ClientCertificateCredential` in a custom credential which provides a means for rotating the certificate.
46+
47+
```C# Snippet:Identity_CertificateCredenetial_RotatableCredential
48+
public class RotatableCertificateCredential : TokenCredential
49+
{
50+
private readonly string _tenantId;
51+
private readonly string _clientId;
52+
private ClientCertificateCredential _credential;
53+
54+
public RotatableCertificateCredential(string tenantId, string clientId, X509Certificate2 certificate)
55+
{
56+
_tenantId = tenantId;
57+
_clientId = clientId;
58+
_credential = new ClientCertificateCredential(_tenantId, _clientId, certificate);
59+
}
60+
61+
public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
62+
{
63+
return _credential.GetToken(requestContext, cancellationToken);
64+
}
65+
66+
public async override ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
67+
{
68+
return await _credential.GetTokenAsync(requestContext, cancellationToken);
69+
}
70+
71+
public void RotateCertificate(X509Certificate2 certificate)
72+
{
73+
_credential = new ClientCertificateCredential(_tenantId, _clientId, certificate);
74+
}
75+
}
76+
```
77+
78+
The above example shows a custom credential type `RotatableCertificateCredential` which provides a `RotateCertificateMethod`. The implementation internally relies on a `ClientCertificateCredential` instance `_credential`, and `RotateCertificate` simply replaces this instance with a new instance using the updated certificate.
79+
80+
### Implicit rotation
81+
Some applications might want to respond to certificate rotations which are external to the application, for instance a separate process rotates the certificate by updating it on disk. Here the application create a custom credential which checks for certificate updates when tokens are requested.
82+
83+
```C# Snippet:Identity_CertificateCredenetial_RotatingCredential
84+
public class RotatingCertificateCredential : TokenCredential
85+
{
86+
private readonly string _tenantId;
87+
private readonly string _clientId;
88+
private readonly string _path;
89+
private readonly object _refreshLock = new object();
90+
private DateTimeOffset _credentialLastModified;
91+
private ClientCertificateCredential _credential;
92+
93+
public RotatingCertificateCredential(string tenantId, string clientId, string path)
94+
{
95+
_tenantId = tenantId;
96+
_clientId = clientId;
97+
_path = path;
98+
99+
RefreshCertificate();
100+
}
101+
102+
public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
103+
{
104+
RefreshCertificate();
105+
106+
return _credential.GetToken(requestContext, cancellationToken);
107+
}
108+
109+
public async override ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
110+
{
111+
RefreshCertificate();
112+
113+
return await _credential.GetTokenAsync(requestContext, cancellationToken);
114+
}
115+
116+
public void RefreshCertificate()
117+
{
118+
lock (_refreshLock)
119+
{
120+
var certificateLastModified = File.GetLastWriteTimeUtc(_path);
121+
122+
if (_credentialLastModified < certificateLastModified)
123+
{
124+
_credential = new ClientCertificateCredential(_tenantId, _clientId, new X509Certificate2(_path));
125+
126+
_credentialLastModified = certificateLastModified;
127+
}
128+
}
129+
}
130+
}
131+
```
132+
133+
In this example the custom credential type `RotatingCertifiateCredential` again uses a `ClientCertificateCredential` instance `_credential` to retrieve tokens. However, in this case it will attempt to refresh the certificate prior to obtaining the token. The method `RefreshCertificate` will query to see if the certificate has changed, and if so it will replace the instance `_credential` with a new instance using the new certificate.

‎sdk/identity/Azure.Identity/samples/DefiningCustomCredentialTypes.md‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
# Defining Custom Credential types
2+
The Azure.Identity library covers a broad range of Azure Active Directory authentication scenarios. However, it's possible the credential implementations in Azure.Identity might not meet the specific needs your application, or an application might want to avoid taking a dependency on the Azure.Identity library.
3+
4+
## Authenticating with a prefetched access token
5+
The Azure.Identity library does not contain a `TokenCredential` implementation which can be constructed directly with an `AccessToken`. This is intentionally omitted as a main line scenario as access tokens expire frequently and have constrained usage. However, there are some scenarios where authenticating a service client with a prefetched token is necessary.
6+
7+
In this example `StaticTokenCredential` implements the `TokenCredential` abstraction. It takes a prefetched access token in its constructor as a `string` or `AccessToken`, and simply returns that from its implementation of `GetToken` and `GetTokenAsync`.
8+
9+
```C# Snippet:StaticTokenCredential
10+
public class StaticTokenCredential : TokenCredential
11+
{
12+
private AccessToken _token;
13+
14+
public StaticTokenCredential(string token) : this(new AccessToken(token, DateTimeOffset.MinValue)) { }
15+
16+
public StaticTokenCredential(AccessToken token)
17+
{
18+
_token = token;
19+
}
20+
21+
public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
22+
{
23+
return _token;
24+
}
25+
26+
public override ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
27+
{
28+
return new ValueTask<AccessToken>(_token);
29+
}
30+
}
31+
```
32+
33+
Once the application has defined this credential type instances of it can be used to authenticate Azure SDK clients. The following example shows an how an application already using some other mechanism for acquiring tokens (in this case the hypothetical method `AquireTokenForScope`) could use the `StaticTokenCredential` to authenticate a `BlobClient`.
34+
35+
```C# Snippet:StaticTokenCredentialUsage
36+
string token = GetTokenForScope("https://storage.azure.com/.default");
37+
38+
var credential = new StaticTokenCredential(token);
39+
40+
var client = new BlobClient(new Uri("https://aka.ms/bloburl"), credential);
41+
```
42+
43+
It should be noted when using this custom credential type, it is the responsibility of the caller to ensure that the token is valid, and contains the correct claims needed to authenticate calls from the particular service client. For instance in the above case the token must have the scope "https://storage.azure.com/.default" to authorize calls to Azure Blob Storage.
44+
45+
## Authenticating with MSAL Directly
46+
47+
Some applications already use the MSAL library's `IConfidentialClientApplication` or `IPublicClientApplication` to authenticate portions of their application. In these cases the application might want to use the same to authenticate Azure SDK clients so to take advantage of token caching the client application is doing and prevent unnecessary authentication calls or user prompting.
48+
49+
### Authenticating with the Confidential Client
50+
51+
In this example the `ConfidentialClientApplicationCredential` is constructed with an instance of `IConfidentialClientApplication` it then implements `GetToken` and `GetTokenAsync` using the `AcquireTokenForClient` method to acquire a token.
52+
53+
```C# Snippet:ConfidentialClientCredential
54+
public class ConfidentialClientCredential : TokenCredential
55+
{
56+
private readonly IConfidentialClientApplication _confidentialClient;
57+
58+
public ConfidentialClientCredential(IConfidentialClientApplication confidentialClient)
59+
{
60+
_confidentialClient = confidentialClient;
61+
}
62+
63+
public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
64+
{
65+
return GetTokenAsync(requestContext, cancellationToken).GetAwaiter().GetResult();
66+
}
67+
68+
public override async ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
69+
{
70+
AuthenticationResult result = await _confidentialClient.AcquireTokenForClient(requestContext.Scopes).ExecuteAsync();
71+
72+
return new AccessToken(result.AccessToken, result.ExpiresOn);
73+
}
74+
}
75+
```
76+
77+
The users could then use the `ConfidentialClientApplicationCredential` be used to authenticate a `BlobClient` with an `IConfidentialClientApplication` it has created to authenticate non Azure SDK calls.
78+
79+
```C# Snippet:ConfidentialClientCredentialUsage
80+
IConfidentialClientApplication confidentialClient = ConfidentialClientApplicationBuilder.Create(clientId).WithClientSecret(clientSecret).Build();
81+
82+
var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), new ConfidentialClientCredential(confidentialClient));
83+
```
84+
85+
## Authenticating with the On Behalf Of Flow
86+
Currently the Azure.Identity library doesn't provide a credential type for clients which need to authenticate via the On Behalf Of flow. While future support for this is planned, users requiring this immediately will have to implement their own `TokenCredential` class.
87+
88+
In this example the `OnBehalfOfCredential` accepts a client id, client secret, and a user's access token. It then creates an instance of `IConfidentialClientApplication` from the Microsoft.Identity.Client library (MSAL) to obtain an OBO token which can be used to authenticate client requests.
89+
90+
```C# Snippet:OnBehalfOfCredential
91+
public class OnBehalfOfCredential : TokenCredential
92+
{
93+
private readonly IConfidentialClientApplication _confidentialClient;
94+
private readonly UserAssertion _userAssertion;
95+
96+
public OnBehalfOfCredential(string clientId, string clientSecret, string userAccessToken)
97+
{
98+
_confidentialClient = ConfidentialClientApplicationBuilder.Create(clientId).WithClientSecret(clientSecret).Build();
99+
100+
_userAssertion = new UserAssertion(userAccessToken);
101+
}
102+
103+
public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
104+
{
105+
return GetTokenAsync(requestContext, cancellationToken).GetAwaiter().GetResult();
106+
}
107+
108+
public override async ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
109+
{
110+
AuthenticationResult result = await _confidentialClient.AcquireTokenOnBehalfOf(requestContext.Scopes, _userAssertion).ExecuteAsync();
111+
112+
return new AccessToken(result.AccessToken, result.ExpiresOn);
113+
}
114+
}
115+
```
116+
The following example shows an how the `OnBehalfOfCredential` could be used to authenticate a `SecretClient`.
117+
118+
119+
```C# Snippet:OnBehalfOfCredentialUsage
120+
var oboCredential = new OnBehalfOfCredential(clientId, clientSecret, userAccessToken);
121+
122+
var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), oboCredential);
123+
```

‎sdk/identity/Azure.Identity/tests/Azure.Identity.Tests.csproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
<ProjectReference Include="$(AzureCoreTestFramework)" />
2222
<ProjectReference Include="..\src\Azure.Identity.csproj" />
2323
<None Update="Data\*" CopyToOutputDirectory="PreserveNewest" />
24+
<ContentWithTargetPath Update="Data\*" CopyToOutputDirectory="PreserveNewest" TargetPath="certs\*" />
2425
</ItemGroup>
2526

2627
</Project>

0 commit comments

Comments
 (0)