AzureAuth provides Azure Active Directory (AAD) authentication functionality for R users of Microsoft’s Azure cloud. Use this package to obtain OAuth 2.0 tokens for Azure services including Azure Resource Manager, Azure Storage and others. Both AAD v1.0 and v2.0 are supported.
The primary repo for this package is at
https://github.com/Azure/AzureAuth; please submit issues and PRs there.
It is also mirrored at the Cloudyr org at
https://github.com/cloudyr/AzureAuth. You can install the development
version of the package with
devtools::install_github("Azure/AzureAuth")
.
The main function in AzureAuth is get_azure_token
, which
obtains an OAuth token from AAD. The token is cached in a user-specific
directory using the rappdirs package, and
future requests will use the cached token without needing you to
reauthenticate.
library(AzureAuth)
<- get_azure_token(resource="myresource", tenant="mytenant", app="app_id", ...) token
For reasons of CRAN policy, the first time AzureAuth is loaded, it will prompt you for permission to create this directory. Unless you have a specific reason otherwise, it’s recommended that you allow the directory to be created. Note that most other cloud engineering tools save credentials in this way, including Docker, Kubernetes, and the Azure CLI itself. The prompt only appears in an interactive session; if AzureAuth is loaded in a batch script, the directory is not created if it doesn’t already exist.
Other supplied functions include list_azure_tokens
,
delete_azure_token
and clean_token_directory
,
to let you manage the token cache.
AzureAuth supports the following methods for authenticating with AAD: authorization_code, device_code, client_credentials, resource_owner and on_behalf_of.
get_azure_token
opens a login window in
your browser, where you can enter your AAD credentials. In the
background, it loads the httpuv package to listen on
a local port. Once you have logged in, the AAD server redirects your
browser to a local URL that contains an authorization code.
get_azure_token
retrieves this authorization code and sends
it to the AAD access endpoint, which returns the OAuth token.# obtain a token using authorization_code
# no user credentials needed
get_azure_token("myresource", "mytenant", "app_id", auth_type="authorization_code")
get_azure_token
contacts the AAD devicecode endpoint, which
responds with a login URL and an access code. You then visit the URL and
enter the code, possibly using a different computer. Meanwhile,
get_azure_token
polls the AAD access endpoint for a token,
which is provided once you have entered the code.# obtain a token using device_code
# no user credentials needed
get_azure_token("myresource", "mytenant", "app_id", auth_type="device_code")
get_azure_token
contacts the access endpoint, passing it the credentials. This can be
either a client secret or a certificate, which you supply in the
password
or certificate
argument respectively.
Once the credentials are verified, the endpoint returns the token.# obtain a token using client_credentials
# supply credentials in password arg
get_azure_token("myresource", "mytenant", "app_id",
password="client_secret", auth_type="client_credentials")
# can also supply a client certificate as a PEM/PFX file...
get_azure_token("myresource", "mytenant", "app_id",
certificate="mycert.pem", auth_type="client_credentials")
# ... or as an object in Azure Key Vault
<- AzureKeyVault::key_vault("myvault")$certificates$get("mycert")
cert get_azure_token("myresource", "mytenant", "app_id",
certificate=cert, auth_type="client_credentials")
get_azure_token
passes your
(personal) username and password to the AAD access endpoint, which
validates your credentials and returns the token.# obtain a token using resource_owner
# supply credentials in username and password args
get_azure_token("myresource", "mytenant", "app_id",
username="myusername", password="mypassword", auth_type="resource_owner")
# obtaining multiple tokens: authenticate (interactively) once...
<- get_azure_token("serviceapp_id", "mytenant", "clientapp_id", auth_type="authorization_code")
tok0 # ...then get tokens for each resource with on_behalf_of
<- get_azure_token("resource1", "mytenant," "serviceapp_id",
tok1 password="serviceapp_secret", auth_type="on_behalf_of", on_behalf_of=tok0)
<- get_azure_token("resource2", "mytenant," "serviceapp_id",
tok2 password="serviceapp_secret", auth_type="on_behalf_of", on_behalf_of=tok0)
If you don’t specify the method, get_azure_token
makes a
best guess based on the presence or absence of the other authentication
arguments, and whether httpuv is installed.
AzureAuth provides get_managed_token
to obtain tokens
from within a managed identity. This is a VM, service or container in
Azure that can authenticate as itself, which removes the need to save
secret passwords or certificates.
# run this from within an Azure VM or container for which an identity has been setup
get_managed_token("myresource")
Using the interactive flows (authorization_code and device_code) from
within a Shiny app requires separating the authorization (logging in to
Azure) step from the token acquisition step. For this purpose, AzureAuth
provides the build_authorization_uri
and
get_device_creds
functions. You can use these from within
your app to carry out the authorization, and then pass the resulting
credentials to get_azure_token
itself. See the
“Authenticating from Shiny” vignette for an example app.
You can also use get_azure_token
to obtain ID tokens, in
addition to access tokens.
With AAD v1.0, using an interactive authentication flow
(authorization_code or device_code) will return an ID token by default –
you don’t have to do anything extra. However, AAD v1.0 will not
refresh the ID token when it expires (only the access token). Because of
this, specify use_cache=FALSE
to avoid picking up cached
token credentials which may have been refreshed previously.
AAD v2.0 does not return an ID token by default, but you can get one
by adding the openid
scope. Again, this applies only to
interactive authentication. If you only want an ID token, it’s
recommended to use AAD v2.0.
# ID token with AAD v1.0
<- get_azure_token("", "mytenant", "app_id", use_cache=FALSE)
tok extract_jwt(tok, "id")
# ID token with AAD v2.0 (recommended)
<- get_azure_token(c("openid", "offline_access"), "mytenant", "app_id", version=2)
tok2 extract_jwt(tok2, "id")
The AzureAuth interface is based on the OAuth framework in the httr package, customised and streamlined for Azure. It is an independent implementation of OAuth, but benefited greatly from the work done by Hadley Wickham and the rest of the httr development team.