Azure/azure-cli

Add more non-interactive authentication modes

Open

#7,594 建立於 2018年10月17日

在 GitHub 查看
 (3 留言) (0 反應) (0 負責人)Python (3,786 star) (2,854 fork)batch import
Accountact-identity-squadfeature-requesthelp wanted

描述

Is your feature request related to a problem? Please describe. I am frustrated when trying to run Azure CLI from PowerShell silently.

az login currently supports these non-interactive authentication modes:

  • login with user credentials
  • login with SP credentials
  • login with SP certificate file (PEM only)
  • login with system managed identity
  • login with user assigned managed identity

I would like to see some more that are mostly applicable to Windows environments.

Describe the solution you'd like

  • login with SP certificate coming from a certificate store (Windows only)
  • login with an existing access token obtained for the appropriate audience, such as piping Azure PowerShell access token into Azure CLI.
  • single sign-on with Windows identity from a domain environment connected to an AAD tenant with ADFS

I don't want to provide any credentials (user credentials or SP ID / Key) via CLI to login silently, because it's the least secure option. However, it's fine if I can't use single sign on if I am stopped by MFA.

Describe alternatives you've considered We are now trialing login with user assigned managed identity case with preview managed identities.

Additional context I am trying to call az acr build and az acr repository commands from PowerShell, because Azure PowerShell set of ACR commands is lacking.

貢獻者指南

技術棧
python
領域
authenticationclicloud
議題類型
feature
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
4
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
over 1 week
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
stale
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
needs investigation
前置要求
Azure CLI codebaseAzure AD authenticationCertificate store integration
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
25
研究方向
Explore the Azure CLI authentication implementation in the 'azure cli core' package, specifically files like 'auth.py' and 'custom.py' in the profile module. Review the existing non interactive authentication modes to understand the architecture. Investigate the Azure SDK for Python documentation on certificate authentication and token based authentication. Check the thread for any maintainer responses or additional feature requests.