feat: add integrated windows authentication support under public clients #652

shajia-deshaw · 2024-01-22T09:44:56Z

Overview

Adds support for Integrated Windows Authentication similar to the Java/.NET clients/

Fixes: #31

rayluo · 2024-01-22T10:32:54Z

Thanks, @shajia-deshaw . Is there any way to test this? Can they be written into test cases?
Anyway, I'll leave this to @ashok672 for reviewing.

shajia-deshaw · 2024-01-22T10:47:43Z

Sure @rayluo - I can add the test cases shortly (I had this tested with a driver script internally)

from msal import PublicClientApplication
app = PublicClientApplication(
    "<client_id>",
    authority="https://login.microsoftonline.com/<tenant_id>")
token = app.acquire_token_integrated_windows_auth("<upn>")
print(token)

shajia-deshaw · 2024-01-22T10:50:46Z

msal/application.py

@@ -172,6 +172,7 @@ class ClientApplication(object):
    ACQUIRE_TOKEN_FOR_CLIENT_ID = "730"
    ACQUIRE_TOKEN_BY_AUTHORIZATION_CODE_ID = "832"
    ACQUIRE_TOKEN_INTERACTIVE = "169"
+    ACQUIRE_TOKEN_INTEGRATED_WINDOWS_AUTH_ID = "870"


I'm not sure how this number is mapped. I just added a random number for IWA btw.

shajia-deshaw · 2024-01-24T19:33:10Z

msal/token_cache.py

@@ -243,7 +243,7 @@ def __add(self, event, now=None):
                    at["refresh_on"] = str(now + refresh_in)  # Schema wants a string
                self.modify(self.CredentialType.ACCESS_TOKEN, at, at)

-            if client_info and not event.get("skip_account_creation"):
+            if (client_info or iwa) and not event.get("skip_account_creation"):


The access token returned by IWA did not meet the criteria to be added as an ACCOUNT credential type in the TokenCache i.e. it didn't have client_info in the response. It was being added as a ACCESS_TOKEN credential type. The cache test in the e2e tests were failing because of it since the get_accounts() call didn't return anything and it assumed there was nothing being added to the cache. Hence, I added a special case of iwa to be added to the ACCOUNT credential type.

The other alternative is to add a method for get_access_tokens similar to get_accounts and use it to decide if we need to acquire new tokens silently for the items in cache.

shajia-deshaw · 2024-02-08T06:00:03Z

Hello folks, just an update - I'm working with my employer to sign the CLA soon.

shajia-deshaw · 2024-02-21T14:08:30Z

@microsoft-github-policy-service agree company="D. E. Shaw & Co., L.P."

shajia-deshaw · 2024-03-06T05:25:58Z

Hello @ashok672 - Checking if you had a chance to review the PR? Thanks.

velulev · 2024-03-13T15:11:46Z

Hello @ashok672 - Checking if you had a chance to review the PR? Thanks.

Hi @ashok672 , please let us know if there is anything else we can help on this with. Thanks.

aschafs · 2024-10-21T03:02:21Z

I just wanted to check if this PR was going to be reviewed and merged. We're very interested in getting IWA support in the msal python library. Thanks!

bgavrilMS · 2024-10-21T10:57:13Z

I don't think so, we are discussing to deprecate Integrated Windows Auth from all MSALs in favor of WAM (broker use). Integrated Windows Auth relies on SAML and HTTP level contracts which are easily broken by network changes, and this causes a lot of churn and support issues. WAM uses a different protocol (PRT) which is not affected.

@iulico-1 @localden - can you provide a perspective as scenario owners?

rayluo · 2024-10-21T16:44:21Z

I don't think so, we are discussing to deprecate Integrated Windows Auth from all MSALs in favor of WAM (broker use). Integrated Windows Auth relies on SAML and HTTP level contracts which are easily broken by network changes, and this causes a lot of churn and support issues. WAM uses a different protocol (PRT) which is not affected.

@iulico-1 @localden - can you provide a perspective as scenario owners?

For the sake of completeness, we had a similar conversation in the feature request issue with the contributor, who mentioned that IWA also works on Linux and that was part of the reason that they worked out this PR. That is a scenario that not currently satisfied by broker.

shajia-deshaw · 2024-10-21T17:07:10Z

I don't think so, we are discussing to deprecate Integrated Windows Auth from all MSALs in favor of WAM (broker use). Integrated Windows Auth relies on SAML and HTTP level contracts which are easily broken by network changes, and this causes a lot of churn and support issues. WAM uses a different protocol (PRT) which is not affected.
@iulico-1 @localden - can you provide a perspective as scenario owners?

For the sake of completeness, we had a similar conversation in the feature request issue with the contributor, who mentioned that IWA also works on Linux and that was part of the reason that they worked out this PR. That is a scenario that not currently satisfied by broker.

Thanks @rayluo for adding context!

FTR, we've been using the patched version of MSAL with Kerberos / IWA flow for months in our internal linux services and applications -- Things have been working just fine.

However, we believe this could be a general enhancement in the upstream MSAL library, benefiting similar users, as evident from the comments on the issue/PR.

localden · 2024-10-21T23:49:19Z

Adding my perspective here - on Windows and macOS, we are indeed shifting to authentication brokers; however, that leaves Linux scenarios in the open and we will need to continue falling back on the vanilla API. I am not inherently opposed to having a native IWA implementation in MSAL Python, but we'd need to coordinate how it falls back to broker and when.

@ashok672 @iulico-1 - something for us to discuss.

iulico-1 · 2024-10-22T18:55:03Z

tests/test_e2e.py

+            azure_region=azure_region, client_credential=client_secret)
+        self.assertEqual(
+            self.app.get_accounts(username=username), [], "Cache starts empty")
+        result = self.app.acquire_token_integrated_windows_auth(


acquire_token_integrated_windows_auth

I am not convinced we need to introduce Windows integrated Auth flow as a separate API.

Windows Integrated Auth is conceptually the same as functionality as default account that brokers (WAM) expose.

Can we follow the same pattern we did with OS account on .net ?

@iulico-1 - how is this going to work on Linux, where there is no WAM? We can't expect every customer to enroll their device either.

On linux there is no WIA also :) this api will just fail with UIRequired on linux without broker integration.

On linux there is no WIA also :) this api will just fail with UIRequired on linux without broker integration.

But the customer claimed otherwise.

feat: add integrated windows authentication support under public clients

5b42f87

shajia-deshaw mentioned this pull request Jan 22, 2024

Feature Request - IWA pass through capabilities - align with .net #31

Open

rayluo requested a review from ashok672 January 22, 2024 10:30

shajia-deshaw commented Jan 22, 2024

View reviewed changes

shajia-deshaw added 3 commits January 24, 2024 21:56

chore(docs): add iwa sample script under samples/

0fdd09f

chore(deps): add requests-kerberos deps to requirements.txt

f69ddd0

test: add e2e tests for iwa flow

6ead687

shajia-deshaw commented Jan 24, 2024

View reviewed changes

iulico-1 reviewed Oct 22, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add integrated windows authentication support under public clients #652

feat: add integrated windows authentication support under public clients #652

shajia-deshaw commented Jan 22, 2024 •

edited

Loading

rayluo commented Jan 22, 2024

shajia-deshaw commented Jan 22, 2024 •

edited

Loading

shajia-deshaw Jan 22, 2024

shajia-deshaw Jan 24, 2024 •

edited

Loading

shajia-deshaw commented Feb 8, 2024

shajia-deshaw commented Feb 21, 2024

shajia-deshaw commented Mar 6, 2024

velulev commented Mar 13, 2024

aschafs commented Oct 21, 2024

bgavrilMS commented Oct 21, 2024 •

edited

Loading

rayluo commented Oct 21, 2024

shajia-deshaw commented Oct 21, 2024

localden commented Oct 21, 2024

iulico-1 Oct 22, 2024

localden Oct 22, 2024

alextok Oct 23, 2024

rayluo Oct 23, 2024

feat: add integrated windows authentication support under public clients #652

Are you sure you want to change the base?

feat: add integrated windows authentication support under public clients #652

Conversation

shajia-deshaw commented Jan 22, 2024 • edited Loading

Overview

rayluo commented Jan 22, 2024

shajia-deshaw commented Jan 22, 2024 • edited Loading

shajia-deshaw Jan 22, 2024

Choose a reason for hiding this comment

shajia-deshaw Jan 24, 2024 • edited Loading

Choose a reason for hiding this comment

shajia-deshaw commented Feb 8, 2024

shajia-deshaw commented Feb 21, 2024

shajia-deshaw commented Mar 6, 2024

velulev commented Mar 13, 2024

aschafs commented Oct 21, 2024

bgavrilMS commented Oct 21, 2024 • edited Loading

rayluo commented Oct 21, 2024

shajia-deshaw commented Oct 21, 2024

localden commented Oct 21, 2024

iulico-1 Oct 22, 2024

Choose a reason for hiding this comment

localden Oct 22, 2024

Choose a reason for hiding this comment

alextok Oct 23, 2024

Choose a reason for hiding this comment

rayluo Oct 23, 2024

Choose a reason for hiding this comment

shajia-deshaw commented Jan 22, 2024 •

edited

Loading

shajia-deshaw commented Jan 22, 2024 •

edited

Loading

shajia-deshaw Jan 24, 2024 •

edited

Loading

bgavrilMS commented Oct 21, 2024 •

edited

Loading