1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
# ------------------------------------
# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.
# ------------------------------------
import os
from unittest.mock import patch
import pytest
from azure.identity import (
AzureCliCredential,
AzureDeveloperCliCredential,
AzurePowerShellCredential,
DefaultAzureCredential,
EnvironmentCredential,
ManagedIdentityCredential,
SharedTokenCacheCredential,
WorkloadIdentityCredential,
)
from azure.identity._constants import EnvironmentVariables
def test_token_credentials_env_dev():
"""With AZURE_TOKEN_CREDENTIALS=dev, DefaultAzureCredential should use only developer credentials"""
prod_credentials = {EnvironmentCredential, WorkloadIdentityCredential, ManagedIdentityCredential}
with patch.dict("os.environ", {EnvironmentVariables.AZURE_TOKEN_CREDENTIALS: "dev"}, clear=False):
credential = DefaultAzureCredential()
# Get the actual credential classes in the chain
actual_classes = {c.__class__ for c in credential.credentials}
# All dev credentials should be present (if supported)
if SharedTokenCacheCredential.supported():
assert SharedTokenCacheCredential in actual_classes
# Other developer credentials should be present
assert AzureCliCredential in actual_classes
assert AzureDeveloperCliCredential in actual_classes
assert AzurePowerShellCredential in actual_classes
# Production credentials should NOT be present
for cred_class in prod_credentials:
if cred_class == WorkloadIdentityCredential:
# Skip this check unless env vars are set
if not all(os.environ.get(var) for var in EnvironmentVariables.WORKLOAD_IDENTITY_VARS):
continue
assert cred_class not in actual_classes
def test_token_credentials_env_prod():
"""With AZURE_TOKEN_CREDENTIALS=prod, DefaultAzureCredential should use only production credentials"""
dev_credentials = {
SharedTokenCacheCredential,
AzureCliCredential,
AzureDeveloperCliCredential,
AzurePowerShellCredential,
}
with patch.dict("os.environ", {EnvironmentVariables.AZURE_TOKEN_CREDENTIALS: "prod"}, clear=False):
# Print to verify the environment variable is set in the test
print(f"AZURE_TOKEN_CREDENTIALS={os.environ.get(EnvironmentVariables.AZURE_TOKEN_CREDENTIALS)}")
credential = DefaultAzureCredential()
# Get the actual credential classes in the chain
actual_classes = {c.__class__ for c in credential.credentials}
# Print which credentials are actually in the chain
print("Credentials in chain:")
for cls in actual_classes:
print(f" - {cls.__name__}")
# Production credentials should be present
assert EnvironmentCredential in actual_classes
assert ManagedIdentityCredential in actual_classes
# Check WorkloadIdentityCredential only if env vars are set
if all(os.environ.get(var) for var in EnvironmentVariables.WORKLOAD_IDENTITY_VARS):
assert WorkloadIdentityCredential in actual_classes
# Developer credentials should NOT be present
for cred_class in dev_credentials:
assert cred_class not in actual_classes
def test_token_credentials_env_case_insensitive():
"""AZURE_TOKEN_CREDENTIALS should be case insensitive"""
with patch.dict("os.environ", {EnvironmentVariables.AZURE_TOKEN_CREDENTIALS: "DeV"}, clear=False):
credential = DefaultAzureCredential()
# Get the actual credential classes in the chain
actual_classes = {c.__class__ for c in credential.credentials}
# EnvironmentCredential (prod) should not be present
assert EnvironmentCredential not in actual_classes
# AzureCliCredential (dev) should be present
assert AzureCliCredential in actual_classes
def test_token_credentials_env_invalid():
"""Invalid AZURE_TOKEN_CREDENTIALS value should raise an error"""
with patch.dict("os.environ", {EnvironmentVariables.AZURE_TOKEN_CREDENTIALS: "invalid"}, clear=False):
with pytest.raises(ValueError):
credential = DefaultAzureCredential()
def test_token_credentials_env_with_exclude():
with patch.dict("os.environ", {EnvironmentVariables.AZURE_TOKEN_CREDENTIALS: "prod"}, clear=False):
credential = DefaultAzureCredential(exclude_environment_credential=True)
actual_classes = {c.__class__ for c in credential.credentials}
assert EnvironmentCredential not in actual_classes
|
