Add test case to show that OBO supports SP

AzureAD / microsoft-authentication-library-for-python

Microsoft Authentication Library (MSAL) for Python makes it easy to authenticate to Microsoft Entra ID. General docs are available here https://learn.microsoft.com/entra/msal/python/ Stable APIs are documented here https://msal-python.readthedocs.io. Questions can be asked on www.stackoverflow.com with tag "msal" + "python".

https://stackoverflow.com/questions/tagged/azure-ad-msal+python

Other

770 stars 192 forks source link

Add test case to show that OBO supports SP #481

Open rayluo opened 2 years ago

rayluo commented 2 years ago

There is no code change to MSAL's implementation in this PR. This means the existing MSAL Python needs no change to support the OBO-for-SP scenario, perhaps since the initial OBO implementation.
This PR contains changes to MSAL's test case, to demonstrate that how OBO for SP could work. It is a matter of how the mid-tier app chooses to manage the potentially-more-than-one SP "accounts", which can be an open topic for discussion.
Currently, the test certificate is not committed, so, the new test case will not be run in CI. But it was manually run by PR author.

bgavrilMS commented 9 months ago

We have an E2E in MSAL.NET - please ping the .NET team to discuss about the certificate.

micwoj92 commented 8 months ago

This branch has conflicts that must be resolved.

rayluo commented 8 months ago

This branch has conflicts that must be resolved.

Thanks. We will be informed of this by github when we revisit this PR (possibly while attempting to solve the test cert topic mentioned above).

Meanwhile, assuming your interest on this topic was driven by your trying to find an OBO example for Service Principal, this PR in its current form (i.e., before merging) still worked as-is, and can serve its current purpose of showcasing how to do OBO with SP.

bgavrilMS commented 8 months ago

@micwoj92 - just to set expectations here. OBO for service principals is currently being experimented on by some internal teams. There is not way for external customers to configure it.