[Feature Request] Improve MSI support in Id.Web

[bgavrilMS]

This is a large feature consisting of several work items:

• Add direct MSI support in Id.Web, based on MSAL [Feature Request] Managed Identity support in IDownstreamWebApi / IDownstreamApi #1775 (note: Azure Identity should continue to be used for the MSI connection to AKV for loading certs)
• Update FIC support (Workload Identity) to use MSAL in the first leg instead of Azure Identity (MSI and AKV are currently supported by Id.Web)
• Ensure MSI and FIC are CAE enabled [Feature Request] IDownstream API should do CAE on its own #2550
• Update Workload Identity samples to use Id.Web instead of MSAL
• Add a sample for MSI next to the client_credentials sample
• Add a sample for certificatless next to the client_credentials sample (?)

[bgavrilMS]

@jmprieur, @jennyf19 - I added here some notes about samples for MSI and FIC. I think we are all in agreement that MSI standalone sample is needed. Not sure how you feel about FIC, but I think we should have one (another chapter in client_credentials)

[jennyf19]

@JoshLozensky for the E2E test, would recommend creating a new test class under TokenAcquirerTests, these have similar E2E tests. You'll want to make sure the test only runs in ADO, because we'll be using the system assigned managed identity, so check this IgnoreOnAzureDevopsFactAttribute for an idea on what to do. If you look at the DaemonConsoleCallingDownstreamApi, you'll get an idea of how we can have a very simple test using TokenAcquirerFactory, but instead of using IDownstreamApi as the service, you will want to use IAuthorizationHeaderProvider. Then api.CreateAuthorizationHeaderForAppAsync() and use keyvault as the scopes, as when running in ADO, in the MwWilson1ESHostedPool, there is a user assigned managed identity: idwebvalidationbuild - which has access to keyvault, so we will get a token to keyvault. The scopes to use are "https://vault.azure.net/.default" and then just check that the result is not null.

[bgavrilMS]

@JoshLozensky - is it fair to say that checkbox 1 is done? Will you be working on a sample and / or on updating FIC next?

[jennyf19]

@bgavrilMS - can you give links to the specific samples you want updated:
Update Workload Identity samples to use Id.Web instead of MSAL
Add a sample for MSI next to the client_credentials sample
Add a sample for certificatless next to the client_credentials sample (?)
With @JoshLozensky and @jmprieur we checked the boxes on the done work above. @JoshLozensky will make issues in the samples to track the work

[LarsKemmann]

When trying to read through the 2.17.0 release and related PRs I'm getting confused... is it now possible (with 2.17.0 and/or with extra configuration work on the underlying MSAL.NET components) to set up my web app (running on Azure App Service with a user-assigned managed identity) to be able to sign in users with the authorization code flow, without requiring either a client secret or a certificate (i.e., private key)? Basically, a workload federation-type of deal on the app registration where I can specify which set of managed identities is allowed to act as the application (I would imagine this requires configuring the app registration's workload federation to accept the managed identity system's token issuer as the IdP)? Or is this issue just about enabling Id.Web to use certificates that are stored in Azure Key Vault (and authenticate to AKV with a managed identity) rather than locally with the web app? That would be nice I'm sure, but I would really like to get rid of secrets (including certificate private keys) altogether from our environment and the authorization code flow for user sign-in is the one place where I just can't do that yet.

[jmprieur]

Hello @LarsKemmann

Workload identity federation is already supported by Microsoft.Identity.Web. you would need to use a client credential. See https://learn.microsoft.com/dotnet/api/microsoft.identity.abstractions.credentialdescription.managedidentityclientid?view=msal-model-dotnet-latest. You will also need to change your app registration (in the certificate and secret tab) to add the federation identity credential with your managed identity.

and choose 'Other issuer'

For the support of managed identity, we just updated the doc: https://github.com/AzureAD/microsoft-identity-web/wiki/calling-apis-with-managed-identity
cc: @jennyf19, @JoshLozensky