Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Identity] Support Azure Arc user-assigned managed identity (UAMI) via MSAL

Abierto
  • ¿Algo no está bien?
#48,708 0 comentarios 1 reacción 2 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@kashifkhan ya está trabajando en esto.

Desde el 24/8/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

Azure.Identity feature-request

Background

MSAL Python now supports acquiring tokens for user-assigned managed identities (UAMI) on Azure Arc (MSAL Python 1.38.0). Historically Azure Arc only supported system-assigned managed identity (SAMI). This issue tracks enabling Arc UAMI in azure-identity (ManagedIdentityCredential and DefaultAzureCredential), for both sync and async.

azure-identity has two independent managed-identity stacks for Arc, and they need different work:

Current behavior

  • Sync (MSAL) AzureArcCredential (azure/identity/_credentials/azure_arc.py) extends MsalManagedIdentityClient and delegates to msal.ManagedIdentityClient (acquire_token_for_client, msal.UserAssignedManagedIdentity / SystemAssignedManagedIdentity). UAMI-on-Arc is gated by MSAL, so a msal version bump is sufficient here.
  • Async (native, no MSAL) AzureArcCredential (azure/identity/aio/_credentials/azure_arc.py) extends AsyncManagedIdentityBase and drives the custom AsyncManagedIdentityClient (aio/_internal/managed_identity_client.py, built on build_async_pipeline) plus ArcChallengeAuthPolicy. MSAL Python is sync-only, so the async path cannot delegate to MSAL and will NOT inherit Arc UAMI from the dependency bump — it needs its own code change.
  • Explicit block: _get_request in _credentials/azure_arc.py (imported and used by the async credential) raises ClientAuthenticationError("User assigned managed identities are not supported by Azure Arc...") whenever identity_config is set. ManagedIdentityClientBase.__init__ folds client_id into self._identity_config, so this trips for client id, object id, and resource id. This block is effectively async-only now (the sync credential goes through MSAL and no longer calls _get_request).

Net effect: sync needs only a dependency uptake; async (native) needs the explicit block removed, the id sent as the correct query parameter, and behavior aligned with the MSAL/sync path.

Scope of work

Sync (MSAL)
  • Bump msal dependency to >= 1.38.0.
  • Verify Arc UAMI token acquisition (client id, and resource/object id as supported).
Async (native, no MSAL)
  • Remove the explicit UAMI-on-Arc block in _get_request (_credentials/azure_arc.py).
  • Send the user-assigned id as the correct Arc query parameter — map the resource_id key to the Arc param name (mi_res_id/msi_res_id); client_id/object_id names are already correct. Confirm the api-version (currently 2020-06-01) honors UAMI and matches what MSAL sends on the sync side.
  • (Alternative) Consider delegating the async path to MSAL via run_in_executor for behavioral parity with sync, instead of maintaining the native implementation (larger change; adds thread-pool overhead).
  • Update async tests (e.g. test_azure_arc* / aio variants) that currently assert Arc UAMI is rejected.
Shared
  • Keep sync (MSAL) and async (native) consistent on query-param names, api-version, and endpoint handling.
  • Update CHANGELOG (and README if it documents Arc as system-assigned-only).

Key references

  • sdk/identity/azure-identity/azure/identity/_credentials/azure_arc.py
  • sdk/identity/azure-identity/azure/identity/aio/_credentials/azure_arc.py
  • sdk/identity/azure-identity/azure/identity/aio/_internal/managed_identity_client.py
  • sdk/identity/azure-identity/azure/identity/_internal/managed_identity_client.py
  • sdk/identity/azure-identity/azure/identity/_internal/msal_managed_identity_client.py
Lenguaje dominante
Python
Estrellas
5.6k
Forks
3.4k
Merge medio
1 d 18 h
PR fusionados (30 d)
202

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de Azure/azure-sdk-for-python

Todos los issues de Azure/azure-sdk-for-python

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.