Managed Identity and Service Principal Support

[embetten]

Overview

• Added MSAL Managed Identity and Service Principal Token Providers to Microsoft.Artifacts.Authentication Library.
• Created new endpoint ARTIFACTS_CREDENTIALPROVIDER_FEED_ENDPOINTS environment variable with new json schema for MI/SP required fields.
• Updated VstsBuildTaskServiceEndpointCredentialProvider to call Microsoft.Artifacts.Authentication for MI/SP token providers.
• Reverted #485 Changes to use system.text.json for de/serialization everywhere except for the VSS_NUGET_EXTERNAL_FEED_ENDPOINTS environment variable.

Design Decisions

• Intentionally not supporting SP secrets authentication to promote security best practices.
• The new environment variable name and json schema were created instead of reusing or extending the existing VSS_NUGET_EXTERNAL_FEED_ENDPOINTS to reduce password usage and clarify the environment variable will be available to our other credproviders such as the artifacs-keyring not just NuGet.

Environment Variable

ARTIFACTS_CREDENTIALPROVIDER_FEED_ENDPOINTS

 {"endpointCredentials": [{"endpoint":"http://example.index.json", "clientId":"required", "clientCertificateSubjectName":"optional", "clientCertificateFilePath":"optional"}]}

• endpoint: required. Feed url to authenticate against.
• clientId: required for both MI/SP. For user assigned managed identities enter the Entra client id. For system assigned variables set the value to system.
• clientCertificateSubjectName: Subject Name of the certificate located in the My/ CurrentUser or LocalMachine certificate store. Optional field. Only used by SP authentication.
• clientCertificateFilePath: File path location of the certificate on the machine. Optional field. Only used by SP authentication.

Will throw error if both clientCertificateSubjectName or clientCertificateFilePath are specified.

[JohnSchmeichel]

using System;

add license header

---

Refers to: CredentialProvider.Microsoft/CredentialProviders/VstsBuildTaskServiceEndpoint/VstsBuildTaskMsalTokenProvidersFactory.cs:1 in 0dceaff. [](commit_id = 0dceaff4b5011ec085c15f3ae33bd0c967a108f0, deletion_comment = False)

[JohnSchmeichel]

using System;

same for all new (non test?) files

---

In reply to: 2116411091

---

Refers to: CredentialProvider.Microsoft/CredentialProviders/VstsBuildTaskServiceEndpoint/VstsBuildTaskMsalTokenProvidersFactory.cs:1 in 0dceaff. [](commit_id = 0dceaff4b5011ec085c15f3ae33bd0c967a108f0, deletion_comment = False)

[JohnSchmeichel]

using System;

test files too

---

In reply to: 2116411506

---

Refers to: CredentialProvider.Microsoft/CredentialProviders/VstsBuildTaskServiceEndpoint/VstsBuildTaskMsalTokenProvidersFactory.cs:1 in 0dceaff. [](commit_id = 0dceaff4b5011ec085c15f3ae33bd0c967a108f0, deletion_comment = False)

[JohnSchmeichel]

please address the build warnings as well, there are a few about package conflicts. surprised these are not failing the build :(