Fix for 3000 - improve error messages when credentials fail to load by bgavrilMS · Pull Request #3003 · AzureAD/microsoft-identity-web

bgavrilMS · 2024-09-03T13:44:34Z

Fixes #3000

Function changes:

DefaultCredentialLoader is now responsible for setting the Skip flag, instead of individual requests
Added more logging
If all credentails fail, the exception messages now contains all the detail (similar to how AzureDefaultCredential has all the details of failing creds)

Testing

Unit test that the correct assertion gets into MSAL from many combinations of credentials
Manual test (and unit test) for using a certificate chain of MSI and cert, where MSI fails
Manual test with cred chain - "AssertionFromFile" and then "CertificateFromKV".

src/Microsoft.Identity.Web.Certificate/SignedAssertionFromManagedIdentityCredentialLoader.cs

src/Microsoft.Identity.Web.TokenAcquisition/ConfidentialClientApplicationBuilderExtension.cs

src/Microsoft.Identity.Web.Certificate/DefaultCredentialsLoader.cs

src/Microsoft.Identity.Web.Certificate/SignedAssertionFilePathCredentialsLoader.cs

src/Microsoft.Identity.Web.Certificateless/ManagedIdentityClientAssertion.cs

tests/Microsoft.Identity.Web.Test/Certificates/WithClientCredentialsTests.cs

src/Microsoft.Identity.Web.TokenAcquisition/ConfidentialClientApplicationBuilderExtension.cs

jmprieur

I would be great to create an end to end test

src/Microsoft.Identity.Web.Certificateless/ManagedIdentityClientAssertion.cs

src/Microsoft.Identity.Web.Certificate/DefaultCredentialsLoader.cs

src/Microsoft.Identity.Web.Certificateless/ManagedIdentityClientAssertion.cs

…r MSI+FIC

jennyf19 · 2024-09-19T15:24:12Z

@bgavrilMS can you update w/master and respond to comments or mark them as resolved? thanks.

src/Microsoft.Identity.Web.Certificate/DefaultCredentialsLoader.cs

src/Microsoft.Identity.Web.Certificate/SignedAssertionFilePathCredentialsLoader.cs

src/Microsoft.Identity.Web.Certificate/DefaultCredentialsLoader.cs

jmprieur · 2024-09-23T20:34:12Z

Started doing end to end testing, and there seem to be a regression on #2675

...pps/daemon-app/daemon-console-calling-downstreamApi/DaemonConsoleCallingDownstreamApi.csproj

jmprieur · 2024-09-23T21:39:44Z

Started doing end to end testing, and there seem to be a regression on #2675

Actually no. It was a test error

jmprieur · 2024-09-24T00:12:22Z

I ran regression tests, which passed

…dentity-web into bogavril/3000

jennyf19

bgavrilMS requested a review from a team as a code owner September 3, 2024 13:44

bgavrilMS commented Sep 3, 2024

View reviewed changes

src/Microsoft.Identity.Web.Certificate/SignedAssertionFromManagedIdentityCredentialLoader.cs Show resolved Hide resolved

bgavrilMS commented Sep 3, 2024

View reviewed changes

src/Microsoft.Identity.Web.TokenAcquisition/ConfidentialClientApplicationBuilderExtension.cs Outdated Show resolved Hide resolved

bgavrilMS marked this pull request as draft September 4, 2024 16:03

bgavrilMS force-pushed the bogavril/3000 branch from c11352c to 69f6a2d Compare September 6, 2024 13:13

bgavrilMS marked this pull request as ready for review September 6, 2024 13:14

bgavrilMS force-pushed the bogavril/3000 branch 2 times, most recently from da44a2d to 9103068 Compare September 9, 2024 15:17