microsoft-identity-web icon indicating copy to clipboard operation
microsoft-identity-web copied to clipboard

[Feature Request] Add support for ITokenAcquisition and debugging locally with Managed Identity

Open SWarnberg opened this issue 8 months ago • 10 comments

Reading the documentation in Calling APIs with Managed Identity, you get the impression that it would be possible to use the id web library instead of Azure.Identity for getting tokens with Managed Identity. However, it doesn't seem to work when debugging locally in Visual Studio, as DefaultAzureCredentials do. Is it supposed to work?

Also, the solution and documentation is only focused on console applications, using IDownstreamApi. A more relevant example would be for a Web Api that calls a Web Api with ITokenAcquisition, since there are more suitable strongly typed proxy clients, like Refit. But that doesn't seem to work either?

In my mind, the configuration in "AzureAd" would have a setting for ManagedIdentity, and not in the "downstream api" section. Currently, it only supports federated clients with user assigned MI's.

Getting a token in code works, when deployed in Azure, with the parameter tokenAcquisitionOptions, but since it doesn't work when debugging it won't be pretty, and you would like it to be configurable in appsettings (if you'd like to do ClientCredentials locally for instance).

string token = await _tokenAcquisition.GetAccessTokenForAppAsync("api://{api-uri}/.default",
  tokenAcquisitionOptions: new TokenAcquisitionOptions { ManagedIdentity = new() });

SWarnberg avatar Jun 13 '24 14:06 SWarnberg