Repository: prometheus/prometheus
File: storage/remote/azuread/azuread.go (Go)

Code before:
		authenticators++
	}

	if authenticators > 1 {
		return errors.New("cannot provide multiple authentication methods in the Azure AD config")
	}

	if c.ManagedIdentity != nil {
		if c.ManagedIdentity.ClientID != "" {
			_, err := uuid.Parse(c.ManagedIdentity.ClientID)
			if err != nil {
				return errors.New("the provided Azure Managed Identity client_id is invalid")
			}
		}
	}

	if c.WorkloadIdentity != nil {
		if c.WorkloadIdentity.ClientID == "" {
			return errors.New("must provide an Azure Workload Identity client_id in the Azure AD config")
		}

		if c.WorkloadIdentity.TenantID == "" {
			return errors.New("must provide an Azure Workload Identity tenant_id in the Azure AD config")
		}

		// Validate client ID format
		_, err := uuid.Parse(c.WorkloadIdentity.ClientID)
		if err != nil {
			return errors.New("the provided Azure Workload Identity client_id is invalid")
		}

		// Validate tenant ID format
		_, err = uuid.Parse(c.WorkloadIdentity.TenantID)
		if err != nil {
			return errors.New("the provided Azure Workload Identity tenant_id is invalid")
		}

		// Set default token file path when not specified - this matches the path used
		// by the Azure Workload Identity webhook
		if c.WorkloadIdentity.TokenFilePath == "" {
			c.WorkloadIdentity.TokenFilePath = DefaultWorkloadIdentityTokenPath
		}
	}

	if c.OAuth != nil {
		if c.OAuth.ClientID == "" {
			return errors.New("must provide an Azure OAuth client_id in the Azure AD config")
		}
		if c.OAuth.ClientSecret == "" {
			return errors.New("must provide an Azure OAuth client_secret in the Azure AD config")
		}

Review comment (suggestion):
```suggestion
		// Validate client ID format.
```

Code after:
			if err != nil {
				return errors.New("the provided Azure Managed Identity client_id is invalid")
			}
		}
	}

	if c.WorkloadIdentity != nil {
		if c.WorkloadIdentity.ClientID == "" {
			return errors.New("must provide an Azure Workload Identity client_id in the Azure AD config")
		}
		if c.WorkloadIdentity.TenantID == "" {
			return errors.New("must provide an Azure Workload Identity tenant_id in the Azure AD config")
		}

		if _, err := uuid.Parse(c.WorkloadIdentity.ClientID); err != nil {
			return errors.New("the provided Azure Workload Identity client_id is invalid")
		}
		if _, err := uuid.Parse(c.WorkloadIdentity.TenantID); err != nil {
			return errors.New("the provided Azure Workload Identity tenant_id is invalid")
		}

		if c.WorkloadIdentity.TokenFilePath == "" {
			c.WorkloadIdentity.TokenFilePath = DefaultWorkloadIdentityTokenPath
		}
	}

	if c.OAuth != nil {
		if c.OAuth.ClientID == "" {
			return errors.New("must provide an Azure OAuth client_id in the Azure AD config")
		}
		if c.OAuth.ClientSecret == "" {
			return errors.New("must provide an Azure OAuth client_secret in the Azure AD config")
		}
		if c.OAuth.TenantID == "" {
			return errors.New("must provide an Azure OAuth tenant_id in the Azure AD config")
		}

		if _, err := uuid.Parse(c.OAuth.ClientID); err != nil {
			return errors.New("the provided Azure OAuth client_id is invalid")
		}
		if _, err := regexp.MatchString("^[0-9a-zA-Z-.]+$", c.OAuth.TenantID); err != nil {
			return errors.New("the provided Azure OAuth tenant_id is invalid")
		}
	}

	if c.SDK != nil {
		if c.SDK.TenantID != "" {
			if _, err := regexp.MatchString("^[0-9a-zA-Z-.]+$", c.SDK.TenantID); err != nil {
				return errors.New("the provided Azure SDK tenant_id is invalid")
			}
		}