public async Task SilentAuthenticateWithBrokerAsync()
{
TokenCachePersistenceOptions persistenceOptions = new TokenCachePersistenceOptions();
// to fully manually verify the InteractiveBrowserCredential this test should be run both authenticating with a
// school / organization account as well as a personal live account, i.e. a @outlook.com, @live.com, or @hotmail.com
var cred = new InteractiveBrowserCredential(new InteractiveBrowserCredentialBrokerOptions {
TokenCachePersistenceOptions = persistenceOptions
});
AccessToken token = await cred.GetTokenAsync(new TokenRequestContext(new string[] { "https://vault.azure.net/.default" })).ConfigureAwait(false);
Assert.NotNull(token.Token);
var silentCred = new SharedTokenCacheCredential(new SharedTokenCacheCredentialBrokerOptions());
// The calls below this should be silent and not require user interaction
token = await cred.GetTokenAsync(new TokenRequestContext(new string[] { "https://vault.azure.net/.default" })).ConfigureAwait(false);
Assert.NotNull(token.Token);
token = await cred.GetTokenAsync(new TokenRequestContext(new string[] { "https://management.core.windows.net//.default" })).ConfigureAwait(false);
Assert.NotNull(token.Token);
}
/// <summary>
/// Get interactive user credentials for Azure Devops.
/// </summary>
/// <returns>AzDO Credentials</returns>
private static async Task <VssCredentials> GetInteractiveUserCredentials()
{
var browserCredential = new InteractiveBrowserCredential();
var context = new TokenRequestContext(AzureDevOpsAuthScopes);
var authToken = await browserCredential.GetTokenAsync(context, System.Threading.CancellationToken.None);
return(new VssCredentials(new VssBasicCredential("", authToken.Token)));
}
public async Task AuthenticateWithBrowserSingleTenantAsync()
{
var cred = new InteractiveBrowserCredential(TenantId, SingleTenantClientId);
AccessToken token = await cred.GetTokenAsync(new TokenRequestContext(new string[] { "https://vault.azure.net/.default" })).ConfigureAwait(false);
Assert.NotNull(token.Token);
}
public async Task AuthenticateWithBrowserAsync()
{
// to fully manually verify the InteractiveBrowserCredential this test should be run both authenticating with a
// school / organization account as well as a personal live account, i.e. a @outlook.com, @live.com, or @hotmail.com
var cred = new InteractiveBrowserCredential();
AccessToken token = await cred.GetTokenAsync(new TokenRequestContext(new string[] { "https://vault.azure.net/.default" })).ConfigureAwait(false);
Assert.NotNull(token.Token);
}
public async Task AuthenticateFollowedByGetTokenAsync()
{
var cred = new InteractiveBrowserCredential();
// this should pop browser
await cred.AuthenticateAsync();
// this should not pop browser
AccessToken token = await cred.GetTokenAsync(new TokenRequestContext(new string[] { "https://vault.azure.net/.default" })).ConfigureAwait(false);
Assert.NotNull(token.Token);
}
public void AuthenticateBrowserCancellationAsync()
{
var cred = new InteractiveBrowserCredential();
var cancelSource = new CancellationTokenSource();
ValueTask <AccessToken> getTokenTask = cred.GetTokenAsync(new TokenRequestContext(new string[] { "https://vault.azure.net/.default" }), cancelSource.Token);
cancelSource.Cancel();
Assert.ThrowsAsync <OperationCanceledException>(async() => await getTokenTask.ConfigureAwait(false));
}
// This test should be run with an MSA account to validate that the refresh for MSA accounts works properly
public async Task AuthenticateWithMSAWithSubsequentSilentRefresh()
{
var cred = new InteractiveBrowserCredential();
// this should pop browser
var authRecord = await cred.AuthenticateAsync();
Assert.NotNull(authRecord);
// this should not pop browser
AccessToken token = await cred.GetTokenAsync(new TokenRequestContext(new string[] { "https://vault.azure.net/.default" })).ConfigureAwait(false);
Assert.NotNull(token.Token);
}
public async Task AuthenticateWithSharedTokenCacheAsync()
{
var cred = new InteractiveBrowserCredential(new InteractiveBrowserCredentialOptions {
TokenCache = new PersistentTokenCache()
});
// this should pop browser
AuthenticationRecord record = await cred.AuthenticateAsync();
var cred2 = new InteractiveBrowserCredential(new InteractiveBrowserCredentialOptions {
TokenCache = new PersistentTokenCache(), AuthenticationRecord = record
});
// this should not pop browser
AccessToken token = await cred2.GetTokenAsync(new TokenRequestContext(new string[] { "https://vault.azure.net/.default" })).ConfigureAwait(false);
Assert.NotNull(token.Token);
}
public override Task <IAccessToken> Authenticate(AuthenticationParameters parameters, CancellationToken cancellationToken)
{
var interactiveParameters = parameters as InteractiveParameters;
var onPremise = interactiveParameters.Environment.OnPremise;
//null instead of "organizations" should be passed to Azure.Identity to support MSA account
var tenantId = onPremise ? AdfsTenant :
(string.Equals(parameters.TenantId, OrganizationsTenant, StringComparison.OrdinalIgnoreCase) ? null : parameters.TenantId);
var tokenCacheProvider = interactiveParameters.TokenCacheProvider;
var resource = interactiveParameters.Environment.GetEndpoint(interactiveParameters.ResourceId) ?? interactiveParameters.ResourceId;
var scopes = AuthenticationHelpers.GetScope(onPremise, resource);
var clientId = AuthenticationHelpers.PowerShellClientId;
var requestContext = new TokenRequestContext(scopes);
var authority = interactiveParameters.Environment.ActiveDirectoryAuthority;
AzureSession.Instance.TryGetComponent(nameof(PowerShellTokenCache), out PowerShellTokenCache tokenCache);
var options = new InteractiveBrowserCredentialOptions()
{
ClientId = clientId,
TenantId = tenantId,
TokenCache = tokenCache.TokenCache,
AuthorityHost = new Uri(authority),
RedirectUri = GetReplyUrl(onPremise, interactiveParameters),
};
var browserCredential = new InteractiveBrowserCredential(options);
var source = new CancellationTokenSource();
source.CancelAfter(TimeSpan.FromMinutes(5));
var authTask = browserCredential.AuthenticateAsync(requestContext, source.Token);
return(MsalAccessToken.GetAccessTokenAsync(
authTask,
() => browserCredential.GetTokenAsync(requestContext, source.Token),
source.Token));
}
public void DisableAutomaticAuthenticationException()
{
var cred = new InteractiveBrowserCredential(new InteractiveBrowserCredentialOptions {
DisableAutomaticAuthentication = true
});
var expTokenRequestContext = new TokenRequestContext(new string[] { "https://vault.azure.net/.default" }, Guid.NewGuid().ToString());
var ex = Assert.ThrowsAsync <AuthenticationRequiredException>(async() => await cred.GetTokenAsync(expTokenRequestContext).ConfigureAwait(false));
Assert.AreEqual(expTokenRequestContext, ex.TokenRequestContext);
}