MSAL MSI with Credentials - Authentication Design #5096
Conversation
docs/msi_with_credential_design.md
Outdated
| - Send a POST request to the IMDS `/credential` endpoint with the certificate details. | ||
| - The request must include: | ||
| - `Metadata: true` header. | ||
| - `X-ms-Client-Request-id` header with a GUID. |
There was a problem hiding this comment.
Presumably this is the CorrelationID similar to CCA's correlation ID? And it also implies that we should add WithCorrelationID API to MSIApplication?
There was a problem hiding this comment.
if we add a WithCorrelationID, will it be a no-op in legacy MSI?
docs/msi_with_credential_design.md
Outdated
| | `WithClientCapabilities()` | Allows client capabilities | | ||
| | `WithClaims()` | Allows passing of claims (bypasses cache). | | ||
| | `GetBindingCertificate()` | Helper method to get the binding certificate. | | ||
| | `GetManagedIdentitySourceAsync()`| Helper method to get the managed identity source. | |
There was a problem hiding this comment.
This alraedy exists in all MSALs no? For Azure SDK. Do we add an extra source?
There was a problem hiding this comment.
yes we are adding a new GetManagedIdentitySourceAsync
docs/msi_with_credential_design.md
Outdated
| - Convert the certificate to a Base64-encoded string (`x5c`). | ||
| - Format the JSON payload containing the certificate details for request authentication. | ||
|
|
||
| ### 4. Request MSI Credential |
There was a problem hiding this comment.
What about credential caching? Where do we cache this?
There was a problem hiding this comment.
we do not cache credentials
docs/msi_with_credential_design.md
Outdated
|
|
||
| - **[SLC Design Document](https://microsoft.sharepoint.com/:w:/t/AzureMSI/EURnTEtFXPlDngpYhCUioqUBvbSUWEX7vZjP0nm8bxUsQA?e=Ejok1n&wdLOR=cE6820299-49AF-4D7A-B7F7-F58D65C232B6)** | ||
| - **[MSAL EPIC](https://identitydivision.visualstudio.com/Engineering/_workitems/edit/3027078)** | ||
|
|
There was a problem hiding this comment.
There needs to be a telemetry chapter. At a minimum we'd want to know if we are dealing with a self-generated cert or one read from the store. Anything else?
docs/vm_vmss_credential_probe.md
Outdated
| | **4️⃣** | If **500 Internal Server Error**, check the **Server** header. | `"Microsoft-IIS/10.0"` (no `IMDS/`) | Retry the request (IMDS might be restarting). | | ||
| | **5️⃣** | If the response does not match the above cases, treat it as **unexpected behavior**. | | Log the issue or fallback to IMDS `/token` if applicable. | | ||
|
|
||
| --- |
There was a problem hiding this comment.
Telemetry chapter? Smth like Probe outcome - "found the endpoint with no retries", "found with retries" and "not found"
docs/slc_revocation_spec.md
Outdated
| ## **MSAL Behavior to Relay the Signal to IMDS** | ||
|
|
||
| - MSAL can only determine that an `{ "error": "invalid_client" }` response is caused by a credential issue but cannot handle suberrors explicitly. | ||
| - For SLC-related errors, MSAL will retry obtaining a new SLC from IMDS and retry with eSTS. |
docs/slc_revocation_spec.md
Outdated
|
|
||
| return tokenResponse; | ||
| ``` | ||
|
|
There was a problem hiding this comment.
Telemetyry chapter and acceptance tests chapter are missing.
docs/slc_revocation_spec.md
Outdated
|
|
||
| - MSAL can only determine that an `{ "error": "invalid_client" }` response is caused by a credential issue but cannot handle suberrors explicitly. | ||
| - For SLC-related errors, MSAL will retry obtaining a new SLC from IMDS and retry with eSTS. | ||
| - For claims challenges, MSAL does not get a signal from eSTS but rather from the app developer when passing claims to MSAL. |
There was a problem hiding this comment.
Probably deserves its own chapter?
Fixes #5121
This pull request includes several important changes that provide detailed guidance on implementing and handling the MSI V2
/credentialendpoint, including token acquisition, SLC revocation, and probing logic for VM/VMSS. The key changes are summarized below:Implementation of MSI V2
/credentialEndpoint:/credentialendpoint, including steps for certificate handling and source detection logic.SLC Revocation Specification:
VM/VMSS Credential Endpoint Probe Logic:
/credentialendpoint in IMDS for VM/VMSS, including handling IMDS restart scenarios and expected responses.