identity_vscode_credential

sdk/identity/azure-identity/azure/identity/_constants.py

@@ -5,7 +5,9 @@
 
 
 AZURE_CLI_CLIENT_ID = "04b07795-8ddb-461a-bbee-02f9e1bf7b46"
-
+AZURE_VSCODE_CLIENT_ID = "aebc6443-996d-45c2-90f0-388ff96faa56"
+AZURE_VSCODE_TENANT_ID = "organizations"
+VSCODE_CREDENTIALS_SECTION = "VS Code Azure"
 
 class KnownAuthorities:
     AZURE_CHINA = "login.chinacloudapi.cn"

sdk/identity/azure-identity/azure/identity/_credentials/win_vscode_credential.py

@@ -0,0 +1,73 @@
+# ------------------------------------
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+# ------------------------------------
+import os
+import json
+from azure.core.exceptions import ClientAuthenticationError
+from .._constants import (
+    VSCODE_CREDENTIALS_SECTION,
+    AZURE_VSCODE_CLIENT_ID,
+    AZURE_VSCODE_TENANT_ID,
+)
+from .._internal.aad_client import AadClient
+try:
+    from win32cred import CredRead
+except ImportError: # pylint:disable=try-except-raise
+    raise
+
+def _read_credential(service_name, account_name):
+    target = u"{}/{}".format(service_name, account_name)
+    res = CredRead(TargetName=target, Type=0x1)
+    cred = res["CredentialBlob"].decode('utf-16')
+    return cred
+
+def _get_user_settings_path():
+    app_data_folder = os.environ['APPDATA']
+    return os.path.join(app_data_folder, "Code", "User", "settings.json")
+
+def _get_user_settings():
+    path = _get_user_settings_path()
+    try:
+        with open(path) as file:
+            data = json.load(file)
+            environment_name = data.get("azure.cloud", "Azure")
+            return environment_name
+    except IOError:
+        return "Azure"
+
+class WinVSCodeCredential(object):
+    """Authenticates by redeeming a refresh token previously saved by VS Code
+
+        :keyword str tenant_id: ID of the application's Azure Active Directory tenant. Also called its 'directory' ID.
+        :keyword str client_id: the application's client ID
+
+        """
+    def __init__(self, **kwargs):
+        client_id = kwargs.pop("client_id", AZURE_VSCODE_CLIENT_ID)
+        tenant_id = kwargs.pop("tenant_id", AZURE_VSCODE_TENANT_ID)
+        self._client = AadClient(tenant_id, client_id, **kwargs)
+
+    def get_token(self, *scopes, **kwargs):
+        # type: (*str, **Any) -> AccessToken
+        """Request an access token for `scopes`.
+
+        .. note:: This method is called by Azure SDK clients. It isn't intended for use in application code.
+
+        When this method is called, the credential will try to get the refresh token saved by VS Code. If a refresh
+        token can be found, it will redeem the refresh token for an access token and return the access token.
+
+        :param str scopes: desired scopes for the access token. This method requires at least one scope.
+        :rtype: :class:`azure.core.credentials.AccessToken`
+        :raises ~azure.core.exceptions.ClientAuthenticationError: authentication failed. The error's ``message``
+          attribute gives a reason. Any error response from Azure Active Directory is available as the error's
+          ``response`` attribute.
+        """
+        environment_name = _get_user_settings()
+        refresh_token = _read_credential(VSCODE_CREDENTIALS_SECTION, environment_name)
+        if not refresh_token:
+            raise ClientAuthenticationError(
+                message="No token available."
+            )
+        token = self._client.obtain_token_by_refresh_token(refresh_token, scopes, **kwargs)
+        return token

sdk/identity/azure-identity/setup.py

@@ -76,6 +76,7 @@
         "msal<2.0.0,>=1.0.0",
         "msal-extensions~=0.1.3",
         "six>=1.6",
+        "pywin32;platform_system=='Windows'",
     ],
     extras_require={
         ":python_version<'3.0'": ["azure-nspkg"],

sdk/identity/azure-identity/tests/test_win_vscode_credential.py

@@ -0,0 +1,27 @@
+# ------------------------------------
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+# ------------------------------------
+import sys
+import pytest
+if sys.platform.startswith('win'):
+    from azure.identity._credentials.win_vscode_credential import _read_credential
+    import win32cred
+
+@pytest.mark.skipif(not sys.platform.startswith('win'), reason="This test only runs on Windows")
+def test_win_vscode_credential():
+    service_name = u"VS Code Azure"
+    account_name = u"Azure"
+    target = u"{}/{}".format(service_name, account_name)
+    comment = u"comment"
+    token_written = u"test_refresh_token"
+    user_name = u"Azure"
+    credential = {"Type": 0x1,
+                   "TargetName": target,
+                   "UserName": user_name,
+                   "CredentialBlob": token_written,
+                   "Comment": comment,
+                   "Persist": 0x2}
+    win32cred.CredWrite(credential)
+    token_read = _read_credential(service_name, account_name)
+    assert token_read == token_written

shared_requirements.txt

@@ -107,6 +107,7 @@ aiohttp>=3.0
 aiodns>=2.0
 python-dateutil>=2.8.0
 six>=1.6
+pywin32;platform_system=='Windows'
 #override azure azure-keyvault~=1.0
 #override azure-mgmt-core azure-core<2.0.0,>=1.4.0
 #override azure-appconfiguration azure-core<2.0.0,>=1.0.0