Skip to content

Commit 27f5ee0

Browse files
chlowellchlowell
authored
Rename DisableAuthorityValidationAndInstanceDiscovery (#20746)
1 parent 8849196 commit 27f5ee0

19 files changed

+96
-109
lines changed

‎sdk/azidentity/CHANGELOG.md

-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@
66

77
### Breaking Changes
88
> These changes affect only code written against a beta version such as v1.3.0-beta.5
9-
* Renamed `DisableInstanceDiscovery` to `DisableAuthorityValidationAndInstanceDiscovery`
109
* Renamed `NewOnBehalfOfCredentialFromCertificate` to `NewOnBehalfOfCredentialWithCertificate`
1110
* Renamed `NewOnBehalfOfCredentialFromSecret` to `NewOnBehalfOfCredentialWithSecret`
1211

‎sdk/azidentity/client_assertion_credential.go

+6-7
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,11 @@ type ClientAssertionCredentialOptions struct {
3636
// Add the wildcard value "*" to allow the credential to acquire tokens for any tenant in which the
3737
// application is registered.
3838
AdditionallyAllowedTenants []string
39-
// DisableAuthorityValidationAndInstanceDiscovery should be set true only by applications authenticating
40-
// in disconnected clouds, or private clouds such as Azure Stack. It determines whether the credential
41-
// requests Azure AD instance metadata from https://login.microsoft.com before authenticating. Setting
42-
// this to true will skip this request, making the application responsible for ensuring the configured
43-
// authority is valid and trustworthy.
44-
DisableAuthorityValidationAndInstanceDiscovery bool
39+
// DisableInstanceDiscovery should be set true only by applications authenticating in disconnected clouds, or
40+
// private clouds such as Azure Stack. It determines whether the credential requests Azure AD instance metadata
41+
// from https://login.microsoft.com before authenticating. Setting this to true will skip this request, making
42+
// the application responsible for ensuring the configured authority is valid and trustworthy.
43+
DisableInstanceDiscovery bool
4544
}
4645

4746
// NewClientAssertionCredential constructs a ClientAssertionCredential. The getAssertion function must be thread safe. Pass nil for options to accept defaults.
@@ -57,7 +56,7 @@ func NewClientAssertionCredential(tenantID, clientID string, getAssertion func(c
5756
return getAssertion(ctx)
5857
},
5958
)
60-
c, err := getConfidentialClient(clientID, tenantID, cred, &options.ClientOptions, confidential.WithInstanceDiscovery(!options.DisableAuthorityValidationAndInstanceDiscovery))
59+
c, err := getConfidentialClient(clientID, tenantID, cred, &options.ClientOptions, confidential.WithInstanceDiscovery(!options.DisableInstanceDiscovery))
6160
if err != nil {
6261
return nil, err
6362
}

‎sdk/azidentity/client_assertion_credential_test.go

+1-4
Original file line numberDiff line numberDiff line change
@@ -100,10 +100,7 @@ func TestClientAssertionCredential_Live(t *testing.T) {
100100
func(context.Context) (string, error) {
101101
return getAssertion(certs[0], key)
102102
},
103-
&ClientAssertionCredentialOptions{
104-
ClientOptions: o,
105-
DisableAuthorityValidationAndInstanceDiscovery: d,
106-
},
103+
&ClientAssertionCredentialOptions{ClientOptions: o, DisableInstanceDiscovery: d},
107104
)
108105
if err != nil {
109106
t.Fatal(err)

‎sdk/azidentity/client_certificate_credential.go

+6-7
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,11 @@ type ClientCertificateCredentialOptions struct {
2929
// Add the wildcard value "*" to allow the credential to acquire tokens for any tenant in which the
3030
// application is registered.
3131
AdditionallyAllowedTenants []string
32-
// DisableAuthorityValidationAndInstanceDiscovery should be set true only by applications authenticating
33-
// in disconnected clouds, or private clouds such as Azure Stack. It determines whether the credential
34-
// requests Azure AD instance metadata from https://login.microsoft.com before authenticating. Setting
35-
// this to true will skip this request, making the application responsible for ensuring the configured
36-
// authority is valid and trustworthy.
37-
DisableAuthorityValidationAndInstanceDiscovery bool
32+
// DisableInstanceDiscovery should be set true only by applications authenticating in disconnected clouds, or
33+
// private clouds such as Azure Stack. It determines whether the credential requests Azure AD instance metadata
34+
// from https://login.microsoft.com before authenticating. Setting this to true will skip this request, making
35+
// the application responsible for ensuring the configured authority is valid and trustworthy.
36+
DisableInstanceDiscovery bool
3837
// SendCertificateChain controls whether the credential sends the public certificate chain in the x5c
3938
// header of each token request's JWT. This is required for Subject Name/Issuer (SNI) authentication.
4039
// Defaults to False.
@@ -63,7 +62,7 @@ func NewClientCertificateCredential(tenantID string, clientID string, certs []*x
6362
if options.SendCertificateChain {
6463
o = append(o, confidential.WithX5C())
6564
}
66-
o = append(o, confidential.WithInstanceDiscovery(!options.DisableAuthorityValidationAndInstanceDiscovery))
65+
o = append(o, confidential.WithInstanceDiscovery(!options.DisableInstanceDiscovery))
6766
c, err := getConfidentialClient(clientID, tenantID, cred, &options.ClientOptions, o...)
6867
if err != nil {
6968
return nil, err

‎sdk/azidentity/client_certificate_credential_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,7 @@ func TestClientCertificateCredential_Live(t *testing.T) {
239239
}
240240
o, stop := initRecording(t)
241241
defer stop()
242-
opts := &ClientCertificateCredentialOptions{ClientOptions: o, DisableAuthorityValidationAndInstanceDiscovery: true}
242+
opts := &ClientCertificateCredentialOptions{ClientOptions: o, DisableInstanceDiscovery: true}
243243
cred, err := NewClientCertificateCredential(liveSP.tenantID, liveSP.clientID, certs, key, opts)
244244
if err != nil {
245245
t.Fatalf("failed to construct credential: %v", err)
@@ -265,7 +265,7 @@ func TestClientCertificateCredentialADFS_Live(t *testing.T) {
265265
o, stop := initRecording(t)
266266
defer stop()
267267
o.Cloud.ActiveDirectoryAuthorityHost = adfsAuthority
268-
opts := &ClientCertificateCredentialOptions{ClientOptions: o, DisableAuthorityValidationAndInstanceDiscovery: true}
268+
opts := &ClientCertificateCredentialOptions{ClientOptions: o, DisableInstanceDiscovery: true}
269269
cred, err := NewClientCertificateCredential("adfs", adfsLiveSP.clientID, certs, key, opts)
270270
if err != nil {
271271
t.Fatalf("failed to construct credential: %v", err)

‎sdk/azidentity/client_secret_credential.go

+6-7
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,11 @@ type ClientSecretCredentialOptions struct {
2424
// Add the wildcard value "*" to allow the credential to acquire tokens for any tenant in which the
2525
// application is registered.
2626
AdditionallyAllowedTenants []string
27-
// DisableAuthorityValidationAndInstanceDiscovery should be set true only by applications authenticating
28-
// in disconnected clouds, or private clouds such as Azure Stack. It determines whether the credential
29-
// requests Azure AD instance metadata from https://login.microsoft.com before authenticating. Setting
30-
// this to true will skip this request, making the application responsible for ensuring the configured
31-
// authority is valid and trustworthy.
32-
DisableAuthorityValidationAndInstanceDiscovery bool
27+
// DisableInstanceDiscovery should be set true only by applications authenticating in disconnected clouds, or
28+
// private clouds such as Azure Stack. It determines whether the credential requests Azure AD instance metadata
29+
// from https://login.microsoft.com before authenticating. Setting this to true will skip this request, making
30+
// the application responsible for ensuring the configured authority is valid and trustworthy.
31+
DisableInstanceDiscovery bool
3332
}
3433

3534
// ClientSecretCredential authenticates an application with a client secret.
@@ -48,7 +47,7 @@ func NewClientSecretCredential(tenantID string, clientID string, clientSecret st
4847
return nil, err
4948
}
5049
c, err := getConfidentialClient(
51-
clientID, tenantID, cred, &options.ClientOptions, confidential.WithInstanceDiscovery(!options.DisableAuthorityValidationAndInstanceDiscovery),
50+
clientID, tenantID, cred, &options.ClientOptions, confidential.WithInstanceDiscovery(!options.DisableInstanceDiscovery),
5251
)
5352
if err != nil {
5453
return nil, err

‎sdk/azidentity/client_secret_credential_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ func TestClientSecretCredential_Live(t *testing.T) {
4949
t.Run(name, func(t *testing.T) {
5050
opts, stop := initRecording(t)
5151
defer stop()
52-
o := ClientSecretCredentialOptions{ClientOptions: opts, DisableAuthorityValidationAndInstanceDiscovery: disabledID}
52+
o := ClientSecretCredentialOptions{ClientOptions: opts, DisableInstanceDiscovery: disabledID}
5353
cred, err := NewClientSecretCredential(liveSP.tenantID, liveSP.clientID, liveSP.secret, &o)
5454
if err != nil {
5555
t.Fatalf("failed to construct credential: %v", err)
@@ -68,7 +68,7 @@ func TestClientSecretCredentialADFS_Live(t *testing.T) {
6868
opts, stop := initRecording(t)
6969
defer stop()
7070
opts.Cloud.ActiveDirectoryAuthorityHost = adfsAuthority
71-
o := ClientSecretCredentialOptions{ClientOptions: opts, DisableAuthorityValidationAndInstanceDiscovery: true}
71+
o := ClientSecretCredentialOptions{ClientOptions: opts, DisableInstanceDiscovery: true}
7272
cred, err := NewClientSecretCredential("adfs", adfsLiveSP.clientID, adfsLiveSP.secret, &o)
7373
if err != nil {
7474
t.Fatalf("failed to construct credential: %v", err)

‎sdk/azidentity/default_azure_credential.go

+9-10
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,11 @@ type DefaultAzureCredentialOptions struct {
2727
// the wildcard value "*" to allow the credential to acquire tokens for any tenant. This value can also be
2828
// set as a semicolon delimited list of tenants in the environment variable AZURE_ADDITIONALLY_ALLOWED_TENANTS.
2929
AdditionallyAllowedTenants []string
30-
// DisableAuthorityValidationAndInstanceDiscovery should be set true only by applications authenticating
31-
// in disconnected clouds, or private clouds such as Azure Stack. It determines whether the credential
32-
// requests Azure AD instance metadata from https://login.microsoft.com before authenticating. Setting
33-
// this to true will skip this request, making the application responsible for ensuring the configured
34-
// authority is valid and trustworthy.
35-
DisableAuthorityValidationAndInstanceDiscovery bool
30+
// DisableInstanceDiscovery should be set true only by applications authenticating in disconnected clouds, or
31+
// private clouds such as Azure Stack. It determines whether the credential requests Azure AD instance metadata
32+
// from https://login.microsoft.com before authenticating. Setting this to true will skip this request, making
33+
// the application responsible for ensuring the configured authority is valid and trustworthy.
34+
DisableInstanceDiscovery bool
3635
// TenantID identifies the tenant the Azure CLI should authenticate in.
3736
// Defaults to the CLI's default tenant, which is typically the home tenant of the user logged in to the CLI.
3837
TenantID string
@@ -73,9 +72,9 @@ func NewDefaultAzureCredential(options *DefaultAzureCredentialOptions) (*Default
7372
}
7473

7574
envCred, err := NewEnvironmentCredential(&EnvironmentCredentialOptions{
76-
ClientOptions: options.ClientOptions,
77-
DisableAuthorityValidationAndInstanceDiscovery: options.DisableAuthorityValidationAndInstanceDiscovery,
78-
additionallyAllowedTenants: additionalTenants,
75+
ClientOptions: options.ClientOptions,
76+
DisableInstanceDiscovery: options.DisableInstanceDiscovery,
77+
additionallyAllowedTenants: additionalTenants,
7978
})
8079
if err == nil {
8180
creds = append(creds, envCred)
@@ -88,7 +87,7 @@ func NewDefaultAzureCredential(options *DefaultAzureCredentialOptions) (*Default
8887
wic, err := NewWorkloadIdentityCredential(&WorkloadIdentityCredentialOptions{
8988
AdditionallyAllowedTenants: additionalTenants,
9089
ClientOptions: options.ClientOptions,
91-
DisableAuthorityValidationAndInstanceDiscovery: options.DisableAuthorityValidationAndInstanceDiscovery,
90+
DisableInstanceDiscovery: options.DisableInstanceDiscovery,
9291
})
9392
if err == nil {
9493
creds = append(creds, wic)

‎sdk/azidentity/device_code_credential.go

+6-7
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,11 @@ type DeviceCodeCredentialOptions struct {
2727
// ClientID is the ID of the application users will authenticate to.
2828
// Defaults to the ID of an Azure development application.
2929
ClientID string
30-
// DisableAuthorityValidationAndInstanceDiscovery should be set true only by applications authenticating
31-
// in disconnected clouds, or private clouds such as Azure Stack. It determines whether the credential
32-
// requests Azure AD instance metadata from https://login.microsoft.com before authenticating. Setting
33-
// this to true will skip this request, making the application responsible for ensuring the configured
34-
// authority is valid and trustworthy.
35-
DisableAuthorityValidationAndInstanceDiscovery bool
30+
// DisableInstanceDiscovery should be set true only by applications authenticating in disconnected clouds, or
31+
// private clouds such as Azure Stack. It determines whether the credential requests Azure AD instance metadata
32+
// from https://login.microsoft.com before authenticating. Setting this to true will skip this request, making
33+
// the application responsible for ensuring the configured authority is valid and trustworthy.
34+
DisableInstanceDiscovery bool
3635
// TenantID is the Azure Active Directory tenant the credential authenticates in. Defaults to the
3736
// "organizations" tenant, which can authenticate work and school accounts. Required for single-tenant
3837
// applications.
@@ -89,7 +88,7 @@ func NewDeviceCodeCredential(options *DeviceCodeCredentialOptions) (*DeviceCodeC
8988
}
9089
cp.init()
9190
c, err := getPublicClient(
92-
cp.ClientID, cp.TenantID, &cp.ClientOptions, public.WithInstanceDiscovery(!cp.DisableAuthorityValidationAndInstanceDiscovery),
91+
cp.ClientID, cp.TenantID, &cp.ClientOptions, public.WithInstanceDiscovery(!cp.DisableInstanceDiscovery),
9392
)
9493
if err != nil {
9594
return nil, err

‎sdk/azidentity/device_code_credential_test.go

+5-4
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ func TestDeviceCodeCredential_Live(t *testing.T) {
9999
},
100100
{
101101
desc: "instance discovery disabled",
102-
opts: DeviceCodeCredentialOptions{DisableAuthorityValidationAndInstanceDiscovery: true, TenantID: liveSP.tenantID},
102+
opts: DeviceCodeCredentialOptions{DisableInstanceDiscovery: true, TenantID: liveSP.tenantID},
103103
},
104104
{
105105
desc: "optional tenant",
@@ -133,9 +133,10 @@ func TestDeviceCodeCredentialADFS_Live(t *testing.T) {
133133
defer stop()
134134
o.Cloud.ActiveDirectoryAuthorityHost = adfsAuthority
135135
opts := DeviceCodeCredentialOptions{
136-
ClientID: adfsLiveUser.clientID,
137-
ClientOptions: o, DisableAuthorityValidationAndInstanceDiscovery: true,
138-
TenantID: "adfs",
136+
ClientID: adfsLiveUser.clientID,
137+
ClientOptions: o,
138+
DisableInstanceDiscovery: true,
139+
TenantID: "adfs",
139140
}
140141
if recording.GetRecordMode() == recording.PlaybackMode {
141142
opts.UserPrompt = func(ctx context.Context, m DeviceCodeMessage) error { return nil }

‎sdk/azidentity/environment_credential.go

+8-9
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,11 @@ const envVarSendCertChain = "AZURE_CLIENT_SEND_CERTIFICATE_CHAIN"
2424
type EnvironmentCredentialOptions struct {
2525
azcore.ClientOptions
2626

27-
// DisableAuthorityValidationAndInstanceDiscovery should be set true only by applications authenticating
28-
// in disconnected clouds, or private clouds such as Azure Stack. It determines whether the credential
29-
// requests Azure AD instance metadata from https://login.microsoft.com before authenticating. Setting
30-
// this to true will skip this request, making the application responsible for ensuring the configured
31-
// authority is valid and trustworthy.
32-
DisableAuthorityValidationAndInstanceDiscovery bool
27+
// DisableInstanceDiscovery should be set true only by applications authenticating in disconnected clouds, or
28+
// private clouds such as Azure Stack. It determines whether the credential requests Azure AD instance metadata
29+
// from https://login.microsoft.com before authenticating. Setting this to true will skip this request, making
30+
// the application responsible for ensuring the configured authority is valid and trustworthy.
31+
DisableInstanceDiscovery bool
3332
// additionallyAllowedTenants is used only by NewDefaultAzureCredential() to enable that constructor's explicit
3433
// option to override the value of AZURE_ADDITIONALLY_ALLOWED_TENANTS. Applications using EnvironmentCredential
3534
// directly should set that variable instead. This field should remain unexported to preserve this credential's
@@ -102,7 +101,7 @@ func NewEnvironmentCredential(options *EnvironmentCredentialOptions) (*Environme
102101
o := &ClientSecretCredentialOptions{
103102
AdditionallyAllowedTenants: additionalTenants,
104103
ClientOptions: options.ClientOptions,
105-
DisableAuthorityValidationAndInstanceDiscovery: options.DisableAuthorityValidationAndInstanceDiscovery,
104+
DisableInstanceDiscovery: options.DisableInstanceDiscovery,
106105
}
107106
cred, err := NewClientSecretCredential(tenantID, clientID, clientSecret, o)
108107
if err != nil {
@@ -127,7 +126,7 @@ func NewEnvironmentCredential(options *EnvironmentCredentialOptions) (*Environme
127126
o := &ClientCertificateCredentialOptions{
128127
AdditionallyAllowedTenants: additionalTenants,
129128
ClientOptions: options.ClientOptions,
130-
DisableAuthorityValidationAndInstanceDiscovery: options.DisableAuthorityValidationAndInstanceDiscovery,
129+
DisableInstanceDiscovery: options.DisableInstanceDiscovery,
131130
}
132131
if v, ok := os.LookupEnv(envVarSendCertChain); ok {
133132
o.SendCertificateChain = v == "1" || strings.ToLower(v) == "true"
@@ -144,7 +143,7 @@ func NewEnvironmentCredential(options *EnvironmentCredentialOptions) (*Environme
144143
o := &UsernamePasswordCredentialOptions{
145144
AdditionallyAllowedTenants: additionalTenants,
146145
ClientOptions: options.ClientOptions,
147-
DisableAuthorityValidationAndInstanceDiscovery: options.DisableAuthorityValidationAndInstanceDiscovery,
146+
DisableInstanceDiscovery: options.DisableInstanceDiscovery,
148147
}
149148
cred, err := NewUsernamePasswordCredential(tenantID, clientID, username, password, o)
150149
if err != nil {

‎sdk/azidentity/environment_credential_test.go

+8-8
Original file line numberDiff line numberDiff line change
@@ -248,8 +248,8 @@ func TestEnvironmentCredential_ClientSecretLive(t *testing.T) {
248248
opts, stop := initRecording(t)
249249
defer stop()
250250
cred, err := NewEnvironmentCredential(&EnvironmentCredentialOptions{
251-
ClientOptions: opts,
252-
DisableAuthorityValidationAndInstanceDiscovery: disabledID,
251+
ClientOptions: opts,
252+
DisableInstanceDiscovery: disabledID,
253253
})
254254
if err != nil {
255255
t.Fatalf("failed to construct credential: %v", err)
@@ -275,8 +275,8 @@ func TestEnvironmentCredentialADFS_ClientSecretLive(t *testing.T) {
275275
opts, stop := initRecording(t)
276276
defer stop()
277277
cred, err := NewEnvironmentCredential(&EnvironmentCredentialOptions{
278-
ClientOptions: opts,
279-
DisableAuthorityValidationAndInstanceDiscovery: true,
278+
ClientOptions: opts,
279+
DisableInstanceDiscovery: true,
280280
})
281281
if err != nil {
282282
t.Fatalf("failed to construct credential: %v", err)
@@ -330,8 +330,8 @@ func TestEnvironmentCredential_UserPasswordLive(t *testing.T) {
330330
opts, stop := initRecording(t)
331331
defer stop()
332332
cred, err := NewEnvironmentCredential(&EnvironmentCredentialOptions{
333-
ClientOptions: opts,
334-
DisableAuthorityValidationAndInstanceDiscovery: disabledID,
333+
ClientOptions: opts,
334+
DisableInstanceDiscovery: disabledID,
335335
})
336336
if err != nil {
337337
t.Fatalf("failed to construct credential: %v", err)
@@ -358,8 +358,8 @@ func TestEnvironmentCredentialADFS_UserPasswordLive(t *testing.T) {
358358
opts, stop := initRecording(t)
359359
defer stop()
360360
cred, err := NewEnvironmentCredential(&EnvironmentCredentialOptions{
361-
ClientOptions: opts,
362-
DisableAuthorityValidationAndInstanceDiscovery: true,
361+
ClientOptions: opts,
362+
DisableInstanceDiscovery: true,
363363
})
364364
if err != nil {
365365
t.Fatalf("failed to construct credential: %v", err)

0 commit comments

Comments
 (0)