Azure / Azure/azure-sdk-for-java
[Identity] Support Azure Arc user-assigned managed identity (UAMI) via MSAL
- Dominant language
- Java
- Stars
- 2.6k
- Forks
- 2.2k
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 178
Description
## Background
MSAL for Java (`msal4j`) now supports acquiring tokens for **user-assigned managed identities (UAMI) on Azure Arc** (`msal4j` **1.26.0**). Historically Azure Arc only supported system-assigned managed identity (SAMI). This issue tracks enabling Arc UAMI in `azure-identity` (`ManagedIdentityCredential` and `DefaultAzureCredential`).
## Current behavior
- `ManagedIdentityCredential` routes Arc through `ManagedIdentityMsalCredential` → `msal4j`'s `ManagedIdentityApplication` (only AKS federated-token is special-cased to `AksExchangeTokenCredential`). So the Arc **token path already uses MSAL**.
- However, `ManagedIdentityCredential.getToken()` contains an **explicit upfront block**: when a UAMI id is set and `ManagedIdentityApplication.getManagedIdentitySource()` is `CLOUD_SHELL` or `AZURE_ARC`, it throws `CredentialUnavailableException` ("User-assigned managed identity is not supported in AZURE_ARC..."). A separate block exists for `SERVICE_FABRIC`.
- A legacy `ArcIdentityCredential` also contains a UAMI guard (`if (getClientId() != null) throw ...`) that appears unused now that Arc is routed through `ManagedIdentityMsalCredential`.
Net effect: the token path is already MSAL-based; enabling Arc UAMI mainly requires removing the explicit `AZURE_ARC` guard plus a dependency uptake.
## Scope of work
- [ ] Bump `msal4j` to `>= 1.26.0`.
- [ ] Remove `AZURE_ARC` from the UAMI guard in `ManagedIdentityCredential.getToken()` (keep the Cloud Shell and Service Fabric guards).
- [ ] Clean up the now-dead UAMI guard in `ArcIdentityCredential` (optional).
- [ ] Verify Arc UAMI token acquisition (client id, resource id, object id as supported).
- [ ] Update tests, class Javadoc, and CHANGELOG.
## Key references
- `sdk/identity/azure-identity/src/main/java/com/azure/identity/ManagedIdentityCredential.java`
- `sdk/identity/azure-identity/src/main/java/com/azure/identity/ArcIdentityCredential.java`
- `sdk/identity/azure-identity/src/main/java/com/azure/identity/ManagedIdentityMsalCredential.java`
Contributor guide
Assessment
This issue has not been assessed yet.