search

Azure / azure-sdk-for-python

This repository is for active development of the Azure SDK for Python. For consumers of the SDK we recommend visiting our public developer docs at https://learn.microsoft.com/python/azure/ or our versioned developer docs at https://azure.github.io/azure-sdk-for-python.
MIT License
4.55k stars 2.77k forks source link

Identity Threat Model Review (WAM) #30162

Closed joshfree closed 11 months ago

joshfree commented 1 year ago

Tracking item for Azure Identity Threat Model Update and Review

pvaneck commented 11 months ago

After going through the existing threat model checklist, the changes required for WAM support in the Identity library do not require any additional updates. Based on previous discussion, the items listed in the threat model report were not applicable. WAM support is toggled with a boolean parameter from Identity. WAM support is also not in the main-line InteractiveBrowserCredential and instead must be installed and used via a separate package azure-identity-broker.

On both the Identity and MSAL-side, static code security analysis was run using bandit, and no noteworthy issues were found.