Add AuthenticationScope to ACR ClientOptions #21493
Conversation
sdk/containerregistry/Azure.Containers.ContainerRegistry/src/ContainerRegistryClientOptions.cs
Outdated
Show resolved
Hide resolved
…ontainerRegistryClientOptions.cs Co-authored-by: Jeremy Meng <yumeng@microsoft.com>
annelo-msft
requested review from
pallavit,
schaabs,
JoshLove-msft,
seankane-msft and
christothes
sdk/containerregistry/Azure.Containers.ContainerRegistry/README.md
Outdated
Show resolved
Hide resolved
| @@ -35,15 +35,37 @@ az acr create --name MyContainerRegistry --resource-group MyResourceGroup --loca | |||
|
|
|||
| ### Authenticate the client | |||
|
|
|||
| The [Azure Identity library][identity] provides easy Azure Active Directory support for authentication. | |||
| The [Azure Identity library][identity] provides easy Azure Active Directory support for authentication. You can set the environment variables `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, and `AZURE_CLIENT_SECRET` to configure `DefaultAzureCredential` to authenticate with AAD. For more information refer to [Azure Identity environment variables](https://github.com/Azure/azure-sdk-for-net/tree/master/sdk/identity/Azure.Identity#environment-variables) or [DefaultAzureCredential](https://github.com/Azure/azure-sdk-for-net/tree/master/sdk/identity/Azure.Identity#defaultazurecredential). | |||
There was a problem hiding this comment.
I believe only EnvironmentCredential will use those environment variables, so depending on the current execution environment or the options passed to DAC, these may be ignored.
There was a problem hiding this comment.
Isn't EnvironmentCredential the first the the DAC chain? Are there cases where this could be bypassed?
There was a problem hiding this comment.
I'm trying to push our readme's away from documenting using environment variables with the DAC as this requires setting up a service principal. Instead I think service client readme's should document that users can log in through the CLII and link to the Identity readme for more ways to authenticate your dev environment when using the DAC.
There was a problem hiding this comment.
Isn't EnvironmentCredential the first the the DAC chain? Are there cases where this could be bypassed?
Yes -
There was a problem hiding this comment.
@schaabs can you point me to an example of a service client README that does this the way you'd like to see it, so I can copy it?
There was a problem hiding this comment.
Updated this to reflect Scott's feedback
sdk/containerregistry/Azure.Containers.ContainerRegistry/src/ContainerRegistryClientOptions.cs
Show resolved
Hide resolved
| @@ -35,15 +35,37 @@ az acr create --name MyContainerRegistry --resource-group MyResourceGroup --loca | |||
|
|
|||
| ### Authenticate the client | |||
|
|
|||
| The [Azure Identity library][identity] provides easy Azure Active Directory support for authentication. | |||
| The [Azure Identity library][identity] provides easy Azure Active Directory support for authentication. You can [authenticate with the Azure CLI](https://github.com/Azure/azure-sdk-for-net/tree/master/sdk/identity/Azure.Identity#authenticating-via-the-azure-cli) when developing and debugging locally. Please see the [Azure Identity README][identity] for more approaches to authenticating with `DefaultAzureCredential`. | |||
This enables customers to use the SDK to connect to registries in the Azure National Clouds, and provides instructions in the README for doing so. Positive functionality has been confirmed by manual testing, and automated tests for this are tracked by #21556
Fixes #20872