Repository: prometheus/prometheus
File: storage/remote/azuread/azuread.go (Go)

Code before:
	refreshTime time.Time
	// credentialClient is the Azure AD credential client that is being used to retrieve accessToken.
	credentialClient azcore.TokenCredential
	options          *policy.TokenRequestOptions
}

// Validate validates config values provided.
func (c *AzureADConfig) Validate() error {
	if c.Cloud == "" {
		c.Cloud = AzurePublic
	}

	if c.Cloud != AzureChina && c.Cloud != AzureGovernment && c.Cloud != AzurePublic {
		return errors.New("must provide a cloud in the Azure AD config")
	}

	if c.ManagedIdentity == nil && c.WorkloadIdentity == nil && c.OAuth == nil && c.SDK == nil {
		return errors.New("must provide an Azure Managed Identity, Azure Workload Identity, Azure OAuth or Azure SDK in the Azure AD config")
	}

	// Check for mutually exclusive configurations
	authenticators := 0
	if c.ManagedIdentity != nil {
		authenticators++
	}
	if c.WorkloadIdentity != nil {
		authenticators++
	}
	if c.OAuth != nil {
		authenticators++
	}
	if c.SDK != nil {
		authenticators++
	}

	if authenticators > 1 {
		return errors.New("cannot provide multiple authentication methods in the Azure AD config")
	}

	if c.ManagedIdentity != nil {
		if c.ManagedIdentity.ClientID != "" {
			_, err := uuid.Parse(c.ManagedIdentity.ClientID)
			if err != nil {
				return errors.New("the provided Azure Managed Identity client_id is invalid")
			}
		}
	}

	if c.WorkloadIdentity != nil {
		if c.WorkloadIdentity.ClientID == "" {
			return errors.New("must provide an Azure Workload Identity client_id in the Azure AD config")

Review comment (security):
Can we use the 0 value to replace the above check? For consistency.

```
if c.ManagedIdentity == nil && c.WorkloadIdentity == nil && c.OAuth == nil && c.SDK == nil {
		return errors.New("must provide an Azure Managed Identity, Azure Workload Identity, Azure OAuth or Azure SDK in the Azure AD config")
	}
```
 

Code after:
	if c.Cloud == "" {
		c.Cloud = AzurePublic
	}

	if c.Cloud != AzureChina && c.Cloud != AzureGovernment && c.Cloud != AzurePublic {
		return errors.New("must provide a cloud in the Azure AD config")
	}

	authenticators := 0
	if c.ManagedIdentity != nil {
		authenticators++
	}
	if c.WorkloadIdentity != nil {
		authenticators++
	}
	if c.OAuth != nil {
		authenticators++
	}
	if c.SDK != nil {
		authenticators++
	}

	if authenticators == 0 {
		return errors.New("must provide an Azure Managed Identity, Azure Workload Identity, Azure OAuth or Azure SDK in the Azure AD config")
	}
	if authenticators > 1 {
		return errors.New("cannot provide multiple authentication methods in the Azure AD config")
	}

	if c.ManagedIdentity != nil {
		if c.ManagedIdentity.ClientID != "" {
			_, err := uuid.Parse(c.ManagedIdentity.ClientID)
			if err != nil {
				return errors.New("the provided Azure Managed Identity client_id is invalid")
			}
		}
	}

	if c.WorkloadIdentity != nil {
		if c.WorkloadIdentity.ClientID == "" {
			return errors.New("must provide an Azure Workload Identity client_id in the Azure AD config")
		}
		if c.WorkloadIdentity.TenantID == "" {
			return errors.New("must provide an Azure Workload Identity tenant_id in the Azure AD config")
		}

		if _, err := uuid.Parse(c.WorkloadIdentity.ClientID); err != nil {
			return errors.New("the provided Azure Workload Identity client_id is invalid")
		}
		if _, err := uuid.Parse(c.WorkloadIdentity.TenantID); err != nil {
			return errors.New("the provided Azure Workload Identity tenant_id is invalid")