AzureCLICredential quoted arguments incorrectly on WindowsAzurePowerShellCredential, which authenticates as the identity logged in to Azure PowerShell(thanks ArmaanMcleod)
AZURE_TOKEN_CREDENTIALS is set to ManagedIdentityCredential, DefaultAzureCredential behaves the same as does ManagedIdentityCredential when used directly. It doesn't apply special retry configuration or attempt to
determine whether IMDS is available. (#25265)
WorkloadIdentityCredential support for identity binding mode added in v1.13.0-beta.1.It will return in v1.14.0-beta.1
AzurePowerShellCredential, which authenticates as the identity logged in to Azure PowerShell(thanks ArmaanMcleod)
WorkloadIdentityCredential supports identity binding mode (#25056)DefaultAzureCredentialOptions.RequireAzureTokenCredentials. NewDefaultAzureCredential returns an error when this option is true and the environment variable AZURE_TOKEN_CREDENTIALS has no value.
AzureDeveloperCLICredential no longer hangs when AZD_DEBUG is setGetToken methods of AzureCLICredential and AzureDeveloperCLICredential return an error when TokenRequestOptions.Claims has a value because these credentials can't acquire a token in that
case. The error messages describe the action required to get a token.
DefaultAzureCredential tries its next credential when a dev tool credential such as AzureCLICredential returns an error
DefaultAzureCredential allows selecting one of its credential types by name via environment variable AZURE_TOKEN_CREDENTIALS. It will use only the selected type at runtime. For example, set
AZURE_TOKEN_CREDENTIALS=WorkloadIdentityCredential to have DefaultAzureCredential use only
WorkloadIdentityCredential.
ManagedIdentityCredential retries IMDS requests for a maximum of ~70 seconds as recommendedin IMDS documentation. In previous versions, it would stop retrying after ~54 seconds by default.
AzureCLICredential and AzureDeveloperCLICredential could wait indefinitely for subprocess outputDefaultAzureCredential reads environment variable AZURE_TOKEN_CREDENTIALS to enable a subset of its credentials: - dev selects AzureCLICredential and AzureDeveloperCLICredential
- prod selects EnvironmentCredential, WorkloadIdentityCredential and ManagedIdentityCredential
GetToken() sets AccessToken.RefreshOn when the token provider specifies a valueNewManagedIdentityCredential logs the configured user-assigned identity, if anyUsernamePasswordCredential because it can't support multifactorauthentication (MFA), which Microsoft Entra ID requires for most tenants. See https://aka.ms/azsdk/identity/mfa for migration guidance.
DefaultAzureCredential skips managed identity in Azure Container InstancesAzureCLICredential and InteractiveBrowserCredential require setting AdditionallyAllowedTenants
when used with some clients
ChainedTokenCredential and DefaultAzureCredential continue to their next credential after ManagedIdentityCredential receives an unexpected response
from IMDS, indicating the response is from something else such as a proxy
AzurePipelinesCredential sets an additional OIDC request header so that itreceives a 401 instead of a 302 after presenting an invalid system access token
AzurePipelinesCredential and includethem in error messages
ObjectID type for ManagedIdentityCredentialOptions.IDNewManagedIdentityCredential now returns an error when a user-assigned identity is specified on a platform whose managed identity API doesn't support that.
ManagedIdentityCredential.GetToken() formerly logged a warning in these cases.
Returning an error instead prevents the credential authenticating an unexpected
identity, causing a client to act with unexpected privileges. The affected
platforms are:
* Azure Arc
* Azure ML (when a resource ID is specified; client IDs are supported)
* Cloud Shell
* Service Fabric
DefaultAzureCredential receives a non-JSON response when probing IMDS beforeattempting to authenticate a managed identity, it continues to the next credential in the chain instead of immediately returning an error.
These changes affect only code written against a beta version such as v1.7.0-beta.1
and persistent cache construction is separate from credential construction.
The PersistentUserAuthentication example in the package docs has been updated
to demonstrate the new API.
AzurePipelinesCredential authenticates an Azure Pipelines service connection withworkload identity federation
These changes affect only code written against a beta version such as v1.7.0-beta.1
AzurePipelinesCredential and persistent token caching APIThese changes affect only code written against a beta version such as v1.6.0-beta.4
NewAzurePipelinesCredential read from environment variables inprior versions are now parameters
AzurePipelinesServiceConnectionCredentialOptions to AzurePipelinesCredentialOptionsNewOnBehalfOfCredentialWithClientAssertions creates an on-behalf-of credentialthat authenticates with client assertions such as federated credentials
These changes affect only code written against a beta version such as v1.6.0-beta.4
AzurePipelinesCredential and the persistent token caching API.They will return in v1.7.0-beta.1
AzurePipelinesCredential authenticates an Azure Pipeline service connection withworkload identity federation
DefaultAzureCredential now sends a probe request with no retries for IMDS managed identityenvironments to avoid excessive retry delays when the IMDS endpoint is not available. This should improve credential chain resolution for local development scenarios.
ManagedIdentityCredential now specifies resource IDs correctly for Azure Container InstancesManagedIdentityCredential now specifies resource IDs correctly for Azure Container InstancesThese changes affect only code written against a beta version such as v1.6.0-beta.1
ErrAuthenticationRequired with AuthenticationRequiredError, a struct type that carries the TokenRequestOptions passed to the GetToken call which
returned the error.
DefaultAzureCredentialshould try their next credential after attempting managed identity authentication in a Docker Desktop container
AzureCLICredential uses the CLI's expires_on value for token expirationAzureCLICredentialOptions.SubscriptionInteractiveBrowserCredential handles AdditionallyAllowedTenants correctlyThese changes affect only code written against a beta version such as v1.5.0-beta.1
DefaultAzureCredential and ManagedIdentityCredential support Azure ML managed identityTokenCachePersistenceOptionson a credential's options to enable and configure this. See the package documentation for this version and TOKEN_CACHING.md for more details.
AzureDeveloperCLICredential authenticates with the Azure Developer CLI (azd). This credential is also part of the DefaultAzureCredential authentication flow.
ManagedIdentityCredential will now retry when IMDS responds 410 or 503These changes affect only code written against a beta version such as v1.4.0-beta.4
GetToken requests a CAE token is now determined by TokenRequestOptions.EnableCAE. AzureSDK clients which support CAE will set this option automatically. Credentials no longer request CAE tokens by default or observe the environment variable "AZUREIDENTITYDISABLE_CP1".
DefaultAzureCredential now try their next credential, if any, whenmanaged identity authentication fails in a Docker Desktop container (#21417)
AzureCLICredential.GetToken() and OnBehalfOfCredential.GetToken()can no longer make two authentication attempts
DefaultAzureCredentialOptions.TenantID applies to workload identity authenticationThese changes affect only code written against a beta version such as v1.3.0-beta.5
NewOnBehalfOfCredentialFromCertificate to NewOnBehalfOfCredentialWithCertificateNewOnBehalfOfCredentialFromSecret to NewOnBehalfOfCredentialWithSecretThese changes affect only code written against a beta version such as v1.3.0-beta.4
NewWorkloadIdentityCredential() parameters into WorkloadIdentityCredentialOptions.The constructor now reads default configuration from environment variables set by the Azure workload identity webhook by default. (#20478)
(#20479)
DefaultAzureCredential that could cause the managed identity endpoint check to fail in rare circumstances.WorkloadIdentityCredentialOptions.AdditionallyAllowedTenants and .DisableInstanceDiscoveryGetToken() so a single instance can be shared among goroutines(#20044)
Continuous Access Evaluation (CAE). This indicates to Microsoft Entra ID that your application can handle CAE claims challenges. You can disable this behavior by setting the environment variable "AZUREIDENTITYDISABLE_CP1" to "true".
InteractiveBrowserCredentialOptions.LoginHint enables pre-populating the loginprompt with a username (#15599)
Specify "adfs" as the credential's tenant.
requesting Microsoft Entra instance metadata by setting the DisableInstanceDiscovery
field on credential options.
options types for these credentials have an AdditionallyAllowedTenants field
that specifies additional tenants in which the credential may authenticate.
OnBehalfOfCredential to support the on-behalf-of flow(#16642)
AzureCLICredential reports token expiration in local time (should be UTC)AzureCLICredential imposes its default timeout only when the Context passed to GetToken() has no deadline
NewCredentialUnavailableError(). This function constructs an error indicating a credential can't authenticate and an encompassing ChainedTokenCredential should
try its next credential, if any.
WorkloadIdentityCredential and DefaultAzureCredential support Workload Identity Federation on Kubernetes. DefaultAzureCredential
support requires environment variable configuration as set by the
Workload Identity webhook.
(#15615)
ManagedIdentityCredential caches tokens in memoryClientCertificateCredential sends only the leaf cert for SNI authenticationClientAssertionCredential to enable applications to authenticatewith custom client assertions
microsoft-authentication-library-for-go requirement to v0.6.0EnvironmentCredential reads certificate passwords from AZURE_CLIENT_CERTIFICATE_PASSWORD(#17099)
ClientCertificateCredential and ClientSecretCredential support ESTS-R. First-party applications can set environment variable AZURE_REGIONAL_AUTHORITY_NAME with a
region name.
(#15605)
microsoft-authentication-library-for-go requirement to v0.5.1(#18176)
DefaultAzureCredential reads environment variable AZURE_CLIENT_ID for theclient ID of a user-assigned managed identity (#17293)
AuthorizationCodeCredential. Use InteractiveBrowserCredential insteadto authenticate a user with the authorization code flow.
AuthenticationFailedError are now returned by pointer.GetToken() returns azcore.AccessToken by valueAzureCLICredential panics after receiving an unexpected error type(#17490)
GetToken() returns an error when the caller specifies no scopegolang.org/x/crypto, azcore and internalAuthorityHost. Credentials are now configured for sovereign or private clouds with the API in azcore/cloud, for example:
`go
// before
opts := azidentity.ClientSecretCredentialOptions{AuthorityHost: azidentity.AzureGovernment}
cred, err := azidentity.NewClientSecretCredential(tenantID, clientID, secret, &opts)
// after import "github.com/Azure/azure-sdk-for-go/sdk/azcore/cloud"
opts := azidentity.ClientSecretCredentialOptions{}
opts.Cloud = cloud.AzureGovernment
cred, err := azidentity.NewClientSecretCredential(tenantID, clientID, secret, &opts)
`
DefaultAzureCredential and ChainedTokenCredential(#17144)
(#17086)
EnvironmentCredential supports certificate SNI authentication when AZURE_CLIENT_SEND_CERTIFICATE_CHAIN is "true".
(#16851)
ManagedIdentityCredential.GetToken() now returns an error when configured fora user assigned identity in Azure Cloud Shell (which doesn't support such identities) (#16946)
NewDefaultAzureCredential() logs non-fatal errors. These errors are also included in the error returned by DefaultAzureCredential.GetToken() when it's unable to acquire a token
from any source. (#15923)
AuthenticationFailedError.RawResponse() with a field having the same nameCredentialUnavailableErrorChainedTokenCredential will now skip looping through the list of source credentials and re-use the first successful credential on subsequent calls to GetToken. * If ChainedTokenCredentialOptions.RetrySources is true, ChainedTokenCredential will continue to try all of the originally provided credentials each time the GetToken method is called.
* ChainedTokenCredential.successfulCredential will contain a reference to the last successful credential.
* DefaultAzureCredenial will also re-use the first successful credential on subsequent calls to GetToken.
* DefaultAzureCredential.chain.successfulCredential will also contain a reference to the last successful credential.
ManagedIdentityCredential no longer probes IMDS before requesting a tokenfrom it. Also, an error response from IMDS no longer disables a credential instance. Following an error, a credential instance will continue to send requests to IMDS as necessary.
azcore requirement to 0.21.0NewAuthenticationPolicy() from credentials. Clients should instead use azcore's runtime.NewBearerTokenPolicy() to construct a bearer token authorization policy.
AuthorityHost field in credential options structs is now a custom type, AuthorityHost, with underlying type string
NewChainedTokenCredential has a new signature to accommodate a placeholder options struct:
`go
// before
cred, err := NewChainedTokenCredential(credA, credB)
// after
cred, err := NewChainedTokenCredential([]azcore.TokenCredential{credA, credB}, nil)
`
ExcludeAzureCLICredential, ExcludeEnvironmentCredential, and ExcludeMSICredential from DefaultAzureCredentialOptions
NewClientCertificateCredential requires a []*x509.Certificate and crypto.PrivateKey instead of a path to a certificate file. Added ParseCertificates to simplify getting these in common cases:
`go
// before
cred, err := NewClientCertificateCredential("tenant", "client-id", "/cert.pem", nil)
// after
certData, err := os.ReadFile("/cert.pem")
certs, key, err := ParseCertificates(certData, password)
cred, err := NewClientCertificateCredential(tenantID, clientID, certs, key, nil)
`
InteractiveBrowserCredentialOptions.ClientSecret and .PortAADAuthenticationFailedErrorid parameter of NewManagedIdentityCredential(). User assigned identities are now specified by ManagedIdentityCredentialOptions.ID:
`go
// before
cred, err := NewManagedIdentityCredential("client-id", nil)
// or, for a resource ID
opts := &ManagedIdentityCredentialOptions{ID: ResourceID}
cred, err := NewManagedIdentityCredential("/subscriptions/...", opts)
// after
clientID := ClientID("7cf7db0d-...")
opts := &ManagedIdentityCredentialOptions{ID: clientID}
// or, for a resource ID
resID: ResourceID("/subscriptions/...")
opts := &ManagedIdentityCredentialOptions{ID: resID}
cred, err := NewManagedIdentityCredential(opts)
`
DeviceCodeCredentialOptions.UserPrompt has a new type: func(context.Context, DeviceCodeMessage) errorazcore.ClientOptions. In addition to changing literal initialization syntax, this change renames HTTPClient fields to Transport.
LogCredential to EventCredentialAzureCLICredential no longer reads the environment variable AZURE_CLI_PATHNewManagedIdentityCredential no longer reads environment variables AZURE_CLIENT_ID and AZURE_RESOURCE_ID. Use ManagedIdentityCredentialOptions.ID instead.
AuthenticationFailedError and CredentialUnavailableError structs. In their place are twointerfaces having the same names.
AzureCLICredential.GetToken no longer mutates its opts.ScopesDefaultAzureCredentialOptionsAuthenticationFailedError.RawResponse() returns the HTTP response motivating the error,if available
NewDefaultAzureCredential() returns *DefaultAzureCredential instead of *ChainedTokenCredentialTenantID field to DefaultAzureCredentialOptions and AzureCLICredentialOptionsAzureCLICredentialOptions.TokenProvider and its type, AzureCLITokenProvider
ManagedIdentityCredential.GetToken returns CredentialUnavailableError when IMDS has no assigned identity, signaling DefaultAzureCredential to
try other credentials
azcore refactor #15383ManagedIdentityCredential.GetToken no longer mutates its opts.Scopesazcore to v0.18.1ManagedIdentityCredentialManagedIdentityCredentialManagedIdentityCredentialGetToken() on ManagedIdentityCredentialInteractiveBrowserCredentialredirectURI parameter back to authentication code flowManagedIdentityCredential and updating datetime string for parsing managed identity access tokens.RedirectURL parameter from auth code flow to align with the MSAL implementation which relies on the native client redirect URL.ManagedIdentityCredentialDeviceCodeCredential callbackAuthorizationCodeCredentialInteractiveBrowserCredentialazidentity on top of azcore refactorpolicy.Policy interface changes.azcore.NonRetriableError.Request.SetBody() to include content type.AzureCLICredential to DefaultAzureCredential chain