.Net Foundation On .NET, 3 Dec 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Securing your Azure applications with Azure.Identity

Description

Azure.Identity on NuGet https://www.nuget.org/packages/Azure.identity?WT.mc_id=ondotnet-c9-cephilli

Azure SDKs for .NET https://github.com/Azure/azure-sdk-for-net?WT.mc_id=ondotnet-c9-cephilli

Azure SDK Design Guidelines for .NET https://azure.github.io/azure-sdk/dotnet_introduction.html?WT.mc_id=ondotnet-c9-cephilli

Azure for .NET and .NET Core developers https://docs.microsoft.com/en-us/dotnet/azure?WT.mc_id=ondotnet-c9-cephilli

In this episode, Scott from the Azure SDK team joins us to talk about the Azure.Identity library and how it makes authentication easier for your Azure applications.

[02:35] - Authenticating changing and the DefaultAzureCredential
[04:32] - How the DefaultAzureCredential works
[07:04] - How does Azure.Identity relate to MSAL
[08:23] - Using Azure.Identity with an Linux VM in Azure
[11:08] - Available credential types

#azureidentity #azuredotnetsdk #dotnet

A

In this episode of the on.net show, we're going to learn about the azure identity, sdk that gives you some flexible options for authenticating with your services. Inside of the cloud. check, it out.

A

Everybody, welcome to another episode of the on.net show..

A

My name is cecil philip, and today I have scott joining me from the azure sdk team. hey, scott.. How is it going, man?

A

good.? How are you? so? Why don't we start off with quickly you just telling us a little bit about yourself and what do you do on that? Team.

B

Sure. so I'm on the azure sdk team, as you said.

B

I focus on identity mainly., I'm the architect in charge of our identity, story,.

B

And I obsess about identity and authentication.

B

So that other developers don't have to attest about those things.

B

Yeah., I know identity and authentication in general is.

A

Not a trivial thing to implement its applications., so it's always great when our libraries and our sdks can take.

A

Some of that work off shoulder, so we could just again focus on solving business problems.

B

Right., that's definitely the approach that we took..

B

What we wanted to do was simplify authentication for developers.

B

We wanted to do a lot of things for them that they ended up in.

B

Older implications of our sdk having to do themselves,.

B

Such as handling the lifetime of tokens that they authenticated with, actually retrieving those tokens themselves, keeping them refreshed..

B

We try and really build that into the platform so that it's.

B

Something that I can just pick up and start working,.

B

And my first 20 minutes isn't focused on how do I actually authenticate this application.

B

yeah, sure.? That makes sense.

A

So specifically, what we're going to be talking about today is a new flavor or new set of sdks that had been worked on for all of our various azure services.

A

This azure identity, library that we have now is going to be something that's fairly common across all of these different libraries for different services..

A

That's right., I'm specifically talking about .net because we're on the on.net show., yes,, azure, identity,,.

B

As I said,, the goal was to simplify authentication..

B

So one way we did that was, to review all of the libraries that are part of our sdk,.

B

All the clients that we have as part of our sdk, and make sure that the authentication story for them was the same..

B

So the way that I authenticate with a blob storage client is.

B

The same way that I authenticate with key vault client and everything else., we also have put together a lot of pre-built means to authenticate.

B

So I'm going to actually walk you through one of.

B

Those now that we've actually want to talk about.

B

Sure., let's do it., so one of the things that we actually created is the way to.

B

Chain together different authentication mechanisms, so we can have a authentication flow..

B

Specifically, we've created one chain which is called the default azure credential., so the default azure credential is a credential which allows me to use the same credential in my dev environment as I use in a deployed environment.

B

So I can go seamlessly from my dev environment to be deployed on azure resource without.

B

Having any code changes or having to have crazy switch statements around how I construct the client.

B

So for this,, we've used the default azure credential,.

B

And when I'm on my dev environment,, I can actually just sign in to visual studio.

B

This will take a second because I had to do single sign-on,.

B

But while we're doing that,, I will say that one nice thing about this is it actually will support multi-factor authentication,, which has really been a pain point for people in the past.

B

So once we've actually signed in here.

A

Yes., so what he's doing now? Because everybody might not be able to see it, so you're signing in in visual studio. you're, going to get a little pop-up on your authenticator app on your phone.

B

That's right.. You are going to hit "allow" because again we.

A

Have two 2fa enabled, and then now you'll be able to work with these services within the visual studio. Development..

A

Yeah. so there we go.

B

So now we are authenticated, and I can actually run this demo on my machine.

B

This is a demo that we've actually shown in.

B

Previous episodes that we've been talking about the pipeline.

B

We're running a console app that's going to connect to storage.

B

That's going to list a bunch of blobs and find ones which need to be cleaned up and delete. Them.

B

Got it. so here we can see I've authenticated on my machine,.

B

And I was able to run the sample and just using this default azure credential.

B

cool., so I'm assuming that is.

A

Using a particular flow as it's authenticated, right?.

A

So what types of different flows are available inside of this library?.

B

So let me talk a little bit about what.

B

The default azure credential flow.

B

Is first and then towards the end,, we can talk about what all the different mechanisms that we have that are available as well. yeah., so the default azure credential, as I said, it- is an actual flow of authentication.

B

So we're going to try a bunch of different mechanisms in order to authenticate.

B

The first thing that we're going to probe is the environment, specifically for environment variables that I have set with my credential information..

B

This will work in any environment., whether I'm on my dev machine or I'm actually on a deployed azure resource,.

B

I can set these environment variables in order to authenticate.

B

The next thing that we're going to look for is the managed identity.. So this is,, if I'm in a hosted, azure environment,.

B

We have something called msi or managed service identity.

B

That is where I have a resource which I've assigned it an identity t.. I can then grant that identity access to things like my blob storage account or my key vault,, and then I can use that identity in order to interact with those things.

A

That's for folks that are working with on-premise systems.

A

That's like me: creating a service account.

A

exactly. like an account, that's not associated with a person, but it just an identity that I signed to worker services. To my database,.

A

Whatever the case is, so that there's some credential that I could use it with.

A

That's right, exactly.

B

The next thing that we're going to look for is a place called the shared token cache,, and this enables our single sign-on scenarios,.

B

Like I showed with vs. so vs, currently we have enabled the.

B

Single sign-on flow with your debugging experience,.

B

And we'll be adding other other applications to this platform as well, such as powershell,, the cli and vs code, as well.

B

Then finally, if we haven't been able to authenticate through any of those means,, we actually have an interactive browser credential,, where we can actually pop a browser for the user to log.

B

In and then use those credentials in order to run the application.

B

Then that is actually saved back to our shared token cache, so it can be used for the single sign-on. So, as I run my app over and over again,, I don't have to continually sign. In. got you. okay.. Now what I wanted to.

A

Ask you about is, I know in the past, we've had adal,.

A

And I think adal has now been sunsetted for msal,.

A

The microsoft's authentication library., how does this azure identity library relates to msal and adal?.

A

Sure. so azure identity.

B

Has parts of which are built on top of msal., so we're not trying to replace that technology. we're actually extending it so that we can use its abilities in the context of actually developing azure applications.

B

Since we're built on top of msal,, we want to limit the dependency graph that you might get into.

B

Trouble where I have a particular version of msal that I depend on,.

B

And I need to load azure identity.

B

So what we've actually done is we made it? So none of our libraries have a direct dependency on azure identity.

B

So we have a base obstruction which they depend. On.

B

So the users free to choose any version of azure identity which meets their needs and hence any version of msal if they want to use that in their application as well.

B

okay, cool.. So that just makes.

A

The dependency management on my side a little bit less daunting., exactly. right.. So now what I want to show you is.

B

Actually that same demo that I just ran,, I want to actually run it in the cloud now.

B

okay.. I have the exact same code..

B

So what I've done is I've created a vm in azure..

B

This is actually an ubuntu 18 vm.

B

I've assigned it an identity here, as you can see.

B

So the system was assigned identity, and I've, given that identity access to our storage account so that our sample can run.

B

okay.. So here I have ssh into the vm,.

B

And what I'm going to do is I'm going to clone our sample repo,.

B

And I'm just going to run from there. okay.. What I love about this is is.

A

The fact that you're doing this on linux, machine.

A

That's correct. right., so it shows how flexible our apis are.

A

And how so we're thinking about just inter-operating with different operating system.

A

so once you're on azure,, it really doesn't matter. it shouldn't matter.. Exactly and.net is.

B

Available to us on linux and on mac and on windows,.

B

And we want to make sure that our identity story and our sdk story is available on all those things,, the seamless integration..

B

So here I've cloned the repo, and I've actually navigated to where our demo is.

B

I'm going to run the same garbage collector demo that I showed before..

B

So all I have to do from here is: I haven't, authenticated or done any special magic.

B

I just went into the vm, pulled down the code, and I ran.net run, and there we go. so tell me what's different now, because before,.

A

You were inside of visual studio,. You authenticated in visual studio,. You did the toll, 2fa dance, thing,, clicked "accept" on your phone,, but now I'm guessing it's doing something: different, right?! So what's the difference?.

B

So, as I showed you that flow before,, what we do is we actually check the environment for environment variables. Set. then we're going to check to see if there's a managed identity, endpoint available.

B

In this particular case,, because we have created a vm, which has the managed identity,, we have an endpoint available that our sdk is hitting, and it's actually getting a token from there..

B

So it's using the identity of this vm in order to run the sample.

B

Versus when we're in our development environment, since we didn't have that available, we skip to the next portion of the chain which was single sign-on., then we discovered that we had actually authenticated through vs, and we use that identity to run this sample.

A

Right. so using the default credential provider,, it's not only just the fact that it has a lot of these different authentication flows inside of it,, but it's also order of precedence..

A

You got to check in particular one first and second and third, and there's an order in which it's going to look for these credentials.. So whoever is in the front of the chain, wins essentially.

B

That's right, and it's also configurable as well., so I can create my own chains.. I can dictate what the flow of authentication should be.

B

I can even with the default azure credential use settings to actually turn off portions of that chain..

B

So for instance,. If want to have this machine,, I don't want the interactive browser credential to run., so I can actually disable that without actually using a different type of credential.

B

Cool, awesome., thank you so much, man.

B

is there anything else. You want to show us about identity?.

A

So I quickly wanted to show you.

B

The different mechanisms that we actually have available because you brought that up before.

B

As you can see,, we have different mechanisms not only to authenticate a service principle,.

B

As you said,, it's like a service account that runs in azure, also to authenticate users.

B

So if I'm on a line of business app on my cell phone,, I have mechanisms to do that and also mixed modes of authentication, such as our default azure credential,, where we want to go between user authentication and service principle. Authentication.

B

Got you. got you., so I have the ability to authenticate a user,.

A

But I can also authenticate a process,.

A

A non carbon-based, entity?, exactly. okay. cool. awesome. well, hey,. Thank you so much for coming on the show, man.. This is a lot of great information.

A

I'll make sure to it that we put a link to that demo that you showed, because I'm sure tons of folks are going to want to try that out and be like, "hey,. Does this thing really work.? Can I just clone it and run it?? I know it's almost unbelievable.

B

So I want people to try for it sure, because I feel like they'll, really be happy with authentications, that we've created.

A

Great., all these libraries are available today., again for.net, they're, available on newer.org, and then we could just search for azure identity, and then we should be able to install it inside of our applications..

A

I know that there's.net standard, 2.0, compliant, right?.

B

A

So we could use a lot of the cool new features like c#,.

A

A week for each and as synchronal rubles and all those other features that are coming up., yeah. awesome.. I want to thank you again for coming on the show.. We really appreciate it. thanks for having me.. Thank you all for watching.. This has been another episode of on.net show, and we learned about the azure identity. Library,, a new sdk, that's available for you to try it on your applications. Today.