Implementing WAM broker authentication

[tabs-not-spaces]

Pull Request

Pull Request (PR) description

WAM Broker auth is cool. This PR should implement it correctly...
More details on PR to come, for now - beer awaits.

Task list

• The PR represents a single logical change. i.e. Cosmetic updates should go in different PRs.
• Added an entry under the Unreleased section of in the CHANGELOG.md as per format.
• Local clean build passes without issue or failed tests.
• Markdown help added/updated.
• Unit tests added/updated.

[github-actions]

Test Results

130 tests   122 ✅  0s ⏱️
 12 suites    0 💤
  1 files      8 ❌

For more details on these failures, see this check.

Results for commit 69b2bee.

♻️ This comment has been updated with latest results.

[PalmEmanuel]

Your PR from a fork uncovered a bug in my testing workflow, which is now fixed (thanks! 👍). Let me know if you have any questions about the tests or such, most of them just check that proper docs and parameter tests are in place.

There's also an approval step to run the code, since the last part of the workflow actually connects to a real identity in my tenant and gets a token as an integration test.

[tabs-not-spaces]

Your PR from a fork uncovered a bug in my testing workflow, which is now fixed (thanks! 👍). Let me know if you have any questions about the tests or such, most of them just check that proper docs and parameter tests are in place.

There's also an approval step to run the code, since the last part of the workflow actually connects to a real identity in my tenant and gets a token as an integration test.

Oh if you have integration tests for WAM / broker auth, you'll need to add the redirect uri for it. ms-appx-web://microsoft.aad.brokerplugin/{clientId}

[PalmEmanuel]

Only got integration tests for the workload identity federation from this repo atm, so that's fine right now.

[PalmEmanuel]

This closes #76 when merged

[PalmEmanuel]

Looking forward to the silent auth with -Broker 👌

FYI I have some basic logic to save credentials in the session, so there's already some "silent auth" built-in if you run an interactive flow such as Get-AzToken -Interactive, Get-AzToken -Broker or Get-AzToken -DeviceCode once, then you can keep running Get-AzToken. I might revisit this logic eventually to make it more intuitive, but it works by storing the credential object in the session (including authentication record with the refresh token).

https://github.com/PalmEmanuel/AzAuth/blob/main/source/AzAuth.Core/TokenManagerAuthMethods/TokenManager.NonInteractive.cs#L39