Azure / Azure/azure-cli

Implement `azure-identity`'s multi-tenant authentication API

Open
#20,881 3 comments 0 reactions 1 assignee Claimed by @jiasli View on GitHub
act-platform-engineering-squad Core feature-request
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

## Context

`azure-identity` introduced its new multi-tenant authentication API `get_token(tenant_id=...)`:

- https://github.com/Azure/azure-sdk-for-python/pull/20940

Meanwhile, before this is implemented, Azure CLI developed its own multi-tenant authentication implementation using `CredentialAdaptor.get_auxiliary_tokens` (#19853):

https://github.com/Azure/azure-cli/blob/110f7b402020f3d3ebd2bfb923ac5a01d026cdd1/src/azure-cli-core/azure/cli/core/commands/client_factory.py#L180-L189

This makes `CredentialAdaptor.get_token` incompatible with `azure-identity`'s [`InteractiveCredential.get_token`](https://github.com/Azure/azure-sdk-for-python/blob/01d0b99e53a1995b39e59649bf3d550dc5408875/sdk/identity/azure-identity/azure/identity/_internal/interactive.py#L103) which takes `tenant_id` and resolves it at

https://github.com/Azure/azure-sdk-for-python/blob/01d0b99e53a1995b39e59649bf3d550dc5408875/sdk/identity/azure-identity/azure/identity/_internal/msal_credentials.py#L62

```py
def _get_app(self, **kwargs):
# type: (**Any) -> msal.ClientApplication
tenant_id = resolve_tenant(self._tenant_id, **kwargs)
```

## TODO

`CredentialAdaptor.get_token` should be able to take `tenant_id`.

## References

- https://github.com/Azure/azure-cli/pull/20880
- https://github.com/Azure/azure-cli/pull/20856

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.