palmemanuel / azauth

A PowerShell module to handle authentication for Azure.

Hello there! <⚡>

I'm an IT nerd who loves Azure and .NET, always interested in learning something new. When I'm not writing code or exploring serverless tech I enjoy slaying virtual dragons with my friends.

I write potentially educational things about my endeavours in tech on my blog PipeHow.

azauth's Issues

Re-write Contribution guide for Sampler workflow

After #46 the workflow is changed.

CTRL + C to cancel commands should be respected

Add help documentation

Add support for IntegratedCredentialWindows auth

https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-desktop-acquire-token-integrated-windows-authentication?tabs=dotnet

Add data to output object

If I am connected to different environments using Azure PowerShell and az login there is no simple way of knowing which of these connections are used to check out my token.

Would it be possible to add more data to the returned token, such as source of the token? I know it is strictly ordered and I can find it in the source code, but it would simplify cashing of tokens and decrease the chances of working against wrong environment.

Improve error messages

Workload Identity Federation

Implement Workload Identity Federation authentication - https://github.com/MicrosoftDocs/microsoft-authentication-library-dotnet/blob/main/msal-dotnet-articles/acquiring-tokens/web-apps-apis/workload-identity-federation.md

Add support for ClientAssertion auth

EXO authentication stopped working since friday

When using token to authenticate i get this error:

when using token from your module -> if i leave authentication on EXO module alone it works without an issue, how ever this is not usable for my scenario :/ Could i ask you please to take a look in to this issue ?

Personal accounts using the Consumer endpoint do not work with cached tokens

When using -Interactive and -TokenCache to save a token using a personal account (gmail for example), it's not possible to then get the token from cache using only -TokenCache.

Might be possible to implement a full cache handling instead, see https://aka.ms/msal-net-token-cache-serialization

Token output should contain a list of all claims

The output AzToken should have a property containing all claims, not just properties of the parsed ones.

Failed to refresh token with multiple caches

Recreantly i start getting this error when trying to use 2 different named cashes at once

First cash always works correctly second one almost never. :(

Implement non-terminating errors

Catch and WriteError

Use token to connect to MS Exchange Online

Hello,

when using Get-MsalToken from deferent module i am able to connect to whit token to Exchange online powershell
how ever when using more robust Get-AzToken from this module i am not able to connect even that i am passing correct resource url https://outlook.office365.com/

Is there anybody who was able to connect successfully to EXO ?

Module can't be imported on Azure Functions using Linux runtime.

When trying to import the module on an Azure Function using Linux runtime there is a dll loading error.

Runtime is PowerShell ~4, host is Linux. I have not tried on other runtimes.

"PSVersion": {
"Major": 7,
"Minor": 2,
"Patch": 13,
"PreReleaseLabel": null,
"BuildLabel": null
},

Autocompletion for `-Resource` with different well-known URLs or IDs

Is it reasonable and doable?

Add support for WorkloadIdentity auth

Implement Workload Identity Federation authentication - something like https://github.com/MicrosoftDocs/microsoft-authentication-library-dotnet/blob/main/msal-dotnet-articles/acquiring-tokens/web-apps-apis/workload-identity-federation.md

This issue is not aiming to solve a single use case such as the Azure.Identity implementation which only supports Kubernetes: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.workloadidentitycredential?view=azure-dotnet

Implement Sampler for more consistent workflow between modules

Implement Sampler for more consistent workflow between modules with builds and other tooling.

Evaluate possibility to expose credential precedence to user with parameter

ValidateSet of different credential types, allow user to specify precedence of token sources.

Add support for ClientCertificate auth

An error when I run Get-AzToken for the first time after installation

After installing the module, I ran Get-AzToken for the first time and got an error.
I'm already authenticated to Azure in that PowerShell session.

Get-AzToken: The ChainedTokenCredential failed due to an unhandled exception: Azure PowerShell authentication timed out.

Evaluate possibility to add default parameter set and parameters position

Should we be able to run Get-AzAuth 'https://management.azure.com'?

Add support for DeviceCode auth

Improve documentation with more examples

Examples of more use cases would be good, for example when working with multiple resources in the same script or session. How to get multiple tokens with only one interactive auth etc.

Consider changing to PowerShellStandard.Library 5.1 to avoid conflicts with platforms like Azure Functions

#30 was resolved by downgrading the version, one way to solve this on a more permanent basis would be to change library to use PowerShellStandard.Library 5.1 and target netstandard2.0 instead of .NET6/7/8+ and System.Management.Automation.

Evaluate possibility to add custom token cache / store

https://learn.microsoft.com/en-gb/azure/active-directory/develop/msal-net-token-cache-serialization?tabs=desktop

Improve parameters for scopes without resource

Scopes such as offline_access or openid for refresh / id tokens don't seem possible to use right now.

Add timeout or browser verification when using -interactive

When running Get-AzToken with the -Interactive switch, if no login is performed and the browser window is closed, the command seems to hang.

Steps to reproduce

Make sure no active sessions are available
Run

Get-AzToken -Interactive 

Close the opened browser window without logging in.

Expected behaviour

If possible, I would prefer the command to either simply stop, or return an error (no account logged on or similar, something we can catch in a catch block)
If not, at least a timeout of n+1 seconds before throwing an error to prevent pipelines from hanging.

platyPS generates markdown documentation for parameter new common parameter `-ProgressAction` in PowerShell 7.4

Implement workaround from PowerShell/platyPS#595.

Add support for ClientSecret auth

(but prefer cert-based)