feat: add integrated windows authentication support under public clients #652

shajia-deshaw · 2024-01-22T09:44:56Z

Overview

Adds support for Integrated Windows Authentication similar to the Java/.NET clients.

Fixes: #31

rayluo · 2024-01-22T10:32:54Z

Thanks, @shajia-deshaw . Is there any way to test this? Can they be written into test cases?
Anyway, I'll leave this to @ashok672 for reviewing.

shajia-deshaw · 2024-01-22T10:47:43Z

Sure @rayluo - I can add the test cases shortly (I had this tested with a driver script internally)

from msal import PublicClientApplication
app = PublicClientApplication(
    "<client_id>",
    authority="https://login.microsoftonline.com/<tenant_id>")
token = app.acquire_token_integrated_windows_auth("<upn>")
print(token)

shajia-deshaw · 2024-01-22T10:50:46Z

msal/application.py

@@ -172,6 +172,7 @@ class ClientApplication(object):
    ACQUIRE_TOKEN_FOR_CLIENT_ID = "730"
    ACQUIRE_TOKEN_BY_AUTHORIZATION_CODE_ID = "832"
    ACQUIRE_TOKEN_INTERACTIVE = "169"
+    ACQUIRE_TOKEN_INTEGRATED_WINDOWS_AUTH_ID = "870"


I'm not sure how this number is mapped. I just added a random number for IWA btw.

shajia-deshaw · 2024-01-24T19:33:10Z

msal/token_cache.py

@@ -243,7 +243,7 @@ def __add(self, event, now=None):
                    at["refresh_on"] = str(now + refresh_in)  # Schema wants a string
                self.modify(self.CredentialType.ACCESS_TOKEN, at, at)

-            if client_info and not event.get("skip_account_creation"):
+            if (client_info or iwa) and not event.get("skip_account_creation"):


The access token returned by IWA did not meet the criteria to be added as an ACCOUNT credential type in the TokenCache i.e. it didn't have client_info in the response. It was being added as a ACCESS_TOKEN credential type. The cache test in the e2e tests were failing because of it since the get_accounts() call didn't return anything and it assumed there was nothing being added to the cache. Hence, I added a special case of iwa to be added to the ACCOUNT credential type.

The other alternative is to add a method for get_access_tokens similar to get_accounts and use it to decide if we need to acquire new tokens silently for the items in cache.

shajia-deshaw · 2024-02-08T06:00:03Z

Hello folks, just an update - I'm working with my employer to sign the CLA soon.

shajia-deshaw · 2024-02-21T14:08:30Z

@microsoft-github-policy-service agree company="D. E. Shaw & Co., L.P."

shajia-deshaw · 2024-03-06T05:25:58Z

Hello @ashok672 - Checking if you had a chance to review the PR? Thanks.

velulev · 2024-03-13T15:11:46Z

Hello @ashok672 - Checking if you had a chance to review the PR? Thanks.

Hi @ashok672 , please let us know if there is anything else we can help on this with. Thanks.

aschafs · 2024-10-21T03:02:21Z

I just wanted to check if this PR was going to be reviewed and merged. We're very interested in getting IWA support in the msal python library. Thanks!

bgavrilMS · 2024-10-21T10:57:13Z

I don't think so, we are discussing to deprecate Integrated Windows Auth from all MSALs in favor of WAM (broker use). Integrated Windows Auth relies on SAML and HTTP level contracts which are easily broken by network changes, and this causes a lot of churn and support issues. WAM uses a different protocol (PRT) which is not affected.

@iulico-1 @localden - can you provide a perspective as scenario owners?

rayluo · 2024-10-21T16:44:21Z

I don't think so, we are discussing to deprecate Integrated Windows Auth from all MSALs in favor of WAM (broker use). Integrated Windows Auth relies on SAML and HTTP level contracts which are easily broken by network changes, and this causes a lot of churn and support issues. WAM uses a different protocol (PRT) which is not affected.

@iulico-1 @localden - can you provide a perspective as scenario owners?

For the sake of completeness, we had a similar conversation in the feature request issue with the contributor, who mentioned that IWA also works on Linux and that was part of the reason that they worked out this PR. That is a scenario that not currently satisfied by broker.

shajia-deshaw · 2024-10-21T17:07:10Z

I don't think so, we are discussing to deprecate Integrated Windows Auth from all MSALs in favor of WAM (broker use). Integrated Windows Auth relies on SAML and HTTP level contracts which are easily broken by network changes, and this causes a lot of churn and support issues. WAM uses a different protocol (PRT) which is not affected.
@iulico-1 @localden - can you provide a perspective as scenario owners?

For the sake of completeness, we had a similar conversation in the feature request issue with the contributor, who mentioned that IWA also works on Linux and that was part of the reason that they worked out this PR. That is a scenario that not currently satisfied by broker.

Thanks @rayluo for adding context!

FTR, we've been using the patched version of MSAL with Kerberos / IWA flow for months in our internal linux services and applications -- Things have been working just fine.

However, we believe this could be a general enhancement in the upstream MSAL library, benefiting similar users, as evident from the comments on the issue/PR.

localden · 2024-10-21T23:49:19Z

Adding my perspective here - on Windows and macOS, we are indeed shifting to authentication brokers; however, that leaves Linux scenarios in the open and we will need to continue falling back on the vanilla API. I am not inherently opposed to having a native IWA implementation in MSAL Python, but we'd need to coordinate how it falls back to broker and when.

@ashok672 @iulico-1 - something for us to discuss.

iulico-1 · 2024-10-22T18:55:03Z

tests/test_e2e.py

+            azure_region=azure_region, client_credential=client_secret)
+        self.assertEqual(
+            self.app.get_accounts(username=username), [], "Cache starts empty")
+        result = self.app.acquire_token_integrated_windows_auth(


acquire_token_integrated_windows_auth

I am not convinced we need to introduce Windows integrated Auth flow as a separate API.

Windows Integrated Auth is conceptually the same as functionality as default account that brokers (WAM) expose.

Can we follow the same pattern we did with OS account on .net ?

@iulico-1 - how is this going to work on Linux, where there is no WAM? We can't expect every customer to enroll their device either.

On linux there is no WIA also :) this api will just fail with UIRequired on linux without broker integration.

On linux there is no WIA also :) this api will just fail with UIRequired on linux without broker integration.

But the customer claimed otherwise.

A form of WIA can be setup on Linux.

So, am I understanding correctly that we now agree on there is a need for Integrated Windows Auth (IWA, a.k.a. WIA) for Linux? And then this conversation is back to the original question, i.e. how the IWA shall be exposed in an API? Brainstorming time. :-)

This PR's current implementation acquire_token_integrated_windows_auth(username, scopes) was probably inspired by MSAL .Net's dedicated IWA api.
If we do not want IWA to be a dedicated API, we will need to fit it into other existing APIs. Such as:

Modeling it as a ROPC but without a password acquire_token_by_username_password(username, password=None, scopes=[...]). This makes sense from the implementation standpoint, because the actual implementation already shares many building blocks (mex.py, wstrust_request.py) which are only used in ROPC code path.

Modeling it as "the same pattern we did with OS account on ~~.net~~ Python", and that is acquire_token_interactive(scopes, login_hint="johndoe@example.com", prompt="none")

Which one do we prefer?

@rayluo @iulico-1 I think this fits best in the acquire_token_interactive flow, and the library can then determine that it's IWA based on parameter heuristics. This will also help reduce the API surfaces that customers have to navigate to use the capability, and simplify broker intergration.

shajia-deshaw mentioned this pull request Jan 22, 2024

Feature Request - IWA pass through capabilities - align with .net #31

Open

rayluo requested a review from ashok672 January 22, 2024 10:30

shajia-deshaw commented Jan 22, 2024

View reviewed changes

shajia-deshaw commented Jan 24, 2024

View reviewed changes

iulico-1 reviewed Oct 22, 2024

View reviewed changes

shajia-deshaw added 4 commits November 13, 2024 11:38

feat: add integrated windows authentication support under public clients

21a04ee

chore(docs): add iwa sample script under samples/

356756d

chore(deps): add requests-kerberos deps to requirements.txt

f2ad4d1

test: add e2e tests for iwa flow

097a1ac

shajia-deshaw force-pushed the dev branch from 6ead687 to 097a1ac Compare November 13, 2024 06:08

shajia-deshaw requested a review from a team as a code owner November 13, 2024 06:08

shajia-deshaw requested review from localden and iulico-1 November 13, 2024 06:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add integrated windows authentication support under public clients #652

feat: add integrated windows authentication support under public clients #652

shajia-deshaw commented Jan 22, 2024 •

edited

Loading

rayluo commented Jan 22, 2024

shajia-deshaw commented Jan 22, 2024 •

edited

Loading

shajia-deshaw Jan 22, 2024

shajia-deshaw Jan 24, 2024 •

edited

Loading

shajia-deshaw commented Feb 8, 2024

shajia-deshaw commented Feb 21, 2024

shajia-deshaw commented Mar 6, 2024

velulev commented Mar 13, 2024

aschafs commented Oct 21, 2024

bgavrilMS commented Oct 21, 2024 •

edited

Loading

rayluo commented Oct 21, 2024

shajia-deshaw commented Oct 21, 2024

localden commented Oct 21, 2024

iulico-1 Oct 22, 2024

localden Oct 22, 2024

alextok Oct 23, 2024

rayluo Oct 23, 2024

iulico-1 Nov 12, 2024

rayluo Nov 14, 2024

localden Nov 16, 2024

feat: add integrated windows authentication support under public clients #652

Are you sure you want to change the base?

feat: add integrated windows authentication support under public clients #652

Conversation

shajia-deshaw commented Jan 22, 2024 • edited Loading

Overview

rayluo commented Jan 22, 2024

shajia-deshaw commented Jan 22, 2024 • edited Loading

Choose a reason for hiding this comment

shajia-deshaw Jan 24, 2024 • edited Loading

Choose a reason for hiding this comment

shajia-deshaw commented Feb 8, 2024

shajia-deshaw commented Feb 21, 2024

shajia-deshaw commented Mar 6, 2024

velulev commented Mar 13, 2024

aschafs commented Oct 21, 2024

bgavrilMS commented Oct 21, 2024 • edited Loading

rayluo commented Oct 21, 2024

shajia-deshaw commented Oct 21, 2024

localden commented Oct 21, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

shajia-deshaw commented Jan 22, 2024 •

edited

Loading

shajia-deshaw commented Jan 22, 2024 •

edited

Loading

shajia-deshaw Jan 24, 2024 •

edited

Loading

bgavrilMS commented Oct 21, 2024 •

edited

Loading