Skip to content

Commit 0ecb0fc

Browse files
committed
Update DefaultAzureCredential usage guidelines for Go
1 parent fbf6031 commit 0ecb0fc

File tree

3 files changed

+15
-19
lines changed

3 files changed

+15
-19
lines changed

articles/go/sdk/authentication/credential-chains.md

+12-15
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
---
2-
title: Credential chains in the Azure Identity client library for Go
3-
description: This article describes the DefaultAzureCredential and ChainedTokenCredential classes in the Azure Identity client library for Go.
4-
ms.date: 12/13/2024
2+
title: Credential chains in the Azure Identity library for Go
3+
description: This article describes the DefaultAzureCredential and ChainedTokenCredential classes in the Azure Identity library for Go.
4+
ms.date: 03/10/2025
55
ms.topic: conceptual
66
ms.custom: devx-track-go
77
---
88

9-
# Credential chains in the Azure Identity client library for Go
9+
# Credential chains in the Azure Identity library for Go
1010

11-
The Azure Identity client library provides *credentials*—public types that implement the Azure Core library's [TokenCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azcore#TokenCredential) interface. A credential represents a distinct authentication flow for acquiring an access token from Microsoft Entra ID. These credentials can be chained together to form an ordered sequence of authentication mechanisms to be attempted.
11+
The Azure Identity library provides *credentials*—public types that implement the Azure Core library's [TokenCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azcore#TokenCredential) interface. A credential represents a distinct authentication flow for acquiring an access token from Microsoft Entra ID. These credentials can be chained together to form an ordered sequence of authentication mechanisms to be attempted.
1212

1313
## How a chained credential works
1414

@@ -102,35 +102,32 @@ if err != nil {
102102
[ChainedTokenCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#ChainedTokenCredential) is an empty chain to which you add credentials to suit your app's needs. For example:
103103

104104
```go
105-
managed, err := azidentity.NewManagedIdentityCredential(nil)
105+
azCLI, err := azidentity.NewAzureCLICredential(nil)
106106
if err != nil {
107107
// handle error
108108
}
109109
110-
azCLI, err := azidentity.NewAzureCLICredential(nil)
110+
azdCLI, err := azidentity.NewAzureDeveloperCLICredential(nil)
111111
if err != nil {
112112
// handle error
113113
}
114114
115-
chain, err := azidentity.NewChainedTokenCredential([]azcore.TokenCredential{managed, azCLI}, nil)
115+
chain, err := azidentity.NewChainedTokenCredential([]azcore.TokenCredential{azCLI, azdCLI}, nil)
116116
if err != nil {
117117
// handle error
118118
}
119119
```
120120

121-
The preceding code sample creates a tailored credential chain comprised of two credentials. `ManagedIdentityCredential` is attempted first, followed by `AzureCliCredential`, if necessary. In graphical form, the chain looks like this:
121+
The preceding code sample creates a tailored credential chain comprised of two credentials. `AzureCLICredential` is attempted first, followed by `AzureDeveloperCLICredential`, if necessary. In graphical form, the chain looks like this:
122122

123-
:::image type="content" source="../media/mermaidjs/chained-token-credential-auth-flow.svg" alt-text="Diagram that shows authentication flow for a ChainedTokenCredential instance that is composed of managed identity credential and Azure CLI credential.":::
123+
:::image type="content" source="../media/mermaidjs/chained-token-credential-auth-flow.svg" alt-text="Diagram that shows authentication flow for a ChainedTokenCredential instance that is composed of Azure CLI and Azure Developer CLI credentials.":::
124124

125125
> [!TIP]
126-
> For improved performance, optimize credential ordering in `ChainedTokenCredential` for your production environment. Credentials intended for use in the local development environment should be added last.
126+
> For improved performance, optimize credential ordering in `ChainedTokenCredential` from most to least used credential.
127127

128128
## Usage guidance for DefaultAzureCredential
129129

130-
`DefaultAzureCredential` is undoubtedly the easiest way to get started with the Azure Identity client library, but with that convenience comes tradeoffs. Once you deploy your app to Azure, you should understand the app's authentication requirements. For that reason, strongly consider moving from `DefaultAzureCredential` to one of the following solutions:
131-
132-
- A specific credential implementation, such as `ManagedIdentityCredential`.
133-
- A pared-down `ChainedTokenCredential` implementation optimized for the Azure environment in which your app runs.
130+
`DefaultAzureCredential` is undoubtedly the easiest way to get started with the Azure Identity library, but with that convenience comes tradeoffs. Once you deploy your app to Azure, you should understand the app's authentication requirements. For that reason, replace `DefaultAzureCredential` with a specific `TokenCredential` implementation, such as `ManagedIdentityCredential`.
134131
135132
Here's why:
136133

articles/go/sdk/includes/mermaidjs/chained-token-credential-auth-flow.md

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
ms.topic: include
3-
ms.date: 12/13/2024
3+
ms.date: 03/10/2025
44
---
55

66
```mermaid
@@ -21,9 +21,8 @@ ms.date: 12/13/2024
2121
}%%
2222
2323
flowchart LR;
24-
C(Managed Identity):::deployed --> D(Azure CLI):::developer;
24+
D(Azure CLI):::developer --> E(Azure Developer CLI):::developer;
2525
2626
%% Define styles for credential type boxes
27-
classDef deployed fill:#95C37E, stroke:#71AD4C, stroke-width:2px;
2827
classDef developer fill:#F5AF6F, stroke:#EB7C39, stroke-width:2px;
2928
```
Loading

0 commit comments

Comments
 (0)