Test and doc updates

Signed-off-by: Paul Van Eck <[email protected]>

Author: pvaneck

sdk/identity/azure-identity/CHANGELOG.md

@@ -5,7 +5,7 @@
 ### Features Added
 
 - Expanded the set of acceptable values for environment variable `AZURE_TOKEN_CREDENTIALS` to allow for selection of a specific credential in the `DefaultAzureCredential` chain. At runtime, only the specified credential will be used when acquiring tokens with `DefaultAzureCredential`. For example, setting `AZURE_TOKEN_CREDENTIALS=WorkloadIdentityCredential` will make `DefaultAzureCredential` use only `WorkloadIdentityCredential`.
-  - Valid values are `EnvironmentCredential`, `WorkloadIdentityCredential`, `ManagedIdentityCredential`,  `AzureCliCredential`, `AzurePowershellCredential`, `AzureDeveloperCliCredential`, and `InteractiveBrowserCredential`. ([#41709](https://github.com/Azure/azure-sdk-for-python/pull/41709))
+  - Valid values are `EnvironmentCredential`, `WorkloadIdentityCredential`, `ManagedIdentityCredential`, `AzureCliCredential`, `AzurePowershellCredential`, `AzureDeveloperCliCredential`, and `InteractiveBrowserCredential`. ([#41709](https://github.com/Azure/azure-sdk-for-python/pull/41709))
 
 ### Breaking Changes
 

sdk/identity/azure-identity/README.md

@@ -297,31 +297,6 @@ variables:
 
 Configuration is attempted in the preceding order. For example, if values for a client secret and certificate are both present, the client secret is used.
 
-### Configuring DefaultAzureCredential
-
-`DefaultAzureCredential` supports an additional environment variable to customize its behavior:
-
-|Variable name|Value
-|-|-
-|`AZURE_TOKEN_CREDENTIALS`|Credential name or group
-
-#### AZURE_TOKEN_CREDENTIALS values
-
-You can set `AZURE_TOKEN_CREDENTIALS` to one of the following values to control which credentials `DefaultAzureCredential` attempts to use:
-
-**Individual Credentials:**
-- `EnvironmentCredential` - Only use environment variables for service principal authentication
-- `WorkloadIdentityCredential` - Only use workload identity for Kubernetes authentication
-- `ManagedIdentityCredential` - Only use managed identity authentication
-- `AzureCliCredential` - Only use Azure CLI authentication
-- `AzurePowerShellCredential` - Only use Azure PowerShell authentication
-- `AzureDeveloperCliCredential` - Only use Azure Developer CLI authentication
-- `InteractiveBrowserCredential` - Only use interactive browser authentication
-
-**Credential Groups:**
-- `prod` - Use deployed service credentials: `EnvironmentCredential`, `WorkloadIdentityCredential`, and `ManagedIdentityCredential`
-- `dev` - Use developer credentials: `SharedTokenCacheCredential`, `AzureCliCredential`, `AzurePowerShellCredential`, and `AzureDeveloperCliCredential`
-
 ## Continuous Access Evaluation
 
 As of version 1.14.0, accessing resources protected by [Continuous Access Evaluation (CAE)][cae] is possible on a per-request basis. This behavior can be enabled by setting the `enable_cae` keyword argument to `True` in the credential's `get_token` method. CAE isn't supported for developer and managed identity credentials.

sdk/identity/azure-identity/tests/test_token_credentials_env.py

@@ -29,7 +29,7 @@ def test_token_credentials_env_dev():
         credential = DefaultAzureCredential()
 
         # Get the actual credential classes in the chain
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # All dev credentials should be present (if supported)
         if SharedTokenCacheCredential.supported():
@@ -40,6 +40,9 @@ def test_token_credentials_env_dev():
         assert AzureDeveloperCliCredential in actual_classes
         assert AzurePowerShellCredential in actual_classes
 
+        # Assert no duplicates
+        assert len(actual_classes) == len(set(actual_classes))
+
         # Production credentials should NOT be present
         for cred_class in prod_credentials:
             if cred_class == WorkloadIdentityCredential:
@@ -60,18 +63,10 @@ def test_token_credentials_env_prod():
     }
 
     with patch.dict("os.environ", {EnvironmentVariables.AZURE_TOKEN_CREDENTIALS: "prod"}, clear=False):
-        # Print to verify the environment variable is set in the test
-        print(f"AZURE_TOKEN_CREDENTIALS={os.environ.get(EnvironmentVariables.AZURE_TOKEN_CREDENTIALS)}")
-
         credential = DefaultAzureCredential()
 
         # Get the actual credential classes in the chain
-        actual_classes = {c.__class__ for c in credential.credentials}
-
-        # Print which credentials are actually in the chain
-        print("Credentials in chain:")
-        for cls in actual_classes:
-            print(f" - {cls.__name__}")
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # Production credentials should be present
         assert EnvironmentCredential in actual_classes
@@ -81,6 +76,9 @@ def test_token_credentials_env_prod():
         if all(os.environ.get(var) for var in EnvironmentVariables.WORKLOAD_IDENTITY_VARS):
             assert WorkloadIdentityCredential in actual_classes
 
+        # Assert no duplicates
+        assert len(actual_classes) == len(set(actual_classes))
+
         # Developer credentials should NOT be present
         for cred_class in dev_credentials:
             assert cred_class not in actual_classes
@@ -93,7 +91,7 @@ def test_token_credentials_env_case_insensitive():
         credential = DefaultAzureCredential()
 
         # Get the actual credential classes in the chain
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # EnvironmentCredential (prod) should not be present
         assert EnvironmentCredential not in actual_classes
@@ -113,7 +111,7 @@ def test_token_credentials_env_invalid():
 def test_token_credentials_env_with_exclude():
     with patch.dict("os.environ", {EnvironmentVariables.AZURE_TOKEN_CREDENTIALS: "prod"}, clear=False):
         credential = DefaultAzureCredential(exclude_environment_credential=True)
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         assert EnvironmentCredential not in actual_classes
 
@@ -135,17 +133,12 @@ def test_token_credentials_env_workload_identity_credential():
         credential = DefaultAzureCredential()
 
         # Get the actual credential classes in the chain
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # Only WorkloadIdentityCredential should be present
         assert WorkloadIdentityCredential in actual_classes
         assert len(actual_classes) == 1
 
-        # Verify other credentials are not present
-        assert EnvironmentCredential not in actual_classes
-        assert ManagedIdentityCredential not in actual_classes
-        assert AzureCliCredential not in actual_classes
-
 
 def test_token_credentials_env_environment_credential():
     """With AZURE_TOKEN_CREDENTIALS=EnvironmentCredential, only EnvironmentCredential should be used"""
@@ -154,17 +147,12 @@ def test_token_credentials_env_environment_credential():
         credential = DefaultAzureCredential()
 
         # Get the actual credential classes in the chain
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # Only EnvironmentCredential should be present
         assert EnvironmentCredential in actual_classes
         assert len(actual_classes) == 1
 
-        # Verify other credentials are not present
-        assert WorkloadIdentityCredential not in actual_classes
-        assert ManagedIdentityCredential not in actual_classes
-        assert AzureCliCredential not in actual_classes
-
 
 def test_token_credentials_env_managed_identity_credential():
     """With AZURE_TOKEN_CREDENTIALS=ManagedIdentityCredential, only ManagedIdentityCredential should be used"""
@@ -175,17 +163,12 @@ def test_token_credentials_env_managed_identity_credential():
         credential = DefaultAzureCredential()
 
         # Get the actual credential classes in the chain
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # Only ManagedIdentityCredential should be present
         assert ManagedIdentityCredential in actual_classes
         assert len(actual_classes) == 1
 
-        # Verify other credentials are not present
-        assert EnvironmentCredential not in actual_classes
-        assert WorkloadIdentityCredential not in actual_classes
-        assert AzureCliCredential not in actual_classes
-
 
 def test_token_credentials_env_azure_cli_credential():
     """With AZURE_TOKEN_CREDENTIALS=AzureCliCredential, only AzureCliCredential should be used"""
@@ -194,17 +177,12 @@ def test_token_credentials_env_azure_cli_credential():
         credential = DefaultAzureCredential()
 
         # Get the actual credential classes in the chain
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # Only AzureCliCredential should be present
         assert AzureCliCredential in actual_classes
         assert len(actual_classes) == 1
 
-        # Verify other credentials are not present
-        assert EnvironmentCredential not in actual_classes
-        assert ManagedIdentityCredential not in actual_classes
-        assert WorkloadIdentityCredential not in actual_classes
-
 
 def test_token_credentials_env_specific_credential_case_insensitive():
     """Specific credential names should be case insensitive"""
@@ -213,7 +191,7 @@ def test_token_credentials_env_specific_credential_case_insensitive():
         credential = DefaultAzureCredential()
 
         # Get the actual credential classes in the chain
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # Only EnvironmentCredential should be present
         assert EnvironmentCredential in actual_classes
@@ -255,7 +233,7 @@ def test_user_exclude_flags_override_env_var():
     # Test case 2: env var says use specific credential, user includes additional credential
     with patch.dict("os.environ", {EnvironmentVariables.AZURE_TOKEN_CREDENTIALS: "environmentcredential"}, clear=False):
         credential = DefaultAzureCredential(exclude_powershell_credential=False)
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # Both EnvironmentCredential and AzurePowerShellCredential should be present
         assert EnvironmentCredential in actual_classes
@@ -264,7 +242,7 @@ def test_user_exclude_flags_override_env_var():
     # Test case 3: env var says "dev" mode, user excludes a dev credential
     with patch.dict("os.environ", {EnvironmentVariables.AZURE_TOKEN_CREDENTIALS: "dev"}, clear=False):
         credential = DefaultAzureCredential(exclude_cli_credential=True)
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # AzureCliCredential should NOT be present despite "dev" mode
         assert AzureCliCredential not in actual_classes

sdk/identity/azure-identity/tests/test_token_credentials_env_async.py

@@ -29,7 +29,7 @@ def test_token_credentials_env_dev():
         credential = DefaultAzureCredential()
 
         # Get the actual credential classes in the chain
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # All dev credentials should be present (if supported)
         if SharedTokenCacheCredential.supported():
@@ -40,6 +40,9 @@ def test_token_credentials_env_dev():
         assert AzureDeveloperCliCredential in actual_classes
         assert AzurePowerShellCredential in actual_classes
 
+        # Assert no duplicates
+        assert len(actual_classes) == len(set(actual_classes))
+
         # Production credentials should NOT be present
         for cred_class in prod_credentials:
             if cred_class == WorkloadIdentityCredential:
@@ -60,18 +63,10 @@ def test_token_credentials_env_prod():
     }
 
     with patch.dict("os.environ", {EnvironmentVariables.AZURE_TOKEN_CREDENTIALS: "prod"}, clear=False):
-        # Print to verify the environment variable is set in the test
-        print(f"AZURE_TOKEN_CREDENTIALS={os.environ.get(EnvironmentVariables.AZURE_TOKEN_CREDENTIALS)}")
-
         credential = DefaultAzureCredential()
 
         # Get the actual credential classes in the chain
-        actual_classes = {c.__class__ for c in credential.credentials}
-
-        # Print which credentials are actually in the chain
-        print("Credentials in chain:")
-        for cls in actual_classes:
-            print(f" - {cls.__name__}")
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # Production credentials should be present
         assert EnvironmentCredential in actual_classes
@@ -81,6 +76,9 @@ def test_token_credentials_env_prod():
         if all(os.environ.get(var) for var in EnvironmentVariables.WORKLOAD_IDENTITY_VARS):
             assert WorkloadIdentityCredential in actual_classes
 
+        # Assert no duplicates
+        assert len(actual_classes) == len(set(actual_classes))
+
         # Developer credentials should NOT be present
         for cred_class in dev_credentials:
             assert cred_class not in actual_classes
@@ -93,7 +91,7 @@ def test_token_credentials_env_case_insensitive():
         credential = DefaultAzureCredential()
 
         # Get the actual credential classes in the chain
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # EnvironmentCredential (prod) should not be present
         assert EnvironmentCredential not in actual_classes
@@ -113,7 +111,7 @@ def test_token_credentials_env_invalid():
 def test_token_credentials_env_with_exclude():
     with patch.dict("os.environ", {EnvironmentVariables.AZURE_TOKEN_CREDENTIALS: "prod"}, clear=False):
         credential = DefaultAzureCredential(exclude_environment_credential=True)
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         assert EnvironmentCredential not in actual_classes
 
@@ -135,17 +133,12 @@ def test_token_credentials_env_workload_identity_credential():
         credential = DefaultAzureCredential()
 
         # Get the actual credential classes in the chain
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # Only WorkloadIdentityCredential should be present
         assert WorkloadIdentityCredential in actual_classes
         assert len(actual_classes) == 1
 
-        # Verify other credentials are not present
-        assert EnvironmentCredential not in actual_classes
-        assert ManagedIdentityCredential not in actual_classes
-        assert AzureCliCredential not in actual_classes
-
 
 def test_token_credentials_env_environment_credential():
     """With AZURE_TOKEN_CREDENTIALS=EnvironmentCredential, only EnvironmentCredential should be used"""
@@ -154,17 +147,12 @@ def test_token_credentials_env_environment_credential():
         credential = DefaultAzureCredential()
 
         # Get the actual credential classes in the chain
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # Only EnvironmentCredential should be present
         assert EnvironmentCredential in actual_classes
         assert len(actual_classes) == 1
 
-        # Verify other credentials are not present
-        assert WorkloadIdentityCredential not in actual_classes
-        assert ManagedIdentityCredential not in actual_classes
-        assert AzureCliCredential not in actual_classes
-
 
 def test_token_credentials_env_managed_identity_credential():
     """With AZURE_TOKEN_CREDENTIALS=ManagedIdentityCredential, only ManagedIdentityCredential should be used"""
@@ -175,17 +163,12 @@ def test_token_credentials_env_managed_identity_credential():
         credential = DefaultAzureCredential()
 
         # Get the actual credential classes in the chain
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # Only ManagedIdentityCredential should be present
         assert ManagedIdentityCredential in actual_classes
         assert len(actual_classes) == 1
 
-        # Verify other credentials are not present
-        assert EnvironmentCredential not in actual_classes
-        assert WorkloadIdentityCredential not in actual_classes
-        assert AzureCliCredential not in actual_classes
-
 
 def test_token_credentials_env_azure_cli_credential():
     """With AZURE_TOKEN_CREDENTIALS=AzureCliCredential, only AzureCliCredential should be used"""
@@ -194,17 +177,12 @@ def test_token_credentials_env_azure_cli_credential():
         credential = DefaultAzureCredential()
 
         # Get the actual credential classes in the chain
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # Only AzureCliCredential should be present
         assert AzureCliCredential in actual_classes
         assert len(actual_classes) == 1
 
-        # Verify other credentials are not present
-        assert EnvironmentCredential not in actual_classes
-        assert ManagedIdentityCredential not in actual_classes
-        assert WorkloadIdentityCredential not in actual_classes
-
 
 def test_token_credentials_env_specific_credential_case_insensitive():
     """Specific credential names should be case insensitive"""
@@ -213,7 +191,7 @@ def test_token_credentials_env_specific_credential_case_insensitive():
         credential = DefaultAzureCredential()
 
         # Get the actual credential classes in the chain
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # Only EnvironmentCredential should be present
         assert EnvironmentCredential in actual_classes
@@ -255,7 +233,7 @@ def test_user_exclude_flags_override_env_var():
     # Test case 2: env var says use specific credential, user includes additional credential
     with patch.dict("os.environ", {EnvironmentVariables.AZURE_TOKEN_CREDENTIALS: "environmentcredential"}, clear=False):
         credential = DefaultAzureCredential(exclude_powershell_credential=False)
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # Both EnvironmentCredential and AzurePowerShellCredential should be present
         assert EnvironmentCredential in actual_classes
@@ -264,7 +242,7 @@ def test_user_exclude_flags_override_env_var():
     # Test case 3: env var says "dev" mode, user excludes a dev credential
     with patch.dict("os.environ", {EnvironmentVariables.AZURE_TOKEN_CREDENTIALS: "dev"}, clear=False):
         credential = DefaultAzureCredential(exclude_cli_credential=True)
-        actual_classes = {c.__class__ for c in credential.credentials}
+        actual_classes = [c.__class__ for c in credential.credentials]
 
         # AzureCliCredential should NOT be present despite "dev" mode
         assert AzureCliCredential not in actual_classes