Skip to content

Commit

Permalink
Add credential builder context (#43708)
Browse files Browse the repository at this point in the history
* Add credential builder context
  • Loading branch information
alexwolfmsft authored Nov 25, 2024
1 parent 88043a9 commit e793387
Show file tree
Hide file tree
Showing 2 changed files with 23 additions and 9 deletions.
6 changes: 3 additions & 3 deletions docs/azure/sdk/authentication/credential-chains.md
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ The order in which `DefaultAzureCredential` attempts credentials follows.

In its simplest form, you can use the parameterless version of `DefaultAzureCredential` as follows:

:::code language="csharp" source="../snippets/authentication/credential-chains/Program.cs" id="snippet_Dac" highlight="1":::
:::code language="csharp" source="../snippets/authentication/credential-chains/Program.cs" id="snippet_Dac" highlight="6":::

> [!TIP]
> The `UseCredential` method in the preceding code snippet is recommended for use in ASP.NET Core apps. For more information, see [Use the Azure SDK for .NET in ASP.NET Core apps](../aspnetcore-guidance.md#authenticate-using-microsoft-entra-id).
Expand All @@ -72,7 +72,7 @@ In its simplest form, you can use the parameterless version of `DefaultAzureCred

To remove a credential from `DefaultAzureCredential`, use the corresponding `Exclude`-prefixed property in [DefaultAzureCredentialOptions](/dotnet/api/azure.identity.defaultazurecredentialoptions?view=azure-dotnet&preserve-view=true#properties). For example:

:::code language="csharp" source="../snippets/authentication/credential-chains/Program.cs" id="snippet_DacExcludes" highlight="4-5":::
:::code language="csharp" source="../snippets/authentication/credential-chains/Program.cs" id="snippet_DacExcludes" highlight="9-10":::

In the preceding code sample, `EnvironmentCredential` and `WorkloadIdentityCredential` are removed from the credential chain. As a result, the first credential to be attempted is `ManagedIdentityCredential`. The modified chain looks like this:

Expand All @@ -97,7 +97,7 @@ As more `Exclude`-prefixed properties are set to `true` (credential exclusions a

[ChainedTokenCredential](/dotnet/api/azure.identity.chainedtokencredential?view=azure-dotnet&preserve-view=true) is an empty chain to which you add credentials to suit your app's needs. For example:

:::code language="csharp" source="../snippets/authentication/credential-chains/Program.cs" id="snippet_Ctc":::
:::code language="csharp" source="../snippets/authentication/credential-chains/Program.cs" id="snippet_Ctc" highlight="6-8" :::

The preceding code sample creates a tailored credential chain comprised of two credentials. The user-assigned managed identity variant of `ManagedIdentityCredential` is attempted first, followed by `VisualStudioCredential`, if necessary. In graphical form, the chain looks like this:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,31 +17,45 @@
}, EventLevel.LogAlways);
#endregion snippet_FilteredLogging

#region snippet_Dac
builder.Services.AddAzureClients(clientBuilder =>
{
clientBuilder.AddBlobServiceClient(
new Uri("https://<account-name>.blob.core.windows.net"));
#region snippet_Dac
DefaultAzureCredential credential = new();
clientBuilder.UseCredential(credential);
#endregion snippet_Dac
});
#endregion snippet_Dac

#region snippet_DacExcludes
builder.Services.AddAzureClients(clientBuilder =>
{
clientBuilder.AddBlobServiceClient(
new Uri("https://<account-name>.blob.core.windows.net"));
#region snippet_DacExcludes
clientBuilder.UseCredential(new DefaultAzureCredential(
new DefaultAzureCredentialOptions
{
ExcludeEnvironmentCredential = true,
ExcludeWorkloadIdentityCredential = true,
ManagedIdentityClientId = userAssignedClientId,
}));
#endregion snippet_DacExcludes
});
#endregion snippet_DacExcludes

#region snippet_Ctc
builder.Services.AddAzureClients(clientBuilder =>
{
clientBuilder.AddBlobServiceClient(
new Uri("https://<account-name>.blob.core.windows.net"));
#region snippet_Ctc
clientBuilder.UseCredential(new ChainedTokenCredential(
new ManagedIdentityCredential(clientId: userAssignedClientId),
new VisualStudioCredential()));
#endregion snippet_Ctc
});
#endregion snippet_Ctc


builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();
Expand Down

0 comments on commit e793387

Please sign in to comment.