Retracted: v1.10.0 was re-tagged after publication; use v1.10.1.
Documentation
¶
Overview ¶
Package managedidentity provides a client for retrieval of Managed Identity applications. The Managed Identity Client is used to acquire a token for managed identity assigned to an azure resource such as Azure function, app service, virtual machine, etc. to acquire a token without using credentials.
Index ¶
Constants ¶
const ( TokenSourceIdentityProvider = base.TokenSourceIdentityProvider TokenSourceCache = base.TokenSourceCache )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AcquireTokenOption ¶
type AcquireTokenOption func(o *AcquireTokenOptions)
func WithClaims ¶
func WithClaims(claims string) AcquireTokenOption
WithClaims sets additional claims to request for the token, such as those required by token revocation or conditional access policies. Use this option when Azure AD returned a claims challenge for a prior request. The argument must be decoded.
type AcquireTokenOptions ¶
type AcquireTokenOptions struct {
// contains filtered or unexported fields
}
type AuthResult ¶ added in v1.4.2
type AuthResult = base.AuthResult
AuthResult contains the results of one token acquisition operation. For details see https://aka.ms/msal-net-authenticationresult
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
func New ¶
func New(id ID, options ...ClientOption) (Client, error)
Client to be used to acquire tokens for managed identity. ID: SystemAssigned, UserAssignedClientID, UserAssignedResourceID, UserAssignedObjectID
Options: WithHTTPClient
func (Client) AcquireToken ¶
func (c Client) AcquireToken(ctx context.Context, resource string, options ...AcquireTokenOption) (AuthResult, error)
Acquires tokens from the configured managed identity on an azure resource.
Resource: scopes application is requesting access to Options: WithClaims
type ClientConfigurer ¶ added in v1.10.0
type ClientConfigurer interface {
ops.HTTPClient
// ConfigureClient receives augment, which derives the client MSAL requires from the supplied
// base client. See [ClientConfigurer] for the contract implementations must satisfy.
ConfigureClient(augment func(*http.Client) (*http.Client, error)) error
}
ClientConfigurer is an ops.HTTPClient that lets MSAL install the transport and client configuration a flow requires, such as Service Fabric certificate pinning. Pass one to WithHTTPClient and MSAL will call ConfigureClient during New.
Only the Service Fabric managed identity source consumes a ClientConfigurer. For every other source MSAL uses the value directly as an ops.HTTPClient and does not call ConfigureClient, so implementations should not rely on ConfigureClient being invoked outside Service Fabric.
Implementations of ConfigureClient must:
- call augment exactly once, synchronously, before ConfigureClient returns, passing the non-nil client MSAL should build upon;
- route every subsequent Do call through the client augment returns, without bypassing its transport, TLS configuration, or redirect policy;
- forward CloseIdleConnections to that same client;
- return any error augment reports and complete all configuration before returning.
MSAL fails closed: if augment reports an error, New returns it even when ConfigureClient discards the error and returns nil, so a misconfigured client is never returned.
MSAL calls ConfigureClient once, during New; a ClientConfigurer need not be safe for concurrent configuration. An implementation may wrap additional middleware around the client augment returns so long as requests still traverse the augmented transport and redirect policy.
type ClientOption ¶
type ClientOption func(*Client)
func WithHTTPClient ¶
func WithHTTPClient(httpClient ops.HTTPClient) ClientOption
WithHTTPClient allows for a custom HTTP client to be set. Flows that must configure the transport underlying the client (for example, Service Fabric certificate pinning) require a ClientConfigurer, because a plain ops.HTTPClient exposes no way to apply those requirements; pass a ClientConfigurer here and MSAL will invoke it to install the configuration it needs.
Only the Service Fabric source currently consumes a ClientConfigurer; every other managed identity source treats the value as a plain ops.HTTPClient and never calls ConfigureClient.
func WithRetryPolicyDisabled ¶
func WithRetryPolicyDisabled() ClientOption
type ID ¶
type ID interface {
// contains filtered or unexported methods
}
func SystemAssigned ¶
func SystemAssigned() ID
type Source ¶
type Source string
const ( // DefaultToIMDS indicates that the source is defaulted to IMDS when no environment variables are set. DefaultToIMDS Source = "DefaultToIMDS" AzureArc Source = "AzureArc" ServiceFabric Source = "ServiceFabric" CloudShell Source = "CloudShell" AzureML Source = "AzureML" AppService Source = "AppService" )
type TokenSource ¶ added in v1.4.2
type TokenSource = base.TokenSource
type UserAssignedClientID ¶
type UserAssignedClientID string
type UserAssignedObjectID ¶
type UserAssignedObjectID string
type UserAssignedResourceID ¶
type UserAssignedResourceID string
Source Files