Package: azure-identity-broker
Azure Identity Broker plugin for PythonThis package extends theAzure Identitylibrary by providing supplemental credentials for authenticating via an authentication broker.An authentication broker is an application that runs on a user’s machine that manages the authentication handshakes and token maintenance for connected accounts. Currently, only the Windows authentication broker, Web Account Manager (WAM), is supported.Source code|Package (PyPI)|API reference documentation|Microsoft Entra ID documentationGetting startedInstall the packageInstall the Azure Identity Broker plugin for Python withpip:pipinstallazure-identity-brokerKey conceptsThis package enables broker support viaInteractiveBrowserBrokerCredentialwhich is a subclass of theInteractiveBrowserCredentialof the Azure Identity library.Parent window handlesWhen authenticating interactively viaInteractiveBrowserBrokerCredential, a parent window handle is required to ensure that the authentication dialog is shown correctly over the requesting window. In the context of graphical user interfaces on devices, a window handle is a unique identifier that the operating system assigns to each window. For the Windows operating system, this handle is an integer value that serves as a reference to a specific window.Microsoft account (MSA) passthroughMicrosoft accounts (MSA) are personal accounts created by users to access Microsoft services. MSA passthrough is a legacy configuration which enables users to get tokens to resources which normally don't accept MSA logins. This feature is only available to first-party applications. Users authenticating with an application that is configured to use MSA passthrough can setenable_msa_passthroughtoTrueinsideInteractiveBrowserBrokerCredentialto allow these personal accounts to be listed by WAM.Redirect URIsMicrosoft Entra applications rely on redirect URIs to determine where to send the authentication response after a user has logged in. To enable brokered authentication through WAM, a redirect URI matching the following pattern should be registered to the application:ms-appx-web://Microsoft.AAD.BrokerPlugin/{client_id}ExamplesAuthenticate withInteractiveBrowserBrokerCredentialThis example demonstrates usingInteractiveBrowserBrokerCredentialas a broker-enabled credential for authenticating with theBlobServiceClientfrom theazure-storage-bloblibrary. Here, thewin32guipackage is used to get the current window.importwin32guifromazure.identity.brokerimportInteractiveBrowserBrokerCredentialfromazure.storage.blobimportBlobServiceClient# Get the handle of the current windowcurrent_window_handle=win32gui.GetForegroundWindow()credential=InteractiveBrowserBrokerCredential(parent_window_handle=current_window_handle)client=BlobServiceClient(account_url,credential=default_credential)TroubleshootingSee the Azure Identitytroubleshooting guidefor details on how to diagnose various failure scenarios.Next stepsClient library supportClient and management libraries listed on theAzure SDK release pagethat support Microsoft Entra authentication accept credentials from this library. You can learn more about using these libraries in their documentation, which is linked from the release page.Known issuesThis library doesn't supportAzure AD B2C.For other open issues, refer to the library'sGitHub repository.Provide feedbackIf you encounter bugs or have suggestions,open an issue.ContributingThis project welcomes contributions and suggestions.  Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visithttps://cla.microsoft.com.When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.This project has adopted theMicrosoft Open Source Code of Conduct. For more information see theCode of Conduct FAQor contactopencode@microsoft.comwith any additional questions or comments.Release History1.0.0 (2023-11-07)Features Addedenable_brokeris always on if running on Windows. Automatically fall back into non-broker mode if running on MacOS or Linux.Breaking ChangesRemovedUsernamePasswordBrokerCredential1.0.0b1 (2023-10-12)Features AddedAddedazure.identity.broker.InteractiveBrowserBrokerCredentialandazure.identity.broker.UsernamePasswordBrokerCredentialwhich have broker support.