Azure / Azure/azure-sdk-for-java

[Identity] Support Azure Arc user-assigned managed identity (UAMI) via MSAL

Open
#50,233 0 comments 2 reactions 1 assignee Claimed by @vcolin7 View on GitHub
Azure.Identity
Dominant language
Java
Stars
2.6k
Forks
2.2k
Avg merge
2d 8h
Merged PRs (30d)
178

Description

## Background

MSAL for Java (`msal4j`) now supports acquiring tokens for **user-assigned managed identities (UAMI) on Azure Arc** (`msal4j` **1.26.0**). Historically Azure Arc only supported system-assigned managed identity (SAMI). This issue tracks enabling Arc UAMI in `azure-identity` (`ManagedIdentityCredential` and `DefaultAzureCredential`).

## Current behavior

- `ManagedIdentityCredential` routes Arc through `ManagedIdentityMsalCredential` → `msal4j`'s `ManagedIdentityApplication` (only AKS federated-token is special-cased to `AksExchangeTokenCredential`). So the Arc **token path already uses MSAL**.
- However, `ManagedIdentityCredential.getToken()` contains an **explicit upfront block**: when a UAMI id is set and `ManagedIdentityApplication.getManagedIdentitySource()` is `CLOUD_SHELL` or `AZURE_ARC`, it throws `CredentialUnavailableException` ("User-assigned managed identity is not supported in AZURE_ARC..."). A separate block exists for `SERVICE_FABRIC`.
- A legacy `ArcIdentityCredential` also contains a UAMI guard (`if (getClientId() != null) throw ...`) that appears unused now that Arc is routed through `ManagedIdentityMsalCredential`.

Net effect: the token path is already MSAL-based; enabling Arc UAMI mainly requires removing the explicit `AZURE_ARC` guard plus a dependency uptake.

## Scope of work

- [ ] Bump `msal4j` to `>= 1.26.0`.
- [ ] Remove `AZURE_ARC` from the UAMI guard in `ManagedIdentityCredential.getToken()` (keep the Cloud Shell and Service Fabric guards).
- [ ] Clean up the now-dead UAMI guard in `ArcIdentityCredential` (optional).
- [ ] Verify Arc UAMI token acquisition (client id, resource id, object id as supported).
- [ ] Update tests, class Javadoc, and CHANGELOG.

## Key references

- `sdk/identity/azure-identity/src/main/java/com/azure/identity/ManagedIdentityCredential.java`
- `sdk/identity/azure-identity/src/main/java/com/azure/identity/ArcIdentityCredential.java`
- `sdk/identity/azure-identity/src/main/java/com/azure/identity/ManagedIdentityMsalCredential.java`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.