|
1 | 1 | ---
|
2 |
| -title: Credential chains in the Azure Identity client library for Go |
3 |
| -description: This article describes the DefaultAzureCredential and ChainedTokenCredential classes in the Azure Identity client library for Go. |
4 |
| -ms.date: 12/13/2024 |
| 2 | +title: Credential chains in the Azure Identity library for Go |
| 3 | +description: This article describes the DefaultAzureCredential and ChainedTokenCredential classes in the Azure Identity library for Go. |
| 4 | +ms.date: 03/10/2025 |
5 | 5 | ms.topic: conceptual
|
6 | 6 | ms.custom: devx-track-go
|
7 | 7 | ---
|
8 | 8 |
|
9 |
| -# Credential chains in the Azure Identity client library for Go |
| 9 | +# Credential chains in the Azure Identity library for Go |
10 | 10 |
|
11 |
| -The Azure Identity client library provides *credentials*—public types that implement the Azure Core library's [TokenCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azcore#TokenCredential) interface. A credential represents a distinct authentication flow for acquiring an access token from Microsoft Entra ID. These credentials can be chained together to form an ordered sequence of authentication mechanisms to be attempted. |
| 11 | +The Azure Identity library provides *credentials*—public types that implement the Azure Core library's [TokenCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azcore#TokenCredential) interface. A credential represents a distinct authentication flow for acquiring an access token from Microsoft Entra ID. These credentials can be chained together to form an ordered sequence of authentication mechanisms to be attempted. |
12 | 12 |
|
13 | 13 | ## How a chained credential works
|
14 | 14 |
|
@@ -102,35 +102,32 @@ if err != nil {
|
102 | 102 | [ChainedTokenCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#ChainedTokenCredential) is an empty chain to which you add credentials to suit your app's needs. For example:
|
103 | 103 |
|
104 | 104 | ```go
|
105 |
| -managed, err := azidentity.NewManagedIdentityCredential(nil) |
| 105 | +azCLI, err := azidentity.NewAzureCLICredential(nil) |
106 | 106 | if err != nil {
|
107 | 107 | // handle error
|
108 | 108 | }
|
109 | 109 |
|
110 |
| -azCLI, err := azidentity.NewAzureCLICredential(nil) |
| 110 | +azdCLI, err := azidentity.NewAzureDeveloperCLICredential(nil) |
111 | 111 | if err != nil {
|
112 | 112 | // handle error
|
113 | 113 | }
|
114 | 114 |
|
115 |
| -chain, err := azidentity.NewChainedTokenCredential([]azcore.TokenCredential{managed, azCLI}, nil) |
| 115 | +chain, err := azidentity.NewChainedTokenCredential([]azcore.TokenCredential{azCLI, azdCLI}, nil) |
116 | 116 | if err != nil {
|
117 | 117 | // handle error
|
118 | 118 | }
|
119 | 119 | ```
|
120 | 120 |
|
121 |
| -The preceding code sample creates a tailored credential chain comprised of two credentials. `ManagedIdentityCredential` is attempted first, followed by `AzureCliCredential`, if necessary. In graphical form, the chain looks like this: |
| 121 | +The preceding code sample creates a tailored credential chain comprised of two credentials. `AzureCLICredential` is attempted first, followed by `AzureDeveloperCLICredential`, if necessary. In graphical form, the chain looks like this: |
122 | 122 |
|
123 |
| -:::image type="content" source="../media/mermaidjs/chained-token-credential-auth-flow.svg" alt-text="Diagram that shows authentication flow for a ChainedTokenCredential instance that is composed of managed identity credential and Azure CLI credential."::: |
| 123 | +:::image type="content" source="../media/mermaidjs/chained-token-credential-auth-flow.svg" alt-text="Diagram that shows authentication flow for a ChainedTokenCredential instance that is composed of Azure CLI and Azure Developer CLI credentials."::: |
124 | 124 |
|
125 | 125 | > [!TIP]
|
126 |
| -> For improved performance, optimize credential ordering in `ChainedTokenCredential` for your production environment. Credentials intended for use in the local development environment should be added last. |
| 126 | +> For improved performance, optimize credential ordering in `ChainedTokenCredential` from most to least used credential. |
127 | 127 |
|
128 | 128 | ## Usage guidance for DefaultAzureCredential
|
129 | 129 |
|
130 |
| -`DefaultAzureCredential` is undoubtedly the easiest way to get started with the Azure Identity client library, but with that convenience comes tradeoffs. Once you deploy your app to Azure, you should understand the app's authentication requirements. For that reason, strongly consider moving from `DefaultAzureCredential` to one of the following solutions: |
131 |
| -
|
132 |
| -- A specific credential implementation, such as `ManagedIdentityCredential`. |
133 |
| -- A pared-down `ChainedTokenCredential` implementation optimized for the Azure environment in which your app runs. |
| 130 | +`DefaultAzureCredential` is undoubtedly the easiest way to get started with the Azure Identity library, but with that convenience comes tradeoffs. Once you deploy your app to Azure, you should understand the app's authentication requirements. For that reason, replace `DefaultAzureCredential` with a specific `TokenCredential` implementation, such as `ManagedIdentityCredential`. |
134 | 131 |
|
135 | 132 | Here's why:
|
136 | 133 |
|
|
0 commit comments