search

AzureAD / microsoft-authentication-library-for-python

Microsoft Authentication Library (MSAL) for Python makes it easy to authenticate to Microsoft Entra ID. General docs are available here https://learn.microsoft.com/entra/msal/python/ Stable APIs are documented here https://msal-python.readthedocs.io. Questions can be asked on www.stackoverflow.com with tag "msal" + "python".
https://stackoverflow.com/questions/tagged/azure-ad-msal+python
Other
795 stars 200 forks source link

[Feature Request] Add cert validation for MI auth in Service Fabric #654

Open Avery-Dunn opened 8 months ago

Avery-Dunn commented 8 months ago

MSAL client type

Managed identity

Problem Statement

According to the managed identity docs for Service Fabric, there is an environment variable called "IDENTITY_SERVER_THUMBPRINT": https://learn.microsoft.com/en-us/azure/service-fabric/how-to-managed-identity-service-fabric-app-code#acquiring-an-access-token-using-rest-api

And per those docs, the thumbprint should be used as part of the steps to retrieve a token:

To obtain a token, the client performs the following steps:

  • forms a URI by concatenating the managed identity endpoint (IDENTITY_ENDPOINT value) with the API version and the resource (audience) required for the token
  • creates a GET http(s) request for the specified URI
  • adds appropriate server certificate validation logic
  • adds the authentication code (IDENTITY_HEADER value) as a header to the request
  • submits the request

Proposed solution

The docs don't describe what 'appropriate' validation entails, however Azure Identity does perform this step for the Java and .NET libraries:

Unfortunately for Python they have not implemented any validation logic to copy, and simply hardcode the relevant 'connection_verify' flag to false.

rayluo commented 8 months ago

Unfortunately for Python they have not implemented any validation logic to copy, and simply hardcode the relevant 'connection_verify' flag to false.

No wonder we were not aware of this feature requirement when we researched the prior art in Azure Identity for Python. And, that also means MSAL Python's current Managed Identity behavior is on par with Azure Identity's status quo.

bgavrilMS commented 7 months ago

Marking this a bug, as it is inconsistent with Azure SDK's managed identity implementation, which we try to replace. This is a GA blocker.

Avery-Dunn commented 7 months ago

For Java and .NET it's a bug since the behavior doesn't match what's in Azure SDK, but for Python (and Node) Azure SDK's implementation doesn't currently validate the cert so the current behavior technically is consistent.

However, they also have an issue on their backlog to add this validation, and I believe it's a blocker for them as well: https://github.com/Azure/azure-sdk-for-python/issues/33431

xiangyan99 commented 7 months ago

Disabling cert validation is our behavior today. Given that, I don't think this is a GA blocker.

xiangyan99 commented 7 months ago

And if you want to discuss more details, let's use emails.