From 2d2853f06f848c9834e71b7b46e040b1c0dbf3a6 Mon Sep 17 00:00:00 2001 From: Alex Wolf Date: Wed, 20 Aug 2025 12:48:23 -0400 Subject: [PATCH 01/36] Extracted broker auth into new doc --- .../sdk/authentication/additional-methods.md | 66 ---------------- .../local-development-broker.md | 76 +++++++++++++++++++ docs/azure/toc.yml | 2 + 3 files changed, 78 insertions(+), 66 deletions(-) create mode 100644 docs/azure/sdk/authentication/local-development-broker.md diff --git a/docs/azure/sdk/authentication/additional-methods.md b/docs/azure/sdk/authentication/additional-methods.md index c78cad2496bbc..c7bb939df2f9b 100644 --- a/docs/azure/sdk/authentication/additional-methods.md +++ b/docs/azure/sdk/authentication/additional-methods.md @@ -37,72 +37,6 @@ The following example demonstrates using an [`InteractiveBrowserCredential`](/do For more exact control, such as setting redirect URIs, you can supply specific arguments to `InteractiveBrowserCredential` such as `redirect_uri`. -## Interactive brokered authentication - -This method interactively authenticates an application through by collecting user credentials using the system authentication broker. A system authentication broker is an app running on a user's machine that manages the authentication handshakes and token maintenance for all connected accounts. Currently, only the Windows authentication broker, Web Account Manager (WAM), is supported. Users on macOS and Linux will be authenticated through the non-brokered interactive browser flow. - -WAM enables identity providers such as Microsoft Entra ID to natively plug into the OS and provide the service to other apps to provide a more secure login process. WAM offers the following benefits: - -- **Feature support**: Apps can access OS-level and service-level capabilities, including Windows Hello, conditional access policies, and FIDO keys. -- **Streamlined single sign-on**: Apps can use the built-in account picker, allowing the user to select an existing account instead of repeatedly entering the same credentials. -- **Enhanced security**: Bug fixes and enhancements ship with Windows. -- **Token protection**: Refresh tokens are device-bound, and apps can acquire device-bound access tokens. - -Interactive brokered authentication enables the application for all operations allowed by the interactive login credentials. Personal Microsoft accounts and work or school accounts are supported. If a supported version of Windows is used, the default browser-based UI is replaced with a smoother authentication experience, similar to Windows built-in apps. - -### Enable applications for interactive brokered authentication - -Perform the following steps to enable the application to authenticate through the interactive broker flow. - -1. On the [Azure portal](https://portal.azure.com), navigate to **Microsoft Entra ID** and select **App registrations** on the left-hand menu. -1. Select the registration for your app, then select **Authentication**. -1. Add the WAM redirect URI to your app registration via a platform configuration: - 1. Under **Platform configurations**, select **+ Add a platform**. - 1. Under **Configure platforms**, select the tile for your application type (platform) to configure its settings, such as **mobile and desktop applications**. - 1. In **Custom redirect URIs**, enter the following WAM redirect URI: - - ```text - ms-appx-web://microsoft.aad.brokerplugin/{client_id} - ``` - - The `{client_id}` placeholder must be replaced with the **Application (client) ID** listed on the **Overview** pane of the app registration. - - 1. Select **Configure**. - - To learn more, see [Add a redirect URI to an app registration](/entra/identity-platform/quickstart-register-app#add-a-redirect-uri). - -1. Back on the **Authentication** pane, under **Advanced settings**, select **Yes** for **Allow public client flows**. -1. Select **Save** to apply the changes. -1. To authorize the application for specific resources, navigate to the resource in question, select **API Permissions**, and enable **Microsoft Graph** and other resources you want to access. Microsoft Graph is usually enabled by default. - - > [!IMPORTANT] - > You must also be the admin of your tenant to grant consent to your application when you sign in for the first time. - -### Example using InteractiveBrowserCredential - -The following example demonstrates using an in a Windows Forms app to authenticate with the [`BlobServiceClient`](/dotnet/api/azure.storage.blobs.blobserviceclient): - -:::code language="csharp" source="../snippets/authentication/additional-auth/interactive/InteractiveBrokeredAuth.cs" highlight="16-20"::: - -> [!NOTE] -> Visit the [Parent window handles](/entra/msal/dotnet/acquiring-tokens/desktop-mobile/wam#parent-window-handles) and [Retrieve a window handle](/windows/apps/develop/ui-input/retrieve-hwnd) articles for more information about retrieving window handles. - -For the code to run successfully, your user account must be assigned an Azure role on the storage account that allows access to blob containers such as **Storage Account Data Contributor**. If an app is specified, it must have API permissions set for **user_impersonation Access Azure Storage** (step 6 in the previous section). This API permission allows the app to access Azure storage on behalf of the signed-in user after consent is granted during sign-in. - -The following screenshot shows the user sign-in experience: - -:::image type="content" source="../media/web-account-manager-sign-in-account-picker.png" alt-text="A screenshot that shows the sign-in experience when using the interactive browser broker credential to authenticate a user." ::: - -### Authenticate the default system account via WAM - -Many people always sign in to Windows with the same user account and, therefore, only ever want to authenticate using that account. WAM and `InteractiveBrowserCredential` also support a silent login process that automatically uses a default account so the user doesn't have to repeatedly select it. - -The following example shows how to enable sign-in with the default system account: - -:::code language="csharp" source="../snippets/authentication/additional-auth/interactive/SilentBrokeredAuth.cs" highlight="16-24"::: - -Once you opt in to this behavior, the credential attempts to sign in by asking the underlying Microsoft Authentication Library (MSAL) to perform the sign-in for the default system account. If the sign-in fails, the credential falls back to displaying the account picker dialog, from which the user can select the appropriate account. - ## Device code authentication This method interactively authenticates a user on devices with limited UI (typically devices without a keyboard): diff --git a/docs/azure/sdk/authentication/local-development-broker.md b/docs/azure/sdk/authentication/local-development-broker.md new file mode 100644 index 0000000000000..7fd29507dc495 --- /dev/null +++ b/docs/azure/sdk/authentication/local-development-broker.md @@ -0,0 +1,76 @@ +--- +title: Authenticate .NET apps to Azure using developer accounts +description: Learn how to authenticate your application to Azure services when using the Azure SDK for .NET during local development using developer accounts. +ms.topic: how-to +ms.custom: devx-track-dotnet, engagement-fy23, devx-track-azurecli +ms.date: 03/14/2025 +--- + +# Authenticate .NET apps to Azure services during local development using interactive brokered authentication + +Interactive brokered authentication collects user credentials using the system authentication broker to authenticate an application with . A system authentication broker is an app running on a user's machine that manages the authentication handshakes and token maintenance for all connected accounts. + +> [!NOTE] +> Currently, only the Windows authentication broker, Web Account Manager (WAM), is supported. Users on macOS and Linux will be authenticated through the non-brokered interactive browser flow. + +WAM enables identity providers such as Microsoft Entra ID to natively plug into the OS and provide the service to other apps to provide a more secure login process. WAM offers the following benefits: + +- **Feature support**: Apps can access OS-level and service-level capabilities, including Windows Hello, conditional access policies, and FIDO keys. +- **Streamlined single sign-on**: Apps can use the built-in account picker, allowing the user to select an existing account instead of repeatedly entering the same credentials. +- **Enhanced security**: Bug fixes and enhancements ship with Windows. +- **Token protection**: Refresh tokens are device-bound, and apps can acquire device-bound access tokens. + +Interactive brokered authentication enables the application for all operations allowed by the interactive login credentials. Personal Microsoft accounts and work or school accounts are supported. If a supported version of Windows is used, the default browser-based UI is replaced with a smoother authentication experience, similar to Windows built-in apps. + +### Enable applications for interactive brokered authentication + +Perform the following steps to enable the application to authenticate through the interactive broker flow. + +1. On the [Azure portal](https://portal.azure.com), navigate to **Microsoft Entra ID** and select **App registrations** on the left-hand menu. +1. Select the registration for your app, then select **Authentication**. +1. Add the WAM redirect URI to your app registration via a platform configuration: + 1. Under **Platform configurations**, select **+ Add a platform**. + 1. Under **Configure platforms**, select the tile for your application type (platform) to configure its settings, such as **mobile and desktop applications**. + 1. In **Custom redirect URIs**, enter the following WAM redirect URI: + + ```text + ms-appx-web://microsoft.aad.brokerplugin/{client_id} + ``` + + The `{client_id}` placeholder must be replaced with the **Application (client) ID** listed on the **Overview** pane of the app registration. + + 1. Select **Configure**. + + To learn more, see [Add a redirect URI to an app registration](/entra/identity-platform/quickstart-register-app#add-a-redirect-uri). + +1. Back on the **Authentication** pane, under **Advanced settings**, select **Yes** for **Allow public client flows**. +1. Select **Save** to apply the changes. +1. To authorize the application for specific resources, navigate to the resource in question, select **API Permissions**, and enable **Microsoft Graph** and other resources you want to access. Microsoft Graph is usually enabled by default. + + > [!IMPORTANT] + > You must also be the admin of your tenant to grant consent to your application when you sign in for the first time. + +### Example using InteractiveBrowserCredential + +The following example demonstrates using an in a Windows Forms app to authenticate with the [`BlobServiceClient`](/dotnet/api/azure.storage.blobs.blobserviceclient): + +:::code language="csharp" source="../snippets/authentication/additional-auth/interactive/InteractiveBrokeredAuth.cs" highlight="16-20"::: + +> [!NOTE] +> Visit the [Parent window handles](/entra/msal/dotnet/acquiring-tokens/desktop-mobile/wam#parent-window-handles) and [Retrieve a window handle](/windows/apps/develop/ui-input/retrieve-hwnd) articles for more information about retrieving window handles. + +For the code to run successfully, your user account must be assigned an Azure role on the storage account that allows access to blob containers such as **Storage Account Data Contributor**. If an app is specified, it must have API permissions set for **user_impersonation Access Azure Storage** (step 6 in the previous section). This API permission allows the app to access Azure storage on behalf of the signed-in user after consent is granted during sign-in. + +The following screenshot shows the user sign-in experience: + +:::image type="content" source="../media/web-account-manager-sign-in-account-picker.png" alt-text="A screenshot that shows the sign-in experience when using the interactive browser broker credential to authenticate a user." ::: + +### Authenticate the default system account via WAM + +Many people always sign in to Windows with the same user account and, therefore, only ever want to authenticate using that account. WAM and `InteractiveBrowserCredential` also support a silent login process that automatically uses a default account so the user doesn't have to repeatedly select it. + +The following example shows how to enable sign-in with the default system account: + +:::code language="csharp" source="../snippets/authentication/additional-auth/interactive/SilentBrokeredAuth.cs" highlight="16-24"::: + +Once you opt in to this behavior, the credential attempts to sign in by asking the underlying Microsoft Authentication Library (MSAL) to perform the sign-in for the default system account. If the sign-in fails, the credential falls back to displaying the account picker dialog, from which the user can select the appropriate account. diff --git a/docs/azure/toc.yml b/docs/azure/toc.yml index 876c05306f850..3690ba6215d1d 100644 --- a/docs/azure/toc.yml +++ b/docs/azure/toc.yml @@ -78,6 +78,8 @@ items: href: ./sdk/authentication/local-development-dev-accounts.md - name: Use a service principal href: ./sdk/authentication/local-development-service-principal.md + - name: Use a broker + href: ./sdk/authentication/local-development-service-principal.md - name: Auth from Azure-hosted apps items: - name: Use a system-assigned managed identity From 162869aaab7c4a50b8f580b5569145c31db9bee7 Mon Sep 17 00:00:00 2001 From: Alex Wolf Date: Wed, 20 Aug 2025 13:06:30 -0400 Subject: [PATCH 02/36] fix metadata --- docs/azure/sdk/authentication/local-development-broker.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/azure/sdk/authentication/local-development-broker.md b/docs/azure/sdk/authentication/local-development-broker.md index 7fd29507dc495..e424cdef3de3e 100644 --- a/docs/azure/sdk/authentication/local-development-broker.md +++ b/docs/azure/sdk/authentication/local-development-broker.md @@ -1,9 +1,9 @@ --- -title: Authenticate .NET apps to Azure using developer accounts -description: Learn how to authenticate your application to Azure services when using the Azure SDK for .NET during local development using developer accounts. +title: Authenticate .NET apps to Azure using interactive brokered authentication. +description: Learn how to authenticate your application to Azure services when using the Azure SDK for .NET during local development using interactive brokered authentication. ms.topic: how-to ms.custom: devx-track-dotnet, engagement-fy23, devx-track-azurecli -ms.date: 03/14/2025 +ms.date: 08/20/2025 --- # Authenticate .NET apps to Azure services during local development using interactive brokered authentication From 835f844ca1fb1225f7c9af8f35542c44fa3507ff Mon Sep 17 00:00:00 2001 From: Alex Wolf Date: Wed, 20 Aug 2025 13:38:14 -0400 Subject: [PATCH 03/36] fix toc --- docs/azure/toc.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/azure/toc.yml b/docs/azure/toc.yml index 3690ba6215d1d..7e49ccf037b5f 100644 --- a/docs/azure/toc.yml +++ b/docs/azure/toc.yml @@ -79,7 +79,7 @@ items: - name: Use a service principal href: ./sdk/authentication/local-development-service-principal.md - name: Use a broker - href: ./sdk/authentication/local-development-service-principal.md + href: ./sdk/authentication/local-development-broker.md - name: Auth from Azure-hosted apps items: - name: Use a system-assigned managed identity From 5d910e0ca6cd96f2bc847395bf60380efec40218 Mon Sep 17 00:00:00 2001 From: alexwolfmsft <93200798+alexwolfmsft@users.noreply.github.com> Date: Wed, 20 Aug 2025 15:28:00 -0400 Subject: [PATCH 04/36] Apply suggestions from code review Co-authored-by: Genevieve Warren <24882762+gewarren@users.noreply.github.com> --- docs/azure/sdk/authentication/local-development-broker.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/azure/sdk/authentication/local-development-broker.md b/docs/azure/sdk/authentication/local-development-broker.md index e424cdef3de3e..f036c9592a997 100644 --- a/docs/azure/sdk/authentication/local-development-broker.md +++ b/docs/azure/sdk/authentication/local-development-broker.md @@ -57,9 +57,9 @@ The following example demonstrates using an [!NOTE] -> Visit the [Parent window handles](/entra/msal/dotnet/acquiring-tokens/desktop-mobile/wam#parent-window-handles) and [Retrieve a window handle](/windows/apps/develop/ui-input/retrieve-hwnd) articles for more information about retrieving window handles. +> For more information about retrieving window handles, see [Parent window handles](/entra/msal/dotnet/acquiring-tokens/desktop-mobile/wam#parent-window-handles) and [Retrieve a window handle](/windows/apps/develop/ui-input/retrieve-hwnd). -For the code to run successfully, your user account must be assigned an Azure role on the storage account that allows access to blob containers such as **Storage Account Data Contributor**. If an app is specified, it must have API permissions set for **user_impersonation Access Azure Storage** (step 6 in the previous section). This API permission allows the app to access Azure storage on behalf of the signed-in user after consent is granted during sign-in. +For the code to run successfully, your user account must be assigned an Azure role on the storage account that allows access to blob containers, such as **Storage Account Data Contributor**. If an app is specified, it must have API permissions set for **user_impersonation Access Azure Storage** (step 6 in the previous section). This API permission allows the app to access Azure storage on behalf of the signed-in user after consent is granted during sign-in. The following screenshot shows the user sign-in experience: From 8fc22b8774a03fec02ea524e02d47d34b50df2ab Mon Sep 17 00:00:00 2001 From: alexwolfmsft <93200798+alexwolfmsft@users.noreply.github.com> Date: Thu, 21 Aug 2025 11:38:07 -0400 Subject: [PATCH 05/36] Apply suggestions from code review Co-authored-by: Scott Addie <10702007+scottaddie@users.noreply.github.com> --- .../local-development-broker.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/docs/azure/sdk/authentication/local-development-broker.md b/docs/azure/sdk/authentication/local-development-broker.md index f036c9592a997..ff6bad7945332 100644 --- a/docs/azure/sdk/authentication/local-development-broker.md +++ b/docs/azure/sdk/authentication/local-development-broker.md @@ -1,17 +1,17 @@ --- -title: Authenticate .NET apps to Azure using interactive brokered authentication. -description: Learn how to authenticate your application to Azure services when using the Azure SDK for .NET during local development using interactive brokered authentication. +title: Authenticate .NET apps to Azure using brokered authentication. +description: Learn how to authenticate your app to Azure services when using the Azure SDK for .NET during local development using brokered authentication. ms.topic: how-to ms.custom: devx-track-dotnet, engagement-fy23, devx-track-azurecli ms.date: 08/20/2025 --- -# Authenticate .NET apps to Azure services during local development using interactive brokered authentication +# Authenticate .NET apps to Azure services during local development using brokered authentication -Interactive brokered authentication collects user credentials using the system authentication broker to authenticate an application with . A system authentication broker is an app running on a user's machine that manages the authentication handshakes and token maintenance for all connected accounts. +Brokered authentication collects user credentials using the system authentication broker to authenticate an application with . A system authentication broker is an app running on a user's machine that manages the authentication handshakes and token maintenance for all connected accounts. > [!NOTE] -> Currently, only the Windows authentication broker, Web Account Manager (WAM), is supported. Users on macOS and Linux will be authenticated through the non-brokered interactive browser flow. +> Currently, only the Windows authentication broker, Web Account Manager (WAM), is supported. Users on macOS and Linux will be authenticated through the [non-brokered interactive browser flow](additional-methods.md#interactive-browser-authentication). WAM enables identity providers such as Microsoft Entra ID to natively plug into the OS and provide the service to other apps to provide a more secure login process. WAM offers the following benefits: @@ -20,11 +20,11 @@ WAM enables identity providers such as Microsoft Entra ID to natively plug into - **Enhanced security**: Bug fixes and enhancements ship with Windows. - **Token protection**: Refresh tokens are device-bound, and apps can acquire device-bound access tokens. -Interactive brokered authentication enables the application for all operations allowed by the interactive login credentials. Personal Microsoft accounts and work or school accounts are supported. If a supported version of Windows is used, the default browser-based UI is replaced with a smoother authentication experience, similar to Windows built-in apps. +Brokered authentication enables the application for all operations allowed by the interactive login credentials. Personal Microsoft accounts and work or school accounts are supported. If a supported version of Windows is used, the default browser-based UI is replaced with a smoother authentication experience, similar to Windows built-in apps. -### Enable applications for interactive brokered authentication +## Configure the app for brokered authentication -Perform the following steps to enable the application to authenticate through the interactive broker flow. +Complete the following steps to enable the application to authenticate through the broker flow: 1. On the [Azure portal](https://portal.azure.com), navigate to **Microsoft Entra ID** and select **App registrations** on the left-hand menu. 1. Select the registration for your app, then select **Authentication**. @@ -34,7 +34,7 @@ Perform the following steps to enable the application to authenticate through th 1. In **Custom redirect URIs**, enter the following WAM redirect URI: ```text - ms-appx-web://microsoft.aad.brokerplugin/{client_id} + ms-appx-web://Microsoft.AAD.BrokerPlugin/{client_id} ``` The `{client_id}` placeholder must be replaced with the **Application (client) ID** listed on the **Overview** pane of the app registration. @@ -50,9 +50,9 @@ Perform the following steps to enable the application to authenticate through th > [!IMPORTANT] > You must also be the admin of your tenant to grant consent to your application when you sign in for the first time. -### Example using InteractiveBrowserCredential +## Example using InteractiveBrowserCredential -The following example demonstrates using an in a Windows Forms app to authenticate with the [`BlobServiceClient`](/dotnet/api/azure.storage.blobs.blobserviceclient): +The following example demonstrates using in a Windows Forms app to authenticate with the [`BlobServiceClient`](/dotnet/api/azure.storage.blobs.blobserviceclient): :::code language="csharp" source="../snippets/authentication/additional-auth/interactive/InteractiveBrokeredAuth.cs" highlight="16-20"::: @@ -65,7 +65,7 @@ The following screenshot shows the user sign-in experience: :::image type="content" source="../media/web-account-manager-sign-in-account-picker.png" alt-text="A screenshot that shows the sign-in experience when using the interactive browser broker credential to authenticate a user." ::: -### Authenticate the default system account via WAM +## Authenticate the default system account via WAM Many people always sign in to Windows with the same user account and, therefore, only ever want to authenticate using that account. WAM and `InteractiveBrowserCredential` also support a silent login process that automatically uses a default account so the user doesn't have to repeatedly select it. From df06fe43656c7d5a3baf0465108f9b920afe04c6 Mon Sep 17 00:00:00 2001 From: alexwolfmsft <93200798+alexwolfmsft@users.noreply.github.com> Date: Thu, 21 Aug 2025 15:05:10 -0400 Subject: [PATCH 06/36] Apply suggestions from code review Co-authored-by: Scott Addie <10702007+scottaddie@users.noreply.github.com> --- .../authentication/local-development-broker.md | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/docs/azure/sdk/authentication/local-development-broker.md b/docs/azure/sdk/authentication/local-development-broker.md index ff6bad7945332..22bd1c6dc8f91 100644 --- a/docs/azure/sdk/authentication/local-development-broker.md +++ b/docs/azure/sdk/authentication/local-development-broker.md @@ -50,22 +50,28 @@ Complete the following steps to enable the application to authenticate through t > [!IMPORTANT] > You must also be the admin of your tenant to grant consent to your application when you sign in for the first time. -## Example using InteractiveBrowserCredential +## Implement the code -The following example demonstrates using in a Windows Forms app to authenticate with the [`BlobServiceClient`](/dotnet/api/azure.storage.blobs.blobserviceclient): +Complete the following steps in your .NET project: + +1. Install the [Azure.Identity](https://www.nuget.org/packages/Azure.Identity) and [Azure.Identity.Broker](https://www.nuget.org/packages/Azure.Identity.Broker) packages. +1. Get a reference to the parent window on top of which the account picker dialog should appear. +1. Create an instance of that accepts an instance of . + +Consider the following sample code from a Windows Forms app that passes the credential to an instance of [BlobServiceClient](/dotnet/api/azure.storage.blobs.blobserviceclient): :::code language="csharp" source="../snippets/authentication/additional-auth/interactive/InteractiveBrokeredAuth.cs" highlight="16-20"::: > [!NOTE] > For more information about retrieving window handles, see [Parent window handles](/entra/msal/dotnet/acquiring-tokens/desktop-mobile/wam#parent-window-handles) and [Retrieve a window handle](/windows/apps/develop/ui-input/retrieve-hwnd). -For the code to run successfully, your user account must be assigned an Azure role on the storage account that allows access to blob containers, such as **Storage Account Data Contributor**. If an app is specified, it must have API permissions set for **user_impersonation Access Azure Storage** (step 6 in the previous section). This API permission allows the app to access Azure storage on behalf of the signed-in user after consent is granted during sign-in. +For the code to run successfully, your user account must be assigned an Azure RBAC role on the storage account that allows access to blob containers, such as **Storage Account Data Contributor**. If an app is specified, it must have API permissions set for **user_impersonation Access Azure Storage** (step 6 in the previous section). This API permission allows the app to access Azure storage on behalf of the signed-in user after consent is granted during sign-in. The following screenshot shows the user sign-in experience: -:::image type="content" source="../media/web-account-manager-sign-in-account-picker.png" alt-text="A screenshot that shows the sign-in experience when using the interactive browser broker credential to authenticate a user." ::: +:::image type="content" source="../media/web-account-manager-sign-in-account-picker.png" alt-text="A screenshot that shows the sign-in experience when using a broker-enabled InteractiveBrowserCredential instance to authenticate a user." ::: -## Authenticate the default system account via WAM +### Authenticate the default system account via WAM Many people always sign in to Windows with the same user account and, therefore, only ever want to authenticate using that account. WAM and `InteractiveBrowserCredential` also support a silent login process that automatically uses a default account so the user doesn't have to repeatedly select it. From 04ba363b9f4a1eb6d30e983b568390192c8ce921 Mon Sep 17 00:00:00 2001 From: alexwolfmsft <93200798+alexwolfmsft@users.noreply.github.com> Date: Thu, 21 Aug 2025 15:39:54 -0400 Subject: [PATCH 07/36] Apply suggestions from code review Co-authored-by: Scott Addie <10702007+scottaddie@users.noreply.github.com> --- docs/azure/sdk/authentication/local-development-broker.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/azure/sdk/authentication/local-development-broker.md b/docs/azure/sdk/authentication/local-development-broker.md index 22bd1c6dc8f91..bc80d839af57c 100644 --- a/docs/azure/sdk/authentication/local-development-broker.md +++ b/docs/azure/sdk/authentication/local-development-broker.md @@ -26,7 +26,7 @@ Brokered authentication enables the application for all operations allowed by th Complete the following steps to enable the application to authenticate through the broker flow: -1. On the [Azure portal](https://portal.azure.com), navigate to **Microsoft Entra ID** and select **App registrations** on the left-hand menu. +1. In the [Azure portal](https://portal.azure.com), navigate to **Microsoft Entra ID** and select **App registrations** on the left-hand menu. 1. Select the registration for your app, then select **Authentication**. 1. Add the WAM redirect URI to your app registration via a platform configuration: 1. Under **Platform configurations**, select **+ Add a platform**. From fdc226fa51a2201359ffe776d98ecba23195d55d Mon Sep 17 00:00:00 2001 From: Alex Wolf Date: Mon, 25 Aug 2025 11:21:47 -0400 Subject: [PATCH 08/36] temp --- .../local-development-broker.md | 22 +++++++++++++++---- .../interactive/InteractiveBrokeredAuth.cs | 6 ++--- .../interactive/SilentBrokeredAuth.cs | 6 ++--- 3 files changed, 24 insertions(+), 10 deletions(-) diff --git a/docs/azure/sdk/authentication/local-development-broker.md b/docs/azure/sdk/authentication/local-development-broker.md index e424cdef3de3e..d60b4c6f6751b 100644 --- a/docs/azure/sdk/authentication/local-development-broker.md +++ b/docs/azure/sdk/authentication/local-development-broker.md @@ -4,15 +4,13 @@ description: Learn how to authenticate your application to Azure services when u ms.topic: how-to ms.custom: devx-track-dotnet, engagement-fy23, devx-track-azurecli ms.date: 08/20/2025 +zone_pivot_groups: operating-systems-set-one --- # Authenticate .NET apps to Azure services during local development using interactive brokered authentication Interactive brokered authentication collects user credentials using the system authentication broker to authenticate an application with . A system authentication broker is an app running on a user's machine that manages the authentication handshakes and token maintenance for all connected accounts. -> [!NOTE] -> Currently, only the Windows authentication broker, Web Account Manager (WAM), is supported. Users on macOS and Linux will be authenticated through the non-brokered interactive browser flow. - WAM enables identity providers such as Microsoft Entra ID to natively plug into the OS and provide the service to other apps to provide a more secure login process. WAM offers the following benefits: - **Feature support**: Apps can access OS-level and service-level capabilities, including Windows Hello, conditional access policies, and FIDO keys. @@ -52,7 +50,9 @@ Perform the following steps to enable the application to authenticate through th ### Example using InteractiveBrowserCredential -The following example demonstrates using an in a Windows Forms app to authenticate with the [`BlobServiceClient`](/dotnet/api/azure.storage.blobs.blobserviceclient): +The following example demonstrates using an in a MAUI app to authenticate with the [`BlobServiceClient`](/dotnet/api/azure.storage.blobs.blobserviceclient): + +:::zone target="docs" pivot="windows" :::code language="csharp" source="../snippets/authentication/additional-auth/interactive/InteractiveBrokeredAuth.cs" highlight="16-20"::: @@ -65,6 +65,18 @@ The following screenshot shows the user sign-in experience: :::image type="content" source="../media/web-account-manager-sign-in-account-picker.png" alt-text="A screenshot that shows the sign-in experience when using the interactive browser broker credential to authenticate a user." ::: +:::zone-end + +:::zone target="docs" pivot="linux" + +:::zone-end + +:::zone target="docs" pivot="macos" + +:::zone-end + +:::zone target="docs" pivot="windows" + ### Authenticate the default system account via WAM Many people always sign in to Windows with the same user account and, therefore, only ever want to authenticate using that account. WAM and `InteractiveBrowserCredential` also support a silent login process that automatically uses a default account so the user doesn't have to repeatedly select it. @@ -74,3 +86,5 @@ The following example shows how to enable sign-in with the default system accoun :::code language="csharp" source="../snippets/authentication/additional-auth/interactive/SilentBrokeredAuth.cs" highlight="16-24"::: Once you opt in to this behavior, the credential attempts to sign in by asking the underlying Microsoft Authentication Library (MSAL) to perform the sign-in for the default system account. If the sign-in fails, the credential falls back to displaying the account picker dialog, from which the user can select the appropriate account. + +:::zone-end diff --git a/docs/azure/sdk/snippets/authentication/additional-auth/interactive/InteractiveBrokeredAuth.cs b/docs/azure/sdk/snippets/authentication/additional-auth/interactive/InteractiveBrokeredAuth.cs index 911232d71c356..a99b5a1d06031 100644 --- a/docs/azure/sdk/snippets/authentication/additional-auth/interactive/InteractiveBrokeredAuth.cs +++ b/docs/azure/sdk/snippets/authentication/additional-auth/interactive/InteractiveBrokeredAuth.cs @@ -20,12 +20,12 @@ private void testInteractiveBrokeredAuth_Click(object sender, EventArgs e) new InteractiveBrowserCredentialBrokerOptions(windowHandle)); // To authenticate and authorize with an Entra ID app registration, substitute the - // and placeholders with the values for your app and tenant. + // and placeholders with the values for your app and tenant. // var credential = new InteractiveBrowserCredential( // new InteractiveBrowserCredentialBrokerOptions(windowHandle) // { - // TenantId = "your-tenant-id", - // ClientId = "your-client-id" + // TenantId = "", + // ClientId = "" // } // ); diff --git a/docs/azure/sdk/snippets/authentication/additional-auth/interactive/SilentBrokeredAuth.cs b/docs/azure/sdk/snippets/authentication/additional-auth/interactive/SilentBrokeredAuth.cs index 20f6ccf87f6f7..513f056b7a93d 100644 --- a/docs/azure/sdk/snippets/authentication/additional-auth/interactive/SilentBrokeredAuth.cs +++ b/docs/azure/sdk/snippets/authentication/additional-auth/interactive/SilentBrokeredAuth.cs @@ -24,12 +24,12 @@ private void testSilentBrokeredAuth_Click(object sender, EventArgs e) }); // To authenticate and authorize with an app, substitute the - // and placeholders with the values for your app and tenant. + // and placeholders with the values for your app and tenant. // var credential = new InteractiveBrowserCredential( // new InteractiveBrowserCredentialBrokerOptions(windowHandle) // { - // TenantId = "your-tenant-id", - // ClientId = "your-client-id" + // TenantId = "", + // ClientId = "" // } // ); From 881a038af866cad976b062640568b4c1cb9561d0 Mon Sep 17 00:00:00 2001 From: Alex Wolf Date: Mon, 25 Aug 2025 16:30:02 -0400 Subject: [PATCH 09/36] add additional OS --- .../local-development-broker.md | 99 +++- .../authentication/Directory.Packages.props | 2 + .../ConsoleApp/BrokeredConsole.csproj | 13 + .../brokered/ConsoleApp/Program.cs | 53 +++ .../authentication/brokered/MauiApp/App.xaml | 14 + .../brokered/MauiApp/App.xaml.cs | 14 + .../brokered/MauiApp/AppShell.xaml | 14 + .../brokered/MauiApp/AppShell.xaml.cs | 9 + .../brokered/MauiApp/BrokeredMaui.csproj | 72 +++ .../brokered/MauiApp/GlobalXmlns.cs | 2 + .../brokered/MauiApp/MainPage.xaml | 61 +++ .../brokered/MauiApp/MainPage.xaml.cs | 123 +++++ .../brokered/MauiApp/MauiProgram.cs | 24 + .../Platforms/Android/AndroidManifest.xml | 6 + .../MauiApp/Platforms/Android/MainActivity.cs | 10 + .../Platforms/Android/MainApplication.cs | 15 + .../Android/Resources/values/colors.xml | 6 + .../Platforms/MacCatalyst/AppDelegate.cs | 9 + .../Platforms/MacCatalyst/Entitlements.plist | 14 + .../MauiApp/Platforms/MacCatalyst/Info.plist | 38 ++ .../MauiApp/Platforms/MacCatalyst/Program.cs | 15 + .../brokered/MauiApp/Platforms/Tizen/Main.cs | 16 + .../Platforms/Tizen/tizen-manifest.xml | 15 + .../MauiApp/Platforms/Windows/App.xaml | 8 + .../MauiApp/Platforms/Windows/App.xaml.cs | 24 + .../Platforms/Windows/Package.appxmanifest | 46 ++ .../MauiApp/Platforms/Windows/app.manifest | 15 + .../MauiApp/Platforms/iOS/AppDelegate.cs | 9 + .../brokered/MauiApp/Platforms/iOS/Info.plist | 32 ++ .../brokered/MauiApp/Platforms/iOS/Program.cs | 15 + .../iOS/Resources/PrivacyInfo.xcprivacy | 51 ++ .../MauiApp/Properties/launchSettings.json | 8 + .../MauiApp/Resources/AppIcon/appicon.svg | 4 + .../MauiApp/Resources/AppIcon/appiconfg.svg | 8 + .../Resources/Fonts/OpenSans-Regular.ttf | Bin 0 -> 96932 bytes .../Resources/Fonts/OpenSans-Semibold.ttf | Bin 0 -> 100820 bytes .../MauiApp/Resources/Images/dotnet_bot.png | Bin 0 -> 93437 bytes .../MauiApp/Resources/Raw/AboutAssets.txt | 15 + .../MauiApp/Resources/Splash/splash.svg | 8 + .../MauiApp/Resources/Styles/Colors.xaml | 45 ++ .../MauiApp/Resources/Styles/Styles.xaml | 444 ++++++++++++++++++ 41 files changed, 1356 insertions(+), 20 deletions(-) create mode 100644 docs/azure/sdk/snippets/authentication/brokered/ConsoleApp/BrokeredConsole.csproj create mode 100644 docs/azure/sdk/snippets/authentication/brokered/ConsoleApp/Program.cs create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/App.xaml create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/App.xaml.cs create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/AppShell.xaml create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/AppShell.xaml.cs create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/BrokeredMaui.csproj create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/GlobalXmlns.cs create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/MainPage.xaml create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/MainPage.xaml.cs create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/MauiProgram.cs create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/Android/AndroidManifest.xml create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/Android/MainActivity.cs create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/Android/MainApplication.cs create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/Android/Resources/values/colors.xml create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/MacCatalyst/AppDelegate.cs create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/MacCatalyst/Entitlements.plist create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/MacCatalyst/Info.plist create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/MacCatalyst/Program.cs create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/Tizen/Main.cs create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/Tizen/tizen-manifest.xml create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/Windows/App.xaml create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/Windows/App.xaml.cs create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/Windows/Package.appxmanifest create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/Windows/app.manifest create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/iOS/AppDelegate.cs create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/iOS/Info.plist create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/iOS/Program.cs create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Platforms/iOS/Resources/PrivacyInfo.xcprivacy create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Properties/launchSettings.json create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Resources/AppIcon/appicon.svg create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Resources/AppIcon/appiconfg.svg create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Resources/Fonts/OpenSans-Regular.ttf create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Resources/Fonts/OpenSans-Semibold.ttf create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Resources/Images/dotnet_bot.png create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Resources/Raw/AboutAssets.txt create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Resources/Splash/splash.svg create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Resources/Styles/Colors.xaml create mode 100644 docs/azure/sdk/snippets/authentication/brokered/MauiApp/Resources/Styles/Styles.xaml diff --git a/docs/azure/sdk/authentication/local-development-broker.md b/docs/azure/sdk/authentication/local-development-broker.md index 0498c322caa71..291015ec0d057 100644 --- a/docs/azure/sdk/authentication/local-development-broker.md +++ b/docs/azure/sdk/authentication/local-development-broker.md @@ -11,7 +11,9 @@ zone_pivot_groups: operating-systems-set-one Brokered authentication collects user credentials using the system authentication broker to authenticate an application with . A system authentication broker is an app running on a user's machine that manages the authentication handshakes and token maintenance for all connected accounts. -WAM enables identity providers such as Microsoft Entra ID to natively plug into the OS and provide the service to other apps to provide a more secure login process. WAM offers the following benefits: +:::zone target="docs" pivot="windows" + +Windows Account Manager (WAM) enables identity providers such as Microsoft Entra ID to natively plug into the OS and provide the service to other apps to provide a more secure login process. WAM offers the following benefits: - **Feature support**: Apps can access OS-level and service-level capabilities, including Windows Hello, conditional access policies, and FIDO keys. - **Streamlined single sign-on**: Apps can use the built-in account picker, allowing the user to select an existing account instead of repeatedly entering the same credentials. @@ -20,20 +22,40 @@ WAM enables identity providers such as Microsoft Entra ID to natively plug into Brokered authentication enables the application for all operations allowed by the interactive login credentials. Personal Microsoft accounts and work or school accounts are supported. If a supported version of Windows is used, the default browser-based UI is replaced with a smoother authentication experience, similar to Windows built-in apps. +:::zone-end + +:::zone target="docs" pivot="linux" + +The Linux operating system uses [Microsoft single sign-on for Linux](/entra/identity/devices/sso-linux) as its authentication broker. It has many benefits for developers and customers alike, including: + +- **Enables Single Sign-On:** enables apps to simplify how users authenticate with Microsoft Entra ID and protects Microsoft Entra ID refresh tokens from exfiltration and misuse +- **Enhanced security.** Many security enhancements are delivered with the broker, without needing to update the application logic. +- **Feature support.** With the help of the broker developers can access rich OS and service capabilities. +- **System integration.** Applications that use the broker plug-and-play with the built-in account picker, allowing the user to quickly pick an existing account instead of reentering the same credentials over and over. +- **Token Protection.** Ensures that the refresh tokens are device bound and [enables apps](/dotnet/advanced/proof-of-possession-tokens) to acquire device bound access tokens. See [Token Protection](/azure/active-directory/conditional-access/concept-token-protection). + +> [!NOTE] +> Microsoft single sign-on (SSO) for Linux authentication broker support is introduced with `Microsoft.Identity.Client` version v4.69.1. + +:::zone-end + ## Configure the app for brokered authentication Complete the following steps to enable the application to authenticate through the broker flow: 1. In the [Azure portal](https://portal.azure.com), navigate to **Microsoft Entra ID** and select **App registrations** on the left-hand menu. 1. Select the registration for your app, then select **Authentication**. -1. Add the WAM redirect URI to your app registration via a platform configuration: +1. Add the redirect URI to your app registration via a platform configuration: 1. Under **Platform configurations**, select **+ Add a platform**. 1. Under **Configure platforms**, select the tile for your application type (platform) to configure its settings, such as **mobile and desktop applications**. - 1. In **Custom redirect URIs**, enter the following WAM redirect URI: + 1. In **Custom redirect URIs**, enter the following redirect URI for your platform: - ```text - ms-appx-web://Microsoft.AAD.BrokerPlugin/{client_id} - ``` + | Platform | Redirect URI | + |-------------|-----------------------------------------------------------------------------------------------------------------------| + | Windows 10+ | `ms-appx-web://Microsoft.AAD.BrokerPlugin/your_client_id` | + | macOS | `msauth.com.msauth.unsignedapp://auth` for unsigned apps `msauth.BUNDLE_ID://auth` for signed apps | + | WSL | `ms-appx-web://Microsoft.AAD.BrokerPlugin/your_client_id` | + | Linux | `https://login.microsoftonline.com/common/oauth2/nativeclient` | The `{client_id}` placeholder must be replaced with the **Application (client) ID** listed on the **Overview** pane of the app registration. @@ -48,25 +70,30 @@ Complete the following steps to enable the application to authenticate through t > [!IMPORTANT] > You must also be the admin of your tenant to grant consent to your application when you sign in for the first time. +### Assign Azure RBAC roles + +For app code to run successfully with brokered auth, your user account must be [assigned an appropriate Azure RBAC role](/dotnet/azure/sdk/authentication/local-development-dev-accounts) on the corresponding Azure service. For example: + +**Azure Blob Storage**: Assign a role such as **Storage Account Data Contributor**. +**Azure Key Vault**: Assign a role such as **Key Vault Secrets Officer**. + +If an app is specified, it must have API permissions set for **user_impersonation Access Azure Storage** (step 6 in the previous section). This API permission allows the app to access Azure storage on behalf of the signed-in user after consent is granted during sign-in. + ## Implement the code The following example demonstrates using an in a MAUI app to authenticate with the [`BlobServiceClient`](/dotnet/api/azure.storage.blobs.blobserviceclient): -:::zone target="docs" pivot="windows" -Complete the following steps in your .NET project: - 1. Install the [Azure.Identity](https://www.nuget.org/packages/Azure.Identity) and [Azure.Identity.Broker](https://www.nuget.org/packages/Azure.Identity.Broker) packages. -1. Get a reference to the parent window on top of which the account picker dialog should appear. -1. Create an instance of that accepts an instance of . -Consider the following sample code from a Windows Forms app that passes the credential to an instance of [BlobServiceClient](/dotnet/api/azure.storage.blobs.blobserviceclient): + > [!NOTE] + > macOS and Linux support exists in `Azure.Identity.Broker` versions 1.3.0 and later. -:::code language="csharp" source="../snippets/authentication/additional-auth/interactive/InteractiveBrokeredAuth.cs" highlight="16-20"::: +1. Get a reference to the parent window on top of which the account picker dialog should appear. +1. Create an instance of that accepts an instance of . -> [!NOTE] -> For more information about retrieving window handles, see [Parent window handles](/entra/msal/dotnet/acquiring-tokens/desktop-mobile/wam#parent-window-handles) and [Retrieve a window handle](/windows/apps/develop/ui-input/retrieve-hwnd). +:::zone target="docs" pivot="windows" -For the code to run successfully, your user account must be assigned an Azure RBAC role on the storage account that allows access to blob containers, such as **Storage Account Data Contributor**. If an app is specified, it must have API permissions set for **user_impersonation Access Azure Storage** (step 6 in the previous section). This API permission allows the app to access Azure storage on behalf of the signed-in user after consent is granted during sign-in. +:::code language="csharp" source="../snippets/authentication/brokered/MauiApp/MainPage.xaml.cs" highlight="36-48" ::: The following screenshot shows the user sign-in experience: @@ -74,11 +101,15 @@ The following screenshot shows the user sign-in experience: :::zone-end -:::zone target="docs" pivot="linux" +:::zone target="docs" pivot="macos" + +:::code language="csharp" source="../snippets/authentication/brokered/MauiApp/MainPage.xaml.cs" highlight="50-62" ::: :::zone-end -:::zone target="docs" pivot="macos" +:::zone target="docs" pivot="linux" + +:::code language="csharp" source="../snippets/authentication/brokered/ConsoleApp/Program.cs" ::: :::zone-end @@ -88,9 +119,37 @@ The following screenshot shows the user sign-in experience: Many people always sign in to Windows with the same user account and, therefore, only ever want to authenticate using that account. WAM and `InteractiveBrowserCredential` also support a silent login process that automatically uses a default account so the user doesn't have to repeatedly select it. -The following example shows how to enable sign-in with the default system account: +The example shows how to enable sign-in with the default system account: + +:::code language="csharp" source="../snippets/authentication/brokered/MauiApp/MainPage.xaml.cs" highlight="42-46" ::: + +Once you opt in to this behavior, the credential attempts to sign in by asking the underlying Microsoft Authentication Library (MSAL) to perform the sign-in for the default system account. If the sign-in fails, the credential falls back to displaying the account picker dialog, from which the user can select the appropriate account. + +:::zone-end + +:::zone target="docs" pivot="macOS" + +### Authenticate the default system account via MacCatalyst + +Many people always sign in with the same user account and, therefore, only ever want to authenticate using that account. `InteractiveBrowserCredential` also supports a silent login process that automatically uses a default account so the user doesn't have to repeatedly select it. + +The example shows how to enable sign-in with the default system account: + +:::code language="csharp" source="../snippets/authentication/brokered/MauiApp/MainPage.xaml.cs" highlight="58-62" ::: + +Once you opt in to this behavior, the credential attempts to sign in by asking the underlying Microsoft Authentication Library (MSAL) to perform the sign-in for the default system account. If the sign-in fails, the credential falls back to displaying the account picker dialog, from which the user can select the appropriate account. + +:::zone-end + +:::zone target="docs" pivot="linux" + +### Authenticate the default system account on Linux + +Many people always sign in with the same user account and, therefore, only ever want to authenticate using that account. `InteractiveBrowserCredential` also supports a silent login process that automatically uses a default account so the user doesn't have to repeatedly select it. + +The example shows how to enable sign-in with the default system account: -:::code language="csharp" source="../snippets/authentication/additional-auth/interactive/SilentBrokeredAuth.cs" highlight="16-24"::: +:::code language="csharp" source="../snippets/authentication/brokered/ConsoleApp/Program.cs"highlight="22-25" ::: Once you opt in to this behavior, the credential attempts to sign in by asking the underlying Microsoft Authentication Library (MSAL) to perform the sign-in for the default system account. If the sign-in fails, the credential falls back to displaying the account picker dialog, from which the user can select the appropriate account. diff --git a/docs/azure/sdk/snippets/authentication/Directory.Packages.props b/docs/azure/sdk/snippets/authentication/Directory.Packages.props index 395eed4ec48fc..d8055aa22b1ee 100644 --- a/docs/azure/sdk/snippets/authentication/Directory.Packages.props +++ b/docs/azure/sdk/snippets/authentication/Directory.Packages.props @@ -15,5 +15,7 @@ + + \ No newline at end of file diff --git a/docs/azure/sdk/snippets/authentication/brokered/ConsoleApp/BrokeredConsole.csproj b/docs/azure/sdk/snippets/authentication/brokered/ConsoleApp/BrokeredConsole.csproj new file mode 100644 index 0000000000000..6d56ccffd7f63 --- /dev/null +++ b/docs/azure/sdk/snippets/authentication/brokered/ConsoleApp/BrokeredConsole.csproj @@ -0,0 +1,13 @@ + + + Exe + net9.0 + enable + Linux + + + + + + + diff --git a/docs/azure/sdk/snippets/authentication/brokered/ConsoleApp/Program.cs b/docs/azure/sdk/snippets/authentication/brokered/ConsoleApp/Program.cs new file mode 100644 index 0000000000000..e295e842cefd5 --- /dev/null +++ b/docs/azure/sdk/snippets/authentication/brokered/ConsoleApp/Program.cs @@ -0,0 +1,53 @@ +using System; +using System.Runtime.InteropServices; +using Azure; +using Azure.Identity; +using Azure.Identity.Broker; +using Azure.Security.KeyVault.Secrets; + +/// +/// Get the handle of the console window for Linux +/// +[DllImport("libX11")] +static extern IntPtr XOpenDisplay(string display); + +[DllImport("libX11")] +static extern IntPtr XRootWindow(IntPtr display, int screen); + +try +{ + IntPtr parentWindowHandle = XRootWindow(XOpenDisplay(null), 0); + Func consoleWindowHandleProvider = () => parentWindowHandle; + + InteractiveBrowserCredentialBrokerOptions brokerOptions = new(parentWindowHandle) + { + UseDefaultBrokerAccount = true, + }; + + // Create the InteractiveBrowserCredential using broker support + InteractiveBrowserCredential credential = new(brokerOptions); + + Uri vaultUri = new("https://.vault.azure.net/"); + SecretClient client = new(vaultUri, credential); + + Console.WriteLine("Retrieving secret 'MySecret' from Key Vault..."); + KeyVaultSecret secret = await client.GetSecretAsync("MySecret"); + Console.WriteLine($"Secret value: {secret.Value}"); + + return 0; +} +catch (AuthenticationFailedException ex) +{ + Console.Error.WriteLine($"Authentication failed: {ex.Message}"); + return 2; +} +catch (RequestFailedException ex) +{ + Console.Error.WriteLine($"Key Vault request failed: {ex.Message}"); + return 3; +} +catch (Exception ex) +{ + Console.Error.WriteLine($"Unexpected error: {ex.Message}"); + return 1; +} diff --git a/docs/azure/sdk/snippets/authentication/brokered/MauiApp/App.xaml b/docs/azure/sdk/snippets/authentication/brokered/MauiApp/App.xaml new file mode 100644 index 0000000000000..447b69d3f68e4 --- /dev/null +++ b/docs/azure/sdk/snippets/authentication/brokered/MauiApp/App.xaml @@ -0,0 +1,14 @@ + + + + + + + + + + + diff --git a/docs/azure/sdk/snippets/authentication/brokered/MauiApp/App.xaml.cs b/docs/azure/sdk/snippets/authentication/brokered/MauiApp/App.xaml.cs new file mode 100644 index 0000000000000..a57e3a1614693 --- /dev/null +++ b/docs/azure/sdk/snippets/authentication/brokered/MauiApp/App.xaml.cs @@ -0,0 +1,14 @@ +namespace SecretVaultApp; + +public partial class App : Application +{ + public App() + { + InitializeComponent(); + } + + protected override Window CreateWindow(IActivationState? activationState) + { + return new Window(new AppShell()); + } +} \ No newline at end of file diff --git a/docs/azure/sdk/snippets/authentication/brokered/MauiApp/AppShell.xaml b/docs/azure/sdk/snippets/authentication/brokered/MauiApp/AppShell.xaml new file mode 100644 index 0000000000000..6370047c80754 --- /dev/null +++ b/docs/azure/sdk/snippets/authentication/brokered/MauiApp/AppShell.xaml @@ -0,0 +1,14 @@ + + + + + + diff --git a/docs/azure/sdk/snippets/authentication/brokered/MauiApp/AppShell.xaml.cs b/docs/azure/sdk/snippets/authentication/brokered/MauiApp/AppShell.xaml.cs new file mode 100644 index 0000000000000..af26d06c910a0 --- /dev/null +++ b/docs/azure/sdk/snippets/authentication/brokered/MauiApp/AppShell.xaml.cs @@ -0,0 +1,9 @@ +namespace SecretVaultApp; + +public partial class AppShell : Shell +{ + public AppShell() + { + InitializeComponent(); + } +} diff --git a/docs/azure/sdk/snippets/authentication/brokered/MauiApp/BrokeredMaui.csproj b/docs/azure/sdk/snippets/authentication/brokered/MauiApp/BrokeredMaui.csproj new file mode 100644 index 0000000000000..e182b1932ebd0 --- /dev/null +++ b/docs/azure/sdk/snippets/authentication/brokered/MauiApp/BrokeredMaui.csproj @@ -0,0 +1,72 @@ + + + + net9.0-android;net9.0-ios;net9.0-maccatalyst + $(TargetFrameworks);net9.0-windows10.0.19041.0 + + + + + + + Exe + SecretVaultApp + true + true + enable + enable + + + SecretVaultApp + + + com.companyname.secretvaultapp + + + 1.0 + 1 + + + None + + 15.0 + 15.0 + 21.0 + 10.0.17763.0 + 10.0.17763.0 + 6.5 + + Windows, macOS + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/azure/sdk/snippets/authentication/brokered/MauiApp/GlobalXmlns.cs b/docs/azure/sdk/snippets/authentication/brokered/MauiApp/GlobalXmlns.cs new file mode 100644 index 0000000000000..e342fadeec59c --- /dev/null +++ b/docs/azure/sdk/snippets/authentication/brokered/MauiApp/GlobalXmlns.cs @@ -0,0 +1,2 @@ +[assembly: XmlnsDefinition("http://schemas.microsoft.com/dotnet/maui/global", "SecretVaultApp")] +[assembly: XmlnsDefinition("http://schemas.microsoft.com/dotnet/maui/global", "SecretVaultApp.Pages")] diff --git a/docs/azure/sdk/snippets/authentication/brokered/MauiApp/MainPage.xaml b/docs/azure/sdk/snippets/authentication/brokered/MauiApp/MainPage.xaml new file mode 100644 index 0000000000000..106a6ee755637 --- /dev/null +++ b/docs/azure/sdk/snippets/authentication/brokered/MauiApp/MainPage.xaml @@ -0,0 +1,61 @@ + + + + + + + +