[Identity] BrokeredAuthentication adding SharedTokenCacheCredentialBrokerOptions (Azure#27917)

schaabs · web-flow · commit b9f809a41477 · 2022-03-31T15:11:47.000-07:00
* Azure.Identity.BrokeredAuthentication adding SharedTokenCacheCredentialBrokerOptions

* updating core ref to project ref

* updating api spec

* refactoring to use a shared internal interface

* fix tests

* move extension test back to avoid dups
diff --git a/sdk/identity/Azure.Identity.BrokeredAuthentication/CHANGELOG.md b/sdk/identity/Azure.Identity.BrokeredAuthentication/CHANGELOG.md
@@ -3,6 +3,7 @@
 ## 1.0.0-beta.2 (Unreleased)
 
 ### Features Added
+- Added `SharedTokenCacheCredentialBrokerOptions` to enable `SharedTokenCacheCredential` to use the authentication broker for silent authentication calls when this specicialized options type is used to construct the credential.
 
 ### Breaking Changes
 
diff --git a/sdk/identity/Azure.Identity.BrokeredAuthentication/api/Azure.Identity.BrokeredAuthentication.net461.cs b/sdk/identity/Azure.Identity.BrokeredAuthentication/api/Azure.Identity.BrokeredAuthentication.net461.cs
@@ -4,4 +4,8 @@ public partial class InteractiveBrowserCredentialBrokerOptions : Azure.Identity.
     {
         public InteractiveBrowserCredentialBrokerOptions() { }
     }
+    public partial class SharedTokenCacheCredentialBrokerOptions : Azure.Identity.SharedTokenCacheCredentialOptions
+    {
+        public SharedTokenCacheCredentialBrokerOptions() { }
+    }
 }
diff --git a/sdk/identity/Azure.Identity.BrokeredAuthentication/api/Azure.Identity.BrokeredAuthentication.netstandard2.0.cs b/sdk/identity/Azure.Identity.BrokeredAuthentication/api/Azure.Identity.BrokeredAuthentication.netstandard2.0.cs
@@ -4,4 +4,8 @@ public partial class InteractiveBrowserCredentialBrokerOptions : Azure.Identity.
     {
         public InteractiveBrowserCredentialBrokerOptions() { }
     }
+    public partial class SharedTokenCacheCredentialBrokerOptions : Azure.Identity.SharedTokenCacheCredentialOptions
+    {
+        public SharedTokenCacheCredentialBrokerOptions() { }
+    }
 }
diff --git a/sdk/identity/Azure.Identity.BrokeredAuthentication/src/Azure.Identity.BrokeredAuthentication.csproj b/sdk/identity/Azure.Identity.BrokeredAuthentication/src/Azure.Identity.BrokeredAuthentication.csproj
@@ -11,8 +11,16 @@
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
   </PropertyGroup>
   <ItemGroup>
-    <PackageReference Include="Azure.Core" />
-    <PackageReference Include="Azure.Identity" VersionOverride="1.6.0-beta.1" />
+    <!--TODO: Switch back to package reference once Core is released prior to Azure.Identity release
+   <PackageReference Include="Azure.Core" />
+   -->
+    <ProjectReference Include="../../../core/Azure.Core/src/Azure.Core.csproj" />
+    <!-- 
+      Update this project reference back to package refefence after next Azure.Identity
+      release, before relasing Azure.Identity.BrokeredAuthentication 1.0.0-beta.2.
+    -->
+    <!--<PackageReference Include="Azure.Identity" VersionOverride="1.6.0-beta.1" />-->
+    <ProjectReference Include="../../Azure.Identity/src/Azure.Identity.csproj"/>
     <PackageReference Include="System.Memory" />
     <PackageReference Include="System.Text.Json" />
     <PackageReference Include="System.Threading.Tasks.Extensions" />
diff --git a/sdk/identity/Azure.Identity.BrokeredAuthentication/src/InteractiveBrowserCredentialBrokerOptions.cs b/sdk/identity/Azure.Identity.BrokeredAuthentication/src/InteractiveBrowserCredentialBrokerOptions.cs
@@ -1,6 +1,7 @@
 ﻿// Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
+using System;
 using Microsoft.Identity.Client;
 #if (NETFRAMEWORK)
 using Microsoft.Identity.Client.Desktop;
@@ -11,15 +12,9 @@ namespace Azure.Identity.BrokeredAuthentication
     /// <summary>
     /// Options to configure the <see cref="InteractiveBrowserCredential"/> to use the system authentication broker in lieu of the system browser if available.
     /// </summary>
-    public class InteractiveBrowserCredentialBrokerOptions : InteractiveBrowserCredentialOptions
+    public class InteractiveBrowserCredentialBrokerOptions : InteractiveBrowserCredentialOptions, IMsalPublicClientInitializerOptions
     {
-        /// <summary>
-        /// Creates a new instance of <see cref="InteractiveBrowserCredentialBrokerOptions"/>.
-        /// </summary>
-        public InteractiveBrowserCredentialBrokerOptions()
-        {
-            this.BeforeBuildClient = AddBroker;
-        }
+        Action<PublicClientApplicationBuilder> IMsalPublicClientInitializerOptions.BeforeBuildClient => AddBroker;
 
         private void AddBroker(PublicClientApplicationBuilder builder)
         {
diff --git a/sdk/identity/Azure.Identity.BrokeredAuthentication/src/SharedTokenCacheCredentialBrokerOptions.cs b/sdk/identity/Azure.Identity.BrokeredAuthentication/src/SharedTokenCacheCredentialBrokerOptions.cs
@@ -0,0 +1,28 @@
+﻿// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System;
+using Microsoft.Identity.Client;
+#if (NETFRAMEWORK)
+using Microsoft.Identity.Client.Desktop;
+#endif
+
+namespace Azure.Identity.BrokeredAuthentication
+{
+    /// <summary>
+    /// Options to configure the <see cref="SharedTokenCacheCredential"/> to use the system authentication broker for silent authentication if available.
+    /// </summary>
+    public class SharedTokenCacheCredentialBrokerOptions : SharedTokenCacheCredentialOptions, IMsalPublicClientInitializerOptions
+    {
+        Action<PublicClientApplicationBuilder> IMsalPublicClientInitializerOptions.BeforeBuildClient => AddBroker;
+
+        private void AddBroker(PublicClientApplicationBuilder builder)
+        {
+#if (NETFRAMEWORK)
+            builder.WithWindowsBroker();
+#else
+            builder.WithBroker();
+#endif
+        }
+    }
+}
diff --git a/sdk/identity/Azure.Identity.BrokeredAuthentication/tests/ManualSharedTokenCacheCredentialBrokerTests.cs b/sdk/identity/Azure.Identity.BrokeredAuthentication/tests/ManualSharedTokenCacheCredentialBrokerTests.cs
@@ -0,0 +1,39 @@
+﻿// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System.Security.AccessControl;
+using System.Threading.Tasks;
+using Azure.Core;
+using NUnit.Framework;
+
+namespace Azure.Identity.BrokeredAuthentication.Tests
+{
+    public class ManualSharedTokenCacheCredentialBrokerTests
+    {
+        [Test]
+        [Ignore("This test is an integration test which can only be run with user interaction")]
+        public async Task SilentAuthenticateWithBrokerAsync()
+        {
+            TokenCachePersistenceOptions persistenceOptions = new TokenCachePersistenceOptions();
+
+            // to fully manually verify the InteractiveBrowserCredential this test should be run both authenticating with a
+            // school / organization account as well as a personal live account, i.e. a @outlook.com, @live.com, or @hotmail.com
+            var cred = new InteractiveBrowserCredential(new InteractiveBrowserCredentialBrokerOptions { TokenCachePersistenceOptions = persistenceOptions});
+
+            AccessToken token = await cred.GetTokenAsync(new TokenRequestContext(new string[] { "https://vault.azure.net/.default" })).ConfigureAwait(false);
+
+            Assert.NotNull(token.Token);
+
+            var silentCred = new SharedTokenCacheCredential(new SharedTokenCacheCredentialBrokerOptions());
+
+            // The calls below this should be silent and not require user interaction
+            token = await cred.GetTokenAsync(new TokenRequestContext(new string[] { "https://vault.azure.net/.default" })).ConfigureAwait(false);
+
+            Assert.NotNull(token.Token);
+
+            token = await cred.GetTokenAsync(new TokenRequestContext(new string[] { "https://management.core.windows.net//.default" })).ConfigureAwait(false);
+
+            Assert.NotNull(token.Token);
+        }
+    }
+}
diff --git a/sdk/identity/Azure.Identity/src/Credentials/InteractiveBrowserCredential.cs b/sdk/identity/Azure.Identity/src/Credentials/InteractiveBrowserCredential.cs
@@ -80,8 +80,7 @@ internal InteractiveBrowserCredential(string tenantId, string clientId, TokenCre
             Pipeline = pipeline ?? CredentialPipeline.GetInstance(options);
             LoginHint = (options as InteractiveBrowserCredentialOptions)?.LoginHint;
             var redirectUrl = (options as InteractiveBrowserCredentialOptions)?.RedirectUri?.AbsoluteUri ?? Constants.DefaultRedirectUrl;
-            var beforeBuildClient = (options as InteractiveBrowserCredentialOptions)?.BeforeBuildClient;
-            Client = client ?? new MsalPublicClient(Pipeline, tenantId, clientId, redirectUrl, options, beforeBuildClient);
+            Client = client ?? new MsalPublicClient(Pipeline, tenantId, clientId, redirectUrl, options);
         }
 
         /// <summary>
diff --git a/sdk/identity/Azure.Identity/src/Credentials/InteractiveBrowserCredentialOptions.cs b/sdk/identity/Azure.Identity/src/Credentials/InteractiveBrowserCredentialOptions.cs
@@ -3,7 +3,6 @@
 
 using System;
 using System.Threading;
-using Microsoft.Identity.Client;
 
 namespace Azure.Identity
 {
@@ -54,7 +53,5 @@ public string TenantId
         /// Avoids the account prompt and pre-populates the username of the account to login.
         /// </summary>
         public string LoginHint { get; set; }
-
-        internal Action<PublicClientApplicationBuilder> BeforeBuildClient { get; set; }
     }
 }
diff --git a/sdk/identity/Azure.Identity/src/IMsalPublicClientInitializerOptions.cs b/sdk/identity/Azure.Identity/src/IMsalPublicClientInitializerOptions.cs
@@ -0,0 +1,15 @@
+﻿// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System;
+using System.Collections.Generic;
+using System.Text;
+using Microsoft.Identity.Client;
+
+namespace Azure.Identity
+{
+    internal interface IMsalPublicClientInitializerOptions
+    {
+        Action<PublicClientApplicationBuilder> BeforeBuildClient { get; }
+    }
+}
diff --git a/sdk/identity/Azure.Identity/src/MsalPublicClient.cs b/sdk/identity/Azure.Identity/src/MsalPublicClient.cs
@@ -20,11 +20,12 @@ internal class MsalPublicClient : MsalClientBase<IPublicClientApplication>
         protected MsalPublicClient()
         { }
 
-        public MsalPublicClient(CredentialPipeline pipeline, string tenantId, string clientId, string redirectUrl, TokenCredentialOptions options, Action<PublicClientApplicationBuilder> beforeBuildClient = null)
+        public MsalPublicClient(CredentialPipeline pipeline, string tenantId, string clientId, string redirectUrl, TokenCredentialOptions options)
             : base(pipeline, tenantId, clientId, options)
         {
             RedirectUrl = redirectUrl;
-            _beforeBuildClient = beforeBuildClient;
+
+            _beforeBuildClient = (options as IMsalPublicClientInitializerOptions)?.BeforeBuildClient;
         }
 
         protected override ValueTask<IPublicClientApplication> CreateClientAsync(bool async, CancellationToken cancellationToken)
diff --git a/sdk/identity/Azure.Identity/tests/InteractiveBrowserCredentialTests.cs b/sdk/identity/Azure.Identity/tests/InteractiveBrowserCredentialTests.cs
@@ -242,22 +242,32 @@ public async Task UsesTenantIdHint([Values(null, TenantIdHint)] string tenantId,
             Assert.AreEqual(expiresOn, actualToken.ExpiresOn, "expiresOn should match");
         }
 
+        public class ExtendedInteractiveBrowserCredentialOptions : InteractiveBrowserCredentialOptions, IMsalPublicClientInitializerOptions
+        {
+            private Action<PublicClientApplicationBuilder> _beforeBuildClient;
+
+            public ExtendedInteractiveBrowserCredentialOptions(Action<PublicClientApplicationBuilder> beforeBuildClient)
+            {
+                _beforeBuildClient = beforeBuildClient;
+            }
+
+            Action<PublicClientApplicationBuilder> IMsalPublicClientInitializerOptions.BeforeBuildClient { get { return _beforeBuildClient; } }
+        }
+
         [Test]
-        public async Task InvokesBeforeBuildClient()
+        public async Task InvokesBeforeBuildClientOnExtendedOptions()
         {
             bool beforeBuildClientInvoked = false;
 
             var cancelSource = new CancellationTokenSource(2000);
 
-            var options = new InteractiveBrowserCredentialOptions
+            var options = new ExtendedInteractiveBrowserCredentialOptions(builder =>
             {
-                BeforeBuildClient = builder =>
-                {
-                    Assert.NotNull(builder);
-                    beforeBuildClientInvoked = true;
-                    cancelSource.Cancel();
-                }
-            };
+                Assert.NotNull(builder);
+                beforeBuildClientInvoked = true;
+                cancelSource.Cancel();
+            }
+            );
 
             var credential = InstrumentClient(new InteractiveBrowserCredential(options));
 
diff --git a/sdk/identity/Azure.Identity/tests/Mock/MockMsalPublicClient.cs b/sdk/identity/Azure.Identity/tests/Mock/MockMsalPublicClient.cs
@@ -41,8 +41,8 @@ internal class MockMsalPublicClient : MsalPublicClient
 
         public MockMsalPublicClient() { }
 
-        public MockMsalPublicClient(CredentialPipeline pipeline, string tenantId, string clientId, string redirectUrl, TokenCredentialOptions options, Action<PublicClientApplicationBuilder> beforeBuildClient = null)
-            : base(pipeline, tenantId, clientId, redirectUrl, options, beforeBuildClient) { }
+        public MockMsalPublicClient(CredentialPipeline pipeline, string tenantId, string clientId, string redirectUrl, TokenCredentialOptions options)
+            : base(pipeline, tenantId, clientId, redirectUrl, options) { }
 
         protected override ValueTask<List<IAccount>> GetAccountsCoreAsync(bool async, CancellationToken cancellationToken)
         {
diff --git a/sdk/identity/Azure.Identity/tests/Properties/AssemblyInfo.cs b/sdk/identity/Azure.Identity/tests/Properties/AssemblyInfo.cs
@@ -0,0 +1,6 @@
+﻿// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System.Runtime.CompilerServices;
+
+[assembly: Azure.Core.AzureResourceProviderNamespace("Microsoft.AAD")]

Original file line number	Diff line number	Diff line change
`@@ -4,4 +4,8 @@ public partial class InteractiveBrowserCredentialBrokerOptions : Azure.Identity.`
`4`	`4`	`{`
`5`	`5`	`public InteractiveBrowserCredentialBrokerOptions() { }`
`6`	`6`	`}`
	`7`	`+ public partial class SharedTokenCacheCredentialBrokerOptions : Azure.Identity.SharedTokenCacheCredentialOptions`
	`8`	`+ {`
	`9`	`+ public SharedTokenCacheCredentialBrokerOptions() { }`
	`10`	`+ }`
`7`	`11`	`}`
Original file line number	Diff line number	Diff line change
`@@ -80,8 +80,7 @@ internal InteractiveBrowserCredential(string tenantId, string clientId, TokenCre`
`80`	`80`	`Pipeline = pipeline ?? CredentialPipeline.GetInstance(options);`
`81`	`81`	`LoginHint = (options as InteractiveBrowserCredentialOptions)?.LoginHint;`
`82`	`82`	`var redirectUrl = (options as InteractiveBrowserCredentialOptions)?.RedirectUri?.AbsoluteUri ?? Constants.DefaultRedirectUrl;`
`83`		`- var beforeBuildClient = (options as InteractiveBrowserCredentialOptions)?.BeforeBuildClient;`
`84`		`- Client = client ?? new MsalPublicClient(Pipeline, tenantId, clientId, redirectUrl, options, beforeBuildClient);`
	`83`	`+ Client = client ?? new MsalPublicClient(Pipeline, tenantId, clientId, redirectUrl, options);`
`85`	`84`	`}`
`86`	`85`
`87`	`86`	`/// <summary>`
Original file line number	Diff line number	Diff line change
`@@ -3,7 +3,6 @@`
`3`	`3`
`4`	`4`	`using System;`
`5`	`5`	`using System.Threading;`
`6`		`-using Microsoft.Identity.Client;`
`7`	`6`
`8`	`7`	`namespace Azure.Identity`
`9`	`8`	`{`
`@@ -54,7 +53,5 @@ public string TenantId`
`54`	`53`	`/// Avoids the account prompt and pre-populates the username of the account to login.`
`55`	`54`	`/// </summary>`
`56`	`55`	`public string LoginHint { get; set; }`
`57`		`-`
`58`		`- internal Action<PublicClientApplicationBuilder> BeforeBuildClient { get; set; }`
`59`	`56`	`}`
`60`	`57`	`}`