Skip to content

Commit 2d33359

Browse files
KarishmaGhiyaKarishmaGhiya
authored
[Identity] Add Pop token support (#30961)
Fixes #23329 - Added SHR PoP token support to @azure/core-auth - Added SHR PoP token support to `InteractiveBrowserCredential` Native Broker Scenarios via @azure/identity and @azure/identity-broker
1 parent 97fe6d1 commit 2d33359

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+1318
-77
lines changed

‎sdk/core/core-auth/CHANGELOG.md

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,10 @@
11
# Release History
22

3-
## 1.8.1 (Unreleased)
3+
## 1.9.0 (2024-10-15)
44

55
### Features Added
66

7-
### Breaking Changes
8-
9-
### Bugs Fixed
10-
11-
### Other Changes
7+
- Added Proof-of-Possession via Signed HTTP Request (SHR) support to `AccessToken` and `GetTokenOptions` for `TokenCredential`. #30961
128

139
## 1.8.0 (2024-09-12)
1410

‎sdk/core/core-auth/package.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@azure/core-auth",
3-
"version": "1.8.1",
3+
"version": "1.9.0",
44
"description": "Provides low-level interfaces and helper methods for authentication in Azure SDK",
55
"sdk-type": "client",
66
"type": "module",
@@ -75,7 +75,7 @@
7575
},
7676
"dependencies": {
7777
"@azure/abort-controller": "^2.0.0",
78-
"@azure/core-util": "^1.1.0",
78+
"@azure/core-util": "^1.11.0",
7979
"tslib": "^2.6.2"
8080
},
8181
"devDependencies": {

‎sdk/core/core-auth/review/core-auth.api.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,14 @@
55
```ts
66

77
import { AbortSignalLike } from '@azure/abort-controller';
8+
import { HttpMethods } from '@azure/core-util';
89

910
// @public
1011
export interface AccessToken {
1112
expiresOnTimestamp: number;
1213
refreshAfterTimestamp?: number;
1314
token: string;
15+
tokenType?: "Bearer" | "pop";
1416
}
1517

1618
// @public
@@ -40,6 +42,11 @@ export interface GetTokenOptions {
4042
abortSignal?: AbortSignalLike;
4143
claims?: string;
4244
enableCae?: boolean;
45+
proofOfPossessionOptions?: {
46+
nonce: string;
47+
resourceRequestMethod: HttpMethods;
48+
resourceRequestUrl: string;
49+
};
4350
requestOptions?: {
4451
timeout?: number;
4552
};
@@ -49,6 +56,8 @@ export interface GetTokenOptions {
4956
};
5057
}
5158

59+
export { HttpMethods }
60+
5261
// @public
5362
export function isKeyCredential(credential: unknown): credential is KeyCredential;
5463

‎sdk/core/core-auth/src/index.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
// Copyright (c) Microsoft Corporation.
22
// Licensed under the MIT License.
3-
3+
export { HttpMethods } from "@azure/core-util";
44
export { AzureKeyCredential } from "./azureKeyCredential.js";
55
export { KeyCredential, isKeyCredential } from "./keyCredential.js";
66
export {

‎sdk/core/core-auth/src/tokenCredential.ts

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
import { AbortSignalLike } from "@azure/abort-controller";
55
import { TracingContext } from "./tracing.js";
6+
import { HttpMethods } from "@azure/core-util";
67

78
/**
89
* Represents a credential capable of providing an authentication token.
@@ -59,6 +60,28 @@ export interface GetTokenOptions {
5960
* Allows specifying a tenantId. Useful to handle challenges that provide tenant Id hints.
6061
*/
6162
tenantId?: string;
63+
64+
/**
65+
* Options for Proof of Possession token requests
66+
*/
67+
proofOfPossessionOptions?: {
68+
/**
69+
* The nonce value required for PoP token requests.
70+
* This is typically retrieved from the WWW-Authenticate header of a 401 challenge response.
71+
* This is used in combination with {@link resourceRequestUrl} and {@link resourceRequestMethod} to generate the PoP token.
72+
*/
73+
nonce: string;
74+
/**
75+
* The HTTP method of the request.
76+
* This is used in combination with {@link resourceRequestUrl} and {@link nonce} to generate the PoP token.
77+
*/
78+
resourceRequestMethod: HttpMethods;
79+
/**
80+
* The URL of the request.
81+
* This is used in combination with {@link resourceRequestMethod} and {@link nonce} to generate the PoP token.
82+
*/
83+
resourceRequestUrl: string;
84+
};
6285
}
6386

6487
/**
@@ -79,6 +102,27 @@ export interface AccessToken {
79102
* The timestamp when the access token should be refreshed, in milliseconds, UNIX epoch time.
80103
*/
81104
refreshAfterTimestamp?: number;
105+
106+
/** Type of token - `Bearer` or `pop` */
107+
tokenType?: "Bearer" | "pop";
108+
}
109+
110+
/**
111+
* @internal
112+
* @param accessToken - Access token
113+
* @returns Whether a token is bearer type or not
114+
*/
115+
export function isBearerToken(accessToken: AccessToken): boolean {
116+
return !accessToken.tokenType || accessToken.tokenType === "Bearer";
117+
}
118+
119+
/**
120+
* @internal
121+
* @param accessToken - Access token
122+
* @returns Whether a token is Pop token or not
123+
*/
124+
export function isPopToken(accessToken: AccessToken): boolean {
125+
return accessToken.tokenType === "pop";
82126
}
83127

84128
/**

‎sdk/core/core-client/src/authorizeRequestOnClaimChallenge.ts

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,9 @@ export async function authorizeRequestOnClaimChallenge(
9494
return false;
9595
}
9696

97-
onChallengeOptions.request.headers.set("Authorization", `Bearer ${accessToken.token}`);
97+
onChallengeOptions.request.headers.set(
98+
"Authorization",
99+
`${accessToken.tokenType ?? "Bearer"} ${accessToken.token}`,
100+
);
98101
return true;
99102
}

‎sdk/core/core-client/src/authorizeRequestOnTenantChallenge.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ export const authorizeRequestOnTenantChallenge: (
5959

6060
challengeOptions.request.headers.set(
6161
Constants.HeaderConstants.AUTHORIZATION,
62-
`Bearer ${accessToken.token}`,
62+
`${accessToken.tokenType ?? "Bearer"} ${accessToken.token}`,
6363
);
6464
return true;
6565
}

‎sdk/core/core-rest-pipeline/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@
9494
"@azure/abort-controller": "^2.0.0",
9595
"@azure/core-auth": "^1.8.0",
9696
"@azure/core-tracing": "^1.0.1",
97-
"@azure/core-util": "^1.10.0",
97+
"@azure/core-util": "^1.11.0",
9898
"@azure/logger": "^1.0.0",
9999
"http-proxy-agent": "^7.0.0",
100100
"https-proxy-agent": "^7.0.0",

‎sdk/core/core-rest-pipeline/review/core-rest-pipeline.api.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import type { AccessToken } from '@azure/core-auth';
99
import { AzureLogger } from '@azure/logger';
1010
import type { Debugger } from '@azure/logger';
1111
import type { GetTokenOptions } from '@azure/core-auth';
12+
import { HttpMethods } from '@azure/core-util';
1213
import type { OperationTracingOptions } from '@azure/core-tracing';
1314
import type { TokenCredential } from '@azure/core-auth';
1415

@@ -177,8 +178,7 @@ export interface HttpHeaders extends Iterable<[string, string]> {
177178
}): RawHttpHeaders;
178179
}
179180

180-
// @public
181-
export type HttpMethods = "GET" | "PUT" | "POST" | "DELETE" | "PATCH" | "HEAD" | "OPTIONS" | "TRACE";
181+
export { HttpMethods }
182182

183183
// @public
184184
export interface InternalPipelineOptions extends PipelineOptions {

‎sdk/core/core-rest-pipeline/src/index.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,16 +9,16 @@ declare global {
99
interface ReadableStream<R = any> {}
1010
interface TransformStream<I = any, O = any> {}
1111
}
12-
/* eslint-enable @typescript-eslint/no-unused-vars */
1312

13+
/* eslint-enable @typescript-eslint/no-unused-vars */
14+
export type { HttpMethods } from "@azure/core-util";
1415
export type {
1516
Agent,
1617
BodyPart,
1718
FormDataMap,
1819
FormDataValue,
1920
HttpClient,
2021
HttpHeaders,
21-
HttpMethods,
2222
KeyObject,
2323
MultipartRequestBody,
2424
PipelineRequest,

‎sdk/core/core-rest-pipeline/src/interfaces.ts

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
import type { AbortSignalLike } from "@azure/abort-controller";
55
import type { OperationTracingOptions } from "@azure/core-tracing";
6+
import type { HttpMethods } from "@azure/core-util";
67

78
/**
89
* A HttpHeaders collection represented as a simple JSON object.
@@ -314,19 +315,6 @@ export type TransferProgressEvent = {
314315
loadedBytes: number;
315316
};
316317

317-
/**
318-
* Supported HTTP methods to use when making requests.
319-
*/
320-
export type HttpMethods =
321-
| "GET"
322-
| "PUT"
323-
| "POST"
324-
| "DELETE"
325-
| "PATCH"
326-
| "HEAD"
327-
| "OPTIONS"
328-
| "TRACE";
329-
330318
/**
331319
* Options to configure a proxy for outgoing requests (Node.js only).
332320
*/

‎sdk/core/core-rest-pipeline/src/pipelineRequest.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
import type {
55
FormDataMap,
66
HttpHeaders,
7-
HttpMethods,
87
MultipartRequestBody,
98
PipelineRequest,
109
ProxySettings,
@@ -15,6 +14,7 @@ import { createHttpHeaders } from "./httpHeaders.js";
1514
import type { AbortSignalLike } from "@azure/abort-controller";
1615
import { randomUUID } from "@azure/core-util";
1716
import type { OperationTracingOptions } from "@azure/core-tracing";
17+
import type { HttpMethods } from "@azure/core-util";
1818

1919
/**
2020
* Settings to initialize a request.

‎sdk/core/core-util/CHANGELOG.md

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,10 @@
11
# Release History
22

3-
## 1.10.1 (Unreleased)
3+
## 1.11.0 (2024-10-15)
44

55
### Features Added
66

7-
### Breaking Changes
8-
9-
### Bugs Fixed
10-
11-
### Other Changes
7+
- Added support for `HttpMethods` type
128

139
## 1.10.0 (2024-09-12)
1410

‎sdk/core/core-util/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@azure/core-util",
3-
"version": "1.10.1",
3+
"version": "1.11.0",
44
"description": "Core library for shared utility methods",
55
"sdk-type": "client",
66
"type": "module",

‎sdk/core/core-util/review/core-util.api.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,9 @@ export function getErrorMessage(e: unknown): string;
6060
// @public
6161
export function getRandomIntegerInclusive(min: number, max: number): number;
6262

63+
// @public
64+
export type HttpMethods = "GET" | "PUT" | "POST" | "DELETE" | "PATCH" | "HEAD" | "OPTIONS" | "TRACE";
65+
6366
// @public
6467
export const isBrowser: boolean;
6568

‎sdk/core/core-util/src/httpMethods.ts

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
// Copyright (c) Microsoft Corporation.
2+
// Licensed under the MIT License.
3+
4+
/**
5+
* @public
6+
* Supported HTTP methods to use when making requests.
7+
*/
8+
export type HttpMethods =
9+
| "GET"
10+
| "PUT"
11+
| "POST"
12+
| "DELETE"
13+
| "PATCH"
14+
| "HEAD"
15+
| "OPTIONS"
16+
| "TRACE";

‎sdk/core/core-util/src/index.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ export { isError, getErrorMessage } from "./error.js";
1717
export { computeSha256Hash, computeSha256Hmac } from "./sha256.js";
1818
export { isDefined, isObjectWithProperties, objectHasProperty } from "./typeGuards.js";
1919
export { randomUUID } from "./uuidUtils.js";
20+
export { HttpMethods } from "./httpMethods.js";
2021
export {
2122
isBrowser,
2223
isBun,

‎sdk/identity/identity-broker/CHANGELOG.md

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,10 @@
11
# Release History
22

3-
## 1.0.2 (Unreleased)
3+
## 1.1.0 (2024-10-15)
44

55
### Features Added
66

7-
### Breaking Changes
8-
9-
### Bugs Fixed
10-
11-
### Other Changes
7+
- Added Proof-of-Possession via Signed HTTP Request (SHR) support to `AccessToken` and `GetTokenOptions` for `InteractiveBrowserCredential` native broker scenarios. #30961
128

139
## 1.0.1 (2024-06-10)
1410

‎sdk/identity/identity-broker/package.json

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@azure/identity-broker",
3-
"version": "1.0.2",
3+
"version": "1.1.0",
44
"sdk-type": "client",
55
"description": "A native plugin for Azure Identity credentials to enable broker authentication such as WAM",
66
"main": "dist/index.js",
@@ -28,7 +28,8 @@
2828
"unit-test": "npm run unit-test:node && npm run unit-test:browser",
2929
"unit-test:browser": "echo skipped",
3030
"unit-test:node": "dev-tool run test:node-ts-input -- --timeout 300000 --exclude 'test/**/browser/**/*.spec.ts' --exclude 'test/snippets.spec.ts' 'test/**/**/*.spec.ts'",
31-
"update-snippets": "dev-tool run update-snippets"
31+
"update-snippets": "dev-tool run update-snippets",
32+
"unit-test:manual": "dev-tool run test:node-ts-input -- --timeout 300000 'test/manual/node/popTokenSupport.spec.ts'"
3233
},
3334
"files": [
3435
"dist/",
@@ -58,17 +59,18 @@
5859
"homepage": "https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/identity/identity-broker/README.md",
5960
"sideEffects": false,
6061
"dependencies": {
61-
"@azure/core-auth": "^1.4.0",
62-
"@azure/identity": "^4.0.1",
63-
"@azure/msal-node": "^2.9.2",
64-
"@azure/msal-node-extensions": "^1.0.7",
62+
"@azure/core-auth": "^1.9.0",
63+
"@azure/identity": "^4.5.0",
64+
"@azure/msal-node-extensions": "^1.3.0",
65+
"@azure/msal-node": "^2.15.0",
6566
"tslib": "^2.2.0"
6667
},
6768
"devDependencies": {
6869
"@azure-tools/test-recorder": "^3.0.0",
6970
"@azure-tools/test-utils": "^1.0.1",
7071
"@azure/abort-controller": "^1.1.0",
7172
"@azure/core-client": "^1.7.0",
73+
"@azure/core-rest-pipeline": "^1.17.0",
7274
"@azure/core-util": "^1.6.0",
7375
"@azure/dev-tool": "^1.0.0",
7476
"@azure/eslint-plugin-azure-sdk": "^3.0.0",

0 commit comments

Comments
 (0)