VYPR
← All advisories
Moderate severityNVD Advisory· Published Jun 11, 2024· Updated Dec 17, 2025

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

CVE-2024-35255

Description

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Azure Identity Libraries and MSAL for Arc had insufficient file path validation, enabling privilege escalation via manipulated WWW-Authenticate headers.

Vulnerability

Overview

CVE-2024-35255 affects Azure Identity Libraries and Microsoft Authentication Library (MSAL) when authenticating via Azure Arc. The libraries failed to properly validate the file path returned in the WWW-Authenticate header during the Azure Arc managed identity token acquisition process. This oversight allowed a potential attacker to supply a path that does not conform to the expected key file location, bypassing security checks [1][2][3][4].

Exploitation

Scenario

An attacker with network access to a resource using managed identity authentication could craft a malicious WWW-Authenticate response containing an arbitrary file path. If the attacker can intercept or spoof the authentication response (e.g., through a man-in-the-middle position or compromised endpoint), the vulnerable library would attempt to read the specified key file, potentially accessing sensitive files outside the intended directory [1][2][4].

Impact

Successful exploitation could lead to elevation of privilege. By forcing the library to read a file attacker controls, the attacker might obtain valid authentication keys for Azure Arc, or read local system files, depending on the application's privileges. This could compromise the managed identity's security and allow unauthorized access to Azure resources [2][3].

Mitigation

The issue has been fixed in the respective SDK repositories for Java [1], Go [2], Python [3], and .NET [4]. Users should update to the patched versions that include proper file path validation for Azure Arc keys. As of the publication date, no workaround is available; updating the SDK libraries is the recommended remediation.

References
  1. Identity june 24 beta update (#40572) · Azure/azure-sdk-for-java@5bf020d
  2. managed identity bug fixes · Azure/azure-sdk-for-go@50774cd
  3. [Identity] Managed identity bug fix (#36010) · Azure/azure-sdk-for-python@cb065ac
  4. MI fixes (#44483) · Azure/azure-sdk-for-net@9279a4f

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
azure-identityPyPI
< 1.16.11.16.1
@azure/identitynpm
< 4.2.14.2.1
com.azure:azure-identityMaven
< 1.12.21.12.2
@azure/msal-nodenpm
>= 2.7.0, < 2.9.22.9.2
Microsoft.Identity.ClientNuGet
>= 4.49.1, < 4.60.44.60.4
github.com/Azure/azure-sdk-for-go/sdk/azidentityGo
< 1.6.0-beta.4.0.20240610221955-50774cd970991.6.0-beta.4.0.20240610221955-50774cd97099
com.microsoft.azure:msal4jMaven
>= 1.14.4-beta, < 1.15.11.15.1
Azure.IdentityNuGet
< 1.11.41.11.4
Microsoft.Identity.ClientNuGet
>= 4.61.0, < 4.61.34.61.3

Affected products

822

Patches

5
5bf020d6ea05

Identity june 24 beta update (#40572)

https://github.com/Azure/azure-sdk-for-javaBill WertJun 11, 2024via ghsa
commit
300 files changed · +484 −305
  • common/smoke-tests/pom.xml+1 −1 modified
    @@ -124,7 +124,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
     </dependency>
 
     <dependency>
  • eng/versioning/external_dependencies.txt+1 −1 modified
    @@ -201,7 +201,7 @@ com.microsoft.azure:azure-mgmt-resources;1.3.0
 com.microsoft.azure:azure-mgmt-search;1.24.1
 com.microsoft.azure:azure-mgmt-storage;1.3.0
 com.microsoft.azure:azure-storage;8.0.0
-com.microsoft.azure:msal4j;1.15.0
+com.microsoft.azure:msal4j;1.15.1
 com.microsoft.azure:msal4j-brokers;1.0.0
 com.microsoft.azure:msal4j-persistence-extension;1.3.0
 com.sun.activation:jakarta.activation;1.2.2
  • eng/versioning/version_client.txt+2 −2 modified
    @@ -129,9 +129,9 @@ com.azure:azure-e2e;1.0.0-beta.1;1.0.0-beta.1
 com.azure:azure-health-insights-clinicalmatching;1.0.0-beta.1;1.0.0-beta.2
 com.azure:azure-health-insights-cancerprofiling;1.0.0-beta.1;1.0.0-beta.2
 com.azure:azure-health-insights-radiologyinsights;1.0.0-beta.1;1.0.0-beta.2
-com.azure:azure-identity;1.12.1;1.13.0-beta.2
+com.azure:azure-identity;1.12.2;1.13.0-beta.2
 com.azure:azure-identity-extensions;1.1.16;1.2.0-beta.2
-com.azure:azure-identity-broker;1.1.1;1.2.0-beta.1
+com.azure:azure-identity-broker;1.1.2;1.2.0-beta.1
 com.azure:azure-identity-broker-samples;1.0.0-beta.1;1.0.0-beta.1
 com.azure:azure-identity-perf;1.0.0-beta.1;1.0.0-beta.1
 com.azure:azure-iot-deviceupdate;1.0.18;1.1.0-beta.1
  • sdk/advisor/azure-resourcemanager-advisor/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/agrifood/azure-resourcemanager-agrifood/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/agrifood/azure-verticals-agrifood-farming/pom.xml+1 −1 modified
    @@ -84,7 +84,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/agrifood/azure-verticals-agrifood-farming/README.md+1 −1 modified
    @@ -47,7 +47,7 @@ To use the [DefaultAzureCredential][DefaultAzureCredential] provider shown below
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
  • sdk/anomalydetector/azure-ai-anomalydetector/pom.xml+1 −1 modified
    @@ -81,7 +81,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/anomalydetector/azure-ai-anomalydetector/README.md+1 −1 modified
    @@ -54,7 +54,7 @@ To use the [DefaultAzureCredential][DefaultAzureCredential] provider shown below
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
  • sdk/aot/azure-aot-graalvm-samples/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
         <dependency>
             <groupId>com.azure</groupId>
             <artifactId>azure-identity</artifactId>
-            <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+            <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
         </dependency>
         <dependency>
             <groupId>com.azure</groupId>
  • sdk/apicenter/azure-resourcemanager-apicenter/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/apimanagement/azure-resourcemanager-apimanagement/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/appcomplianceautomation/azure-resourcemanager-appcomplianceautomation/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/appconfiguration/azure-data-appconfiguration-perf/pom.xml+1 −1 modified
    @@ -97,7 +97,7 @@
         <dependency>
           <groupId>com.azure</groupId>
           <artifactId>azure-identity</artifactId>
-          <version>1.12.1</version>  <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+          <version>1.12.2</version>  <!-- {x-version-update;com.azure:azure-identity;dependency} -->
         </dependency>
       </dependencies>
     </profile>
  • sdk/appconfiguration/azure-data-appconfiguration/pom.xml+1 −1 modified
    @@ -115,7 +115,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/appconfiguration/azure-resourcemanager-appconfiguration/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/appcontainers/azure-resourcemanager-appcontainers/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/applicationinsights/azure-resourcemanager-applicationinsights/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/astro/azure-resourcemanager-astro/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/attestation/azure-resourcemanager-attestation/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/attestation/azure-security-attestation/pom.xml+1 −1 modified
    @@ -130,7 +130,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/avs/azure-resourcemanager-avs/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/azurearcdata/azure-resourcemanager-azurearcdata/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/azurestack/azure-resourcemanager-azurestack/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/azurestackhci/azure-resourcemanager-azurestackhci/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/baremetalinfrastructure/azure-resourcemanager-baremetalinfrastructure/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/batch/azure-compute-batch/pom.xml+1 −1 modified
    @@ -83,7 +83,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/batch/azure-resourcemanager-batch/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/billing/azure-resourcemanager-billing/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/billingbenefits/azure-resourcemanager-billingbenefits/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/changeanalysis/azure-resourcemanager-changeanalysis/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/chaos/azure-resourcemanager-chaos/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/cognitiveservices/azure-resourcemanager-cognitiveservices/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/commerce/azure-resourcemanager-commerce/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/communication/azure-communication-callautomation/pom.xml+1 −1 modified
    @@ -131,7 +131,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/communication/azure-communication-callingserver/pom.xml+1 −1 modified
    @@ -144,7 +144,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/communication/azure-communication-email/pom.xml+1 −1 modified
    @@ -84,7 +84,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/communication/azure-communication-identity/pom.xml+1 −1 modified
    @@ -121,7 +121,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/communication/azure-communication-messages/pom.xml+1 −1 modified
    @@ -84,7 +84,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/communication/azure-communication-phonenumbers/pom.xml+1 −1 modified
    @@ -141,7 +141,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/communication/azure-communication-rooms/pom.xml+1 −1 modified
    @@ -117,7 +117,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/communication/azure-communication-sms/pom.xml+1 −1 modified
    @@ -113,7 +113,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/communication/azure-resourcemanager-communication/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/confidentialledger/azure-resourcemanager-confidentialledger/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/confidentialledger/azure-security-confidentialledger/pom.xml+1 −1 modified
    @@ -70,7 +70,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/confidentialledger/azure-security-confidentialledger/README.md+1 −1 modified
    @@ -49,7 +49,7 @@ To use the [DefaultAzureCredential][DefaultAzureCredential] provider shown below
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
  • sdk/confluent/azure-resourcemanager-confluent/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/connectedvmware/azure-resourcemanager-connectedvmware/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/consumption/azure-resourcemanager-consumption/pom.xml+1 −1 modified
    @@ -54,7 +54,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/containerregistry/azure-containers-containerregistry-perf/pom.xml+1 −1 modified
    @@ -58,7 +58,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
     </dependency>
   </dependencies>
 </project>
  • sdk/containerregistry/azure-containers-containerregistry/pom.xml+1 −1 modified
    @@ -129,7 +129,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/containerservicefleet/azure-resourcemanager-containerservicefleet/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/contentsafety/azure-ai-contentsafety/pom.xml+1 −1 modified
    @@ -78,7 +78,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/core/azure-core-tracing-opentelemetry-samples/pom.xml+1 −1 modified
    @@ -77,7 +77,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/cosmos/azure-cosmos-benchmark/pom.xml+1 −1 modified
    @@ -63,7 +63,7 @@ Licensed under the MIT License.
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version>  <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version>  <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <exclusions>
         <exclusion>
           <groupId>com.azure</groupId>
  • sdk/cosmos/azure-cosmos-encryption/pom.xml+1 −1 modified
    @@ -80,7 +80,7 @@ Licensed under the MIT License.
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version>  <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version>  <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
       <exclusions>
         <exclusion>
  • sdk/cosmos/azure-cosmos-kafka-connect/pom.xml+1 −1 modified
    @@ -126,7 +126,7 @@ Licensed under the MIT License.
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <exclusions>
         <exclusion>
           <groupId>com.azure</groupId>
  • sdk/cosmos/azure-cosmos-spark_3_2-12/pom.xml+1 −1 modified
    @@ -89,7 +89,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <exclusions>
         <exclusion>
           <groupId>com.azure</groupId>
  • sdk/cosmos/azure-cosmos-spark-account-data-resolver-sample/pom.xml+1 −1 modified
    @@ -123,7 +123,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <exclusions>
         <exclusion>
           <groupId>com.azure</groupId>
  • sdk/cosmos/azure-cosmos-tests/pom.xml+1 −1 modified
    @@ -150,7 +150,7 @@ Licensed under the MIT License.
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/cosmosdbforpostgresql/azure-resourcemanager-cosmosdbforpostgresql/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/costmanagement/azure-resourcemanager-costmanagement/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/dashboard/azure-resourcemanager-dashboard/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/databox/azure-resourcemanager-databox/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/databoxedge/azure-resourcemanager-databoxedge/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/databricks/azure-resourcemanager-databricks/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/datadog/azure-resourcemanager-datadog/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/datafactory/azure-resourcemanager-datafactory/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/datalakeanalytics/azure-resourcemanager-datalakeanalytics/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/datalakestore/azure-resourcemanager-datalakestore/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/datamigration/azure-resourcemanager-datamigration/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/dataprotection/azure-resourcemanager-dataprotection/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/defendereasm/azure-resourcemanager-defendereasm/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/delegatednetwork/azure-resourcemanager-delegatednetwork/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/deploymentmanager/azure-resourcemanager-deploymentmanager/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/desktopvirtualization/azure-resourcemanager-desktopvirtualization/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/devcenter/azure-developer-devcenter/pom.xml+1 −1 modified
    @@ -65,7 +65,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/devcenter/azure-resourcemanager-devcenter/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/devhub/azure-resourcemanager-devhub/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/deviceprovisioningservices/azure-resourcemanager-deviceprovisioningservices/pom.xml+1 −1 modified
    @@ -61,7 +61,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/deviceregistry/azure-resourcemanager-deviceregistry/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@ Code generated by Microsoft (R) TypeSpec Code Generator.
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/deviceupdate/azure-iot-deviceupdate/pom.xml+1 −1 modified
    @@ -49,7 +49,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/deviceupdate/azure-resourcemanager-deviceupdate/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/devopsinfrastructure/azure-resourcemanager-devopsinfrastructure/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/devspaces/azure-resourcemanager-devspaces/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/devtestlabs/azure-resourcemanager-devtestlabs/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/digitaltwins/azure-digitaltwins-core/pom.xml+1 −1 modified
    @@ -76,7 +76,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/digitaltwins/azure-resourcemanager-digitaltwins/pom.xml+1 −1 modified
    @@ -70,7 +70,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/dnsresolver/azure-resourcemanager-dnsresolver/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/documentintelligence/azure-ai-documentintelligence/pom.xml+1 −1 modified
    @@ -101,7 +101,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/documentintelligence/azure-ai-documentintelligence/README.md+1 −1 modified
    @@ -90,7 +90,7 @@ Authentication with AAD requires some initial setup:
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/dynatrace/azure-resourcemanager-dynatrace/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/easm/azure-analytics-defender-easm/pom.xml+1 −1 modified
    @@ -96,7 +96,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/edgezones/azure-resourcemanager-edgezones/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/education/azure-resourcemanager-education/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/elastic/azure-resourcemanager-elastic/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/elasticsan/azure-resourcemanager-elasticsan/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/eventgrid/azure-messaging-eventgrid-namespaces/pom.xml+1 −1 modified
    @@ -76,7 +76,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/eventgrid/azure-messaging-eventgrid/pom.xml+1 −1 modified
    @@ -101,7 +101,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/eventgrid/azure-resourcemanager-eventgrid/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/eventhubs/azure-messaging-eventhubs-checkpointstore-blob/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/eventhubs/azure-messaging-eventhubs-checkpointstore-jedis/pom.xml+1 −1 modified
    @@ -53,7 +53,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/eventhubs/azure-messaging-eventhubs/pom.xml+1 −1 modified
    @@ -56,7 +56,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/eventhubs/azure-messaging-eventhubs/README.md+1 −1 modified
    @@ -137,7 +137,7 @@ platform. First, add the package:
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/eventhubs/microsoft-azure-eventhubs-eph/pom.xml+1 −1 modified
    @@ -64,7 +64,7 @@
     <dependency>
       <groupId>com.microsoft.azure</groupId>
       <artifactId>msal4j</artifactId>
-      <version>1.15.0</version> <!-- {x-version-update;com.microsoft.azure:msal4j;external_dependency} -->
+      <version>1.15.1</version> <!-- {x-version-update;com.microsoft.azure:msal4j;external_dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/eventhubs/microsoft-azure-eventhubs-extensions/pom.xml+1 −1 modified
    @@ -68,7 +68,7 @@
       <dependency>
         <groupId>com.microsoft.azure</groupId>
         <artifactId>msal4j</artifactId>
-        <version>1.15.0</version> <!-- {x-version-update;com.microsoft.azure:msal4j;external_dependency} -->
+        <version>1.15.1</version> <!-- {x-version-update;com.microsoft.azure:msal4j;external_dependency} -->
         <scope>test</scope>
       </dependency>
       <dependency>
  • sdk/eventhubs/microsoft-azure-eventhubs/pom.xml+1 −1 modified
    @@ -77,7 +77,7 @@
     <dependency>
       <groupId>com.microsoft.azure</groupId>
       <artifactId>msal4j</artifactId>
-      <version>1.15.0</version> <!-- {x-version-update;com.microsoft.azure:msal4j;external_dependency} -->
+      <version>1.15.1</version> <!-- {x-version-update;com.microsoft.azure:msal4j;external_dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/face/azure-ai-vision-face/pom.xml+1 −1 modified
    @@ -78,7 +78,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/face/azure-ai-vision-face/README.md+1 −1 modified
    @@ -87,7 +87,7 @@ To use the [DefaultAzureCredential][azure_sdk_java_default_azure_credential] typ
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.11.4</version>
+    <version>1.12.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/fluidrelay/azure-resourcemanager-fluidrelay/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/formrecognizer/azure-ai-formrecognizer-perf/pom.xml+1 −1 modified
    @@ -105,7 +105,7 @@
         <dependency>
           <groupId>com.azure</groupId>
           <artifactId>azure-identity</artifactId>
-          <version>1.12.1</version>  <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+          <version>1.12.2</version>  <!-- {x-version-update;com.azure:azure-identity;dependency} -->
         </dependency>
       </dependencies>
     </profile>
  • sdk/formrecognizer/azure-ai-formrecognizer/pom.xml+1 −1 modified
    @@ -100,7 +100,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/formrecognizer/azure-ai-formrecognizer/README.md+1 −1 modified
    @@ -167,7 +167,7 @@ Authentication with AAD requires some initial setup:
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/frontdoor/azure-resourcemanager-frontdoor/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/graphservices/azure-resourcemanager-graphservices/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/hanaonazure/azure-resourcemanager-hanaonazure/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/hardwaresecuritymodules/azure-resourcemanager-hardwaresecuritymodules/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/hdinsight/azure-resourcemanager-hdinsight-containers/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/hdinsight/azure-resourcemanager-hdinsight/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/healthcareapis/azure-resourcemanager-healthcareapis/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/healthinsights/azure-health-insights-cancerprofiling/pom.xml+1 −1 modified
    @@ -80,7 +80,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/healthinsights/azure-health-insights-clinicalmatching/pom.xml+1 −1 modified
    @@ -80,7 +80,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/healthinsights/azure-health-insights-radiologyinsights/pom.xml+1 −1 modified
    @@ -84,7 +84,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/hybridcompute/azure-resourcemanager-hybridcompute/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/hybridconnectivity/azure-resourcemanager-hybridconnectivity/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/hybridcontainerservice/azure-resourcemanager-hybridcontainerservice/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/hybridkubernetes/azure-resourcemanager-hybridkubernetes/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/hybridnetwork/azure-resourcemanager-hybridnetwork/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/identity/azure-identity-broker/CHANGELOG.md+9 −0 modified
    @@ -10,6 +10,15 @@
 
 ### Other Changes
 
+## 1.1.2 (2024-06-10)
+
+### Other Changes
+
+#### Dependency Updates
+
+- Upgraded `azure-identity` from `1.12.1` to version `1.12.2`.
+- Upgraded `msal4j` from `1.15.0` to version `1.15.1`.
+
 ## 1.1.1 (2024-05-02)
 
 ### Other Changes
  • sdk/identity/azure-identity-broker/pom.xml+2 −2 modified
    @@ -37,7 +37,7 @@
     <dependency>
       <groupId>com.microsoft.azure</groupId>
       <artifactId>msal4j</artifactId>
-      <version>1.15.0</version> <!-- {x-version-update;com.microsoft.azure:msal4j;external_dependency} -->
+      <version>1.15.1</version> <!-- {x-version-update;com.microsoft.azure:msal4j;external_dependency} -->
     </dependency>
     <dependency>
       <groupId>com.microsoft.azure</groupId>
@@ -62,7 +62,7 @@
           <rules>
             <bannedDependencies>
               <includes>
-                <include>com.microsoft.azure:msal4j:[1.15.0]</include> <!-- {x-include-update;com.microsoft.azure:msal4j;external_dependency} -->
+                <include>com.microsoft.azure:msal4j:[1.15.1]</include> <!-- {x-include-update;com.microsoft.azure:msal4j;external_dependency} -->
                 <include>com.microsoft.azure:msal4j-brokers:[1.0.0]</include> <!-- {x-include-update;com.microsoft.azure:msal4j-brokers;external_dependency} -->
               </includes>
             </bannedDependencies>
  • sdk/identity/azure-identity-broker/README.md+1 −1 modified
    @@ -46,7 +46,7 @@ To take dependency on a particular version of the library that isn't present in
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity-broker</artifactId>
-    <version>1.1.0</version>
+    <version>1.1.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/identity/azure-identity/CHANGELOG.md+13 −2 modified
    @@ -1,15 +1,26 @@
 # Release History
 
-## 1.13.0-beta.2 (Unreleased)
+## 1.13.0-beta.2 (2024-06-10)
 
 ### Features Added
+- Added support for a client assertion in `OnBehalfOfCredential` [#40552](https://github.com/Azure/azure-sdk-for-java/pull/40552/files)
 
-### Breaking Changes
+### Bugs Fixed
+- Fixed an issue which may block `AzurePowershellCredential` from functioning correctly. [#40552](https://github.com/Azure/azure-sdk-for-java/pull/40552/files) 
+
+## 1.12.2 (2024-06-10)
 
 ### Bugs Fixed
+- Managed identity bug fixes
 
 ### Other Changes
 
+#### Dependency Updates
+
+- Upgraded `azure-core` from `1.49.0` to version `1.49.1`.
+- Upgraded `azure-core-http-netty` from `1.15.0` to version `1.15.1`.
+- Upgraded `msal4j` from `1.15.0` to version `1.15.1`.
+
 ## 1.13.0-beta.1 (2024-05-23)
 
 ### Features Added
  • sdk/identity/azure-identity-extensions/pom.xml+1 −1 modified
    @@ -34,7 +34,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
     </dependency>
 
     <!-- test   -->
  • sdk/identity/azure-identity/pom.xml+2 −2 modified
    @@ -46,7 +46,7 @@
     <dependency>
       <groupId>com.microsoft.azure</groupId>
       <artifactId>msal4j</artifactId>
-      <version>1.15.0</version> <!-- {x-version-update;com.microsoft.azure:msal4j;external_dependency} -->
+      <version>1.15.1</version> <!-- {x-version-update;com.microsoft.azure:msal4j;external_dependency} -->
     </dependency>
     <dependency>
       <groupId>com.microsoft.azure</groupId>
@@ -151,7 +151,7 @@
           <rules>
             <bannedDependencies>
               <includes>
-                <include>com.microsoft.azure:msal4j:[1.15.0]</include> <!-- {x-include-update;com.microsoft.azure:msal4j;external_dependency} -->
+                <include>com.microsoft.azure:msal4j:[1.15.1]</include> <!-- {x-include-update;com.microsoft.azure:msal4j;external_dependency} -->
                 <include>com.microsoft.azure:msal4j-persistence-extension:[1.3.0]</include> <!-- {x-include-update;com.microsoft.azure:msal4j-persistence-extension;external_dependency} -->
                 <include>net.java.dev.jna:jna-platform:[5.6.0]</include> <!-- {x-include-update;net.java.dev.jna:jna-platform;external_dependency} -->
                 <include>org.linguafranca.pwdb:KeePassJava2:[2.1.4]</include> <!-- {x-include-update;org.linguafranca.pwdb:KeePassJava2;external_dependency} -->
  • sdk/identity/azure-identity/README.md+1 −1 modified
    @@ -46,7 +46,7 @@ To take dependency on a particular version of the library that isn't present in
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.1</version>
+    <version>1.12.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/identity/azure-identity/src/main/java/com/azure/identity/implementation/IdentityClientBase.java+2 −4 modified
    @@ -99,6 +99,8 @@
 import java.util.function.Supplier;
 import java.util.regex.Pattern;
 
+import static com.azure.identity.implementation.util.IdentityUtil.isWindowsPlatform;
+
 public abstract class IdentityClientBase {
     static final SerializerAdapter SERIALIZER_ADAPTER = JacksonAdapter.createDefaultSerializerAdapter();
     static final String WINDOWS_STARTER = "cmd.exe";
@@ -837,10 +839,6 @@ String getSafeWorkingDirectory() {
         }
     }
 
-    boolean isWindowsPlatform() {
-        return System.getProperty("os.name").contains("Windows");
-    }
-
     String redactInfo(String input) {
         return ACCESS_TOKEN_PATTERN.matcher(input).replaceAll("****");
     }
  • sdk/identity/azure-identity/src/main/java/com/azure/identity/implementation/IdentityClient.java+8 −2 modified
    @@ -40,6 +40,7 @@
 import reactor.core.publisher.Mono;
 
 import javax.net.ssl.HttpsURLConnection;
+import java.io.File;
 import java.io.IOException;
 import java.net.HttpURLConnection;
 import java.net.MalformedURLException;
@@ -51,6 +52,7 @@
 import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
+import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.time.Duration;
 import java.time.OffsetDateTime;
@@ -66,6 +68,8 @@
 import java.util.function.Function;
 import java.util.function.Supplier;
 
+import static com.azure.identity.implementation.util.ValidationUtil.validateSecretFile;
+
 /**
  * The identity client that contains APIs to retrieve access tokens
  * from various configurations.
@@ -993,8 +997,10 @@ private Mono<AccessToken> authenticateToArcManagedIdentityEndpoint(String identi
                         null));
                 }
 
-                String secretKeyPath = realm.substring(separatorIndex + 1);
-                secretKey = new String(Files.readAllBytes(Paths.get(secretKeyPath)), StandardCharsets.UTF_8);
+                String secretKeyPathHeaderValue = realm.substring(separatorIndex + 1);
+                Path secretKeyPath = validateSecretFile(new File(secretKeyPathHeaderValue), LOGGER);
+
+                secretKey = new String(Files.readAllBytes(secretKeyPath), StandardCharsets.UTF_8);
 
 
                 if (connection != null) {
  • sdk/identity/azure-identity/src/main/java/com/azure/identity/implementation/util/IdentityUtil.java+9 −0 modified
    @@ -111,4 +111,13 @@ public static byte[] convertInputStreamToByteArray(InputStream inputStream) {
         }
         return outputStream.toByteArray();
     }
+
+
+    public static boolean isWindowsPlatform() {
+        return System.getProperty("os.name").contains("Windows");
+    }
+
+    public static boolean isLinuxPlatform() {
+        return System.getProperty("os.name").contains("Linux");
+    }
 }
  • sdk/identity/azure-identity/src/main/java/com/azure/identity/implementation/util/ValidationUtil.java+49 −0 modified
    @@ -3,11 +3,19 @@
 
 package com.azure.identity.implementation.util;
 
+import com.azure.core.exception.ClientAuthenticationException;
+import com.azure.core.util.CoreUtils;
 import com.azure.core.util.logging.ClientLogger;
 
+import java.io.File;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.List;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+
+import static com.azure.identity.implementation.util.IdentityUtil.isLinuxPlatform;
+import static com.azure.identity.implementation.util.IdentityUtil.isWindowsPlatform;
 
 /**
  * Utility class for validating parameters.
@@ -107,4 +115,45 @@ public static void validateInteractiveBrowserRedirectUrlSetup(Integer port, Stri
     private static boolean isValidTenantCharacter(char c) {
         return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || (c == '.') || (c == '-');
     }
+
+
+    public static Path validateSecretFile(File file, ClientLogger logger) {
+
+        Path path = file.toPath();
+        if (isWindowsPlatform()) {
+            String programData = System.getenv("ProgramData");
+            if (CoreUtils.isNullOrEmpty(programData)) {
+                throw logger.logExceptionAsError(new ClientAuthenticationException("The ProgramData environment"
+                    + " variable is not set.", null));
+            }
+            String target = Paths.get(programData, "AzureConnectedMachineAgent", "Tokens").toString();
+            if (!path.getParent().toString().equals(target)) {
+                throw logger.logExceptionAsError(new ClientAuthenticationException("The secret key file is not"
+                    + " located in the expected directory.", null));
+            }
+        } else if (isLinuxPlatform()) {
+            Path target = Paths.get("/", "var", "opt", "azcmagent", "tokens");
+            if (!path.getParent().equals(target)) {
+                throw logger.logExceptionAsError(new ClientAuthenticationException("The secret key file is not"
+                    + " located in the expected directory.", null));
+            }
+        } else {
+            throw logger.logExceptionAsError(new ClientAuthenticationException("The platform is not supported"
+                + " for Azure Arc Managed Identity Endpoint", null));
+        }
+
+        if (!path.toString().endsWith(".key")) {
+            throw logger.logExceptionAsError(new ClientAuthenticationException("The secret key file does not"
+                + " have the expected file extension", null));
+        }
+
+
+
+        if (file.length() > 4096) {
+            throw logger.logExceptionAsError(new ClientAuthenticationException("The secret key file is too large"
+                + " to be read from Azure Arc Managed Identity Endpoint", null));
+        }
+
+        return path;
+    }
 }
  • sdk/identity/azure-identity/src/test/java/com/azure/identity/implementation/ValidationUtilTests.java+97 −0 added
    @@ -0,0 +1,97 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+package com.azure.identity.implementation;
+
+import com.azure.core.exception.ClientAuthenticationException;
+import com.azure.core.util.logging.ClientLogger;
+import com.azure.identity.implementation.util.ValidationUtil;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.condition.DisabledOnOs;
+import org.junit.jupiter.api.condition.OS;
+
+import java.io.File;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+
+import static com.azure.identity.implementation.util.IdentityUtil.isLinuxPlatform;
+import static com.azure.identity.implementation.util.IdentityUtil.isWindowsPlatform;
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@DisabledOnOs({OS.MAC})
+public class ValidationUtilTests {
+    private static final ClientLogger LOGGER = new ClientLogger(ValidationUtilTests.class);
+
+    private static File good;
+    private static File fileTooLong;
+    private static File wrongPrefix;
+    private static File wrongExtension;
+    private static File fileWithRelativeSegments;
+
+
+    @BeforeAll
+    public static void setupClass() {
+        Path beginning = null;
+        if (isWindowsPlatform()) {
+            beginning = Paths.get(System.getenv("ProgramData"), "AzureConnectedMachineAgent", "Tokens");
+        } else if (isLinuxPlatform()) {
+
+            beginning = Paths.get("/", "var", "opt", "azcmagent", "tokens");
+        }
+
+        good = new TestFile(Paths.get(beginning.toString(), "good.key").toString());
+        fileTooLong = new TestFile(Paths.get(beginning.toString(), "fileTooLong.key").toString(), 4097);
+        wrongPrefix = new TestFile(Paths.get("wrongPrefix", ".key").toString());
+        wrongExtension = new TestFile(Paths.get(beginning.toString(), "wrongExtension.txt").toString());
+        fileWithRelativeSegments = new TestFile(Paths.get(beginning.toString(), "..", "file.key").toString());
+
+    }
+    @Test
+    public void testValidPath() {
+        assertDoesNotThrow(() -> ValidationUtil.validateSecretFile(good, LOGGER));
+    }
+
+    @Test
+    public void testInvalidTooLong() {
+        Throwable thrown = assertThrows(ClientAuthenticationException.class, () -> ValidationUtil.validateSecretFile(fileTooLong, LOGGER));
+        assertTrue(thrown.getMessage().contains("The secret key file is too large"));
+    }
+
+    @Test
+    public void testInvalidWrongPrefix() {
+        Throwable thrown = assertThrows(ClientAuthenticationException.class, () -> ValidationUtil.validateSecretFile(wrongPrefix, LOGGER));
+        assertTrue(thrown.getMessage().contains("The secret key file is not located in the expected directory"));
+    }
+
+    @Test
+    public void testInvalidWrongExtension() {
+        Throwable thrown = assertThrows(ClientAuthenticationException.class, () -> ValidationUtil.validateSecretFile(wrongExtension, LOGGER));
+        assertTrue(thrown.getMessage().contains("The secret key file does not have the expected file extension"));
+    }
+
+    @Test
+    public void testInvalidRelativeSegments() {
+        Throwable thrown = assertThrows(ClientAuthenticationException.class, () -> ValidationUtil.validateSecretFile(fileWithRelativeSegments, LOGGER));
+        assertTrue(thrown.getMessage().contains("The secret key file is not located in the expected directory"));
+    }
+
+    static class TestFile extends File {
+        long length = 4096;
+        TestFile(String pathname) {
+            super(pathname);
+        }
+
+        TestFile(String pathName, long length) {
+            super(pathName);
+            this.length = length;
+        }
+
+        @Override
+        public long length() {
+            return length;
+        }
+    }
+}
  • sdk/imagebuilder/azure-resourcemanager-imagebuilder/pom.xml+1 −1 modified
    @@ -78,7 +78,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/informaticadatamanagement/azure-resourcemanager-informaticadatamanagement/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/iotcentral/azure-resourcemanager-iotcentral/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/iotfirmwaredefense/azure-resourcemanager-iotfirmwaredefense/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/iothub/azure-resourcemanager-iothub/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/keyvault/azure-security-keyvault-administration/pom.xml+1 −1 modified
    @@ -124,7 +124,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/keyvault/azure-security-keyvault-certificates/pom.xml+1 −1 modified
    @@ -107,7 +107,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/keyvault/azure-security-keyvault-keys/pom.xml+1 −1 modified
    @@ -111,7 +111,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <!-- bytebuddy dependencies are required for mockito 4.11.0 to work with Java 21. Mockito 4.11.0 is the last release -->
  • sdk/keyvault/azure-security-keyvault-perf/pom.xml+2 −2 modified
    @@ -41,7 +41,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
     </dependency>
     <dependency>
       <groupId>com.azure</groupId>
@@ -126,7 +126,7 @@
         <dependency>
           <groupId>com.azure</groupId>
           <artifactId>azure-identity</artifactId>
-          <version>1.12.1</version>  <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+          <version>1.12.2</version>  <!-- {x-version-update;com.azure:azure-identity;dependency} -->
         </dependency>
       </dependencies>
     </profile>
  • sdk/keyvault/azure-security-keyvault-secrets/pom.xml+1 −1 modified
    @@ -116,7 +116,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/kubernetesconfiguration/azure-resourcemanager-kubernetesconfiguration/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/kusto/azure-resourcemanager-kusto/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/largeinstance/azure-resourcemanager-largeinstance/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/loadtesting/azure-developer-loadtesting/pom.xml+1 −1 modified
    @@ -65,7 +65,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/loadtesting/azure-resourcemanager-loadtesting/pom.xml+1 −1 modified
    @@ -61,7 +61,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/loganalytics/azure-resourcemanager-loganalytics/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/logic/azure-resourcemanager-logic/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/logz/azure-resourcemanager-logz/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/machinelearning/azure-resourcemanager-machinelearning/pom.xml+1 −1 modified
    @@ -84,7 +84,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/maintenance/azure-resourcemanager-maintenance/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/managedapplications/azure-resourcemanager-managedapplications/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/managednetworkfabric/azure-resourcemanager-managednetworkfabric/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/managementgroups/azure-resourcemanager-managementgroups/pom.xml+1 −1 modified
    @@ -69,7 +69,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/maps/azure-maps-elevation/pom.xml+1 −1 modified
    @@ -73,7 +73,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/maps/azure-maps-geolocation/pom.xml+1 −1 modified
    @@ -77,7 +77,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/maps/azure-maps-render/pom.xml+1 −1 modified
    @@ -86,7 +86,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/maps/azure-maps-route/pom.xml+1 −1 modified
    @@ -86,7 +86,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/maps/azure-maps-search/pom.xml+1 −1 modified
    @@ -87,7 +87,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/maps/azure-maps-timezone/pom.xml+1 −1 modified
    @@ -83,7 +83,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/maps/azure-maps-traffic/pom.xml+1 −1 modified
    @@ -74,7 +74,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/maps/azure-maps-weather/pom.xml+1 −1 modified
    @@ -84,7 +84,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/maps/azure-resourcemanager-maps/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/mariadb/azure-resourcemanager-mariadb/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/mediaservices/azure-resourcemanager-mediaservices/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/metricsadvisor/azure-ai-metricsadvisor/pom.xml+1 −1 modified
    @@ -98,7 +98,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/metricsadvisor/azure-ai-metricsadvisor/README.md+1 −1 modified
    @@ -112,7 +112,7 @@ Authentication with AAD requires some initial setup:
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/migrationdiscoverysap/azure-resourcemanager-migrationdiscoverysap/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/mixedreality/azure-mixedreality-authentication/pom.xml+1 −1 modified
    @@ -94,7 +94,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/mixedreality/azure-resourcemanager-mixedreality/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/mobilenetwork/azure-resourcemanager-mobilenetwork/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/modelsrepository/azure-iot-modelsrepository/pom.xml+1 −1 modified
    @@ -64,7 +64,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/monitor/azure-monitor-ingestion-perf/pom.xml+1 −1 modified
    @@ -36,7 +36,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
     </dependency>
 
     <dependency>
  • sdk/monitor/azure-monitor-ingestion/pom.xml+1 −1 modified
    @@ -113,7 +113,7 @@
         <dependency>
             <groupId>com.azure</groupId>
             <artifactId>azure-identity</artifactId>
-            <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+            <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
             <scope>test</scope>
         </dependency>
     </dependencies>
  • sdk/monitor/azure-monitor-ingestion/README.md+1 −1 modified
    @@ -76,7 +76,7 @@ To use the [DefaultAzureCredential][DefaultAzureCredential] provider shown below
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/monitor/azure-monitor-opentelemetry-exporter/pom.xml+1 −1 modified
    @@ -182,7 +182,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/monitor/azure-monitor-query-perf/pom.xml+1 −1 modified
    @@ -36,7 +36,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
     </dependency>
 
     <dependency>
  • sdk/monitor/azure-monitor-query/pom.xml+1 −1 modified
    @@ -75,7 +75,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/monitor/azure-monitor-query/README.md+1 −1 modified
    @@ -86,7 +86,7 @@ To use the [DefaultAzureCredential][DefaultAzureCredential] provider shown below
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/mysql/azure-resourcemanager-mysql/pom.xml+1 −1 modified
    @@ -61,7 +61,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/mysqlflexibleserver/azure-resourcemanager-mysqlflexibleserver/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/netapp/azure-resourcemanager-netapp/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/networkanalytics/azure-resourcemanager-networkanalytics/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/networkcloud/azure-resourcemanager-networkcloud/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/networkfunction/azure-resourcemanager-networkfunction/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/newrelicobservability/azure-resourcemanager-newrelicobservability/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/nginx/azure-resourcemanager-nginx/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/notificationhubs/azure-resourcemanager-notificationhubs/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/openai/azure-ai-openai-assistants/pom.xml+1 −1 modified
    @@ -87,7 +87,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/openai/azure-ai-openai/pom.xml+1 −1 modified
    @@ -86,7 +86,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/openai/azure-ai-openai/README.md+1 −1 modified
    @@ -105,7 +105,7 @@ Authentication with AAD requires some initial setup:
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/operationsmanagement/azure-resourcemanager-operationsmanagement/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/oracledatabase/azure-resourcemanager-oracledatabase/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/orbital/azure-resourcemanager-orbital/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/paloaltonetworks/azure-resourcemanager-paloaltonetworks-ngfw/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/peering/azure-resourcemanager-peering/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/personalizer/azure-ai-personalizer/pom.xml+1 −1 modified
    @@ -97,7 +97,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/playwrighttesting/azure-resourcemanager-playwrighttesting/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/policyinsights/azure-resourcemanager-policyinsights/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/postgresql/azure-resourcemanager-postgresql/pom.xml+1 −1 modified
    @@ -61,7 +61,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/postgresqlflexibleserver/azure-resourcemanager-postgresqlflexibleserver/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/powerbidedicated/azure-resourcemanager-powerbidedicated/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/providerhub/azure-resourcemanager-providerhub/pom.xml+1 −1 modified
    @@ -72,7 +72,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/purview/azure-analytics-purview-administration/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/purview/azure-analytics-purview-administration/README.md+1 −1 modified
    @@ -48,7 +48,7 @@ To use the [DefaultAzureCredential][DefaultAzureCredential] provider shown below
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/purview/azure-analytics-purview-catalog/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/purview/azure-analytics-purview-catalog/README.md+1 −1 modified
    @@ -51,7 +51,7 @@ To use the [DefaultAzureCredential][DefaultAzureCredential] provider shown below
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/purview/azure-analytics-purview-datamap/pom.xml+1 −1 modified
    @@ -84,7 +84,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/purview/azure-analytics-purview-scanning/pom.xml+1 −1 modified
    @@ -72,7 +72,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/purview/azure-analytics-purview-scanning/README.md+1 −1 modified
    @@ -50,7 +50,7 @@ To use the [DefaultAzureCredential][DefaultAzureCredential] provider shown below
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/purview/azure-analytics-purview-sharing/pom.xml+1 −1 modified
    @@ -78,7 +78,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/purview/azure-analytics-purview-workflow/pom.xml+1 −1 modified
    @@ -79,7 +79,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/purview/azure-analytics-purview-workflow/README.md+1 −1 modified
    @@ -29,7 +29,7 @@ To use the [UsernamePasswordCredential][username_password_credential] provider s
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
  • sdk/purview/azure-resourcemanager-purview/pom.xml+1 −1 modified
    @@ -61,7 +61,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/quantum/azure-quantum-jobs/pom.xml+1 −1 modified
    @@ -76,7 +76,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/quantum/azure-resourcemanager-quantum/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/qumulo/azure-resourcemanager-qumulo/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/quota/azure-resourcemanager-quota/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/recoveryservices/azure-resourcemanager-recoveryservices/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/recoveryservicesbackup/azure-resourcemanager-recoveryservicesbackup/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@ Code generated by Microsoft (R) AutoRest Code Generator.
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/recoveryservicesdatareplication/azure-resourcemanager-recoveryservicesdatareplication/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/recoveryservicessiterecovery/azure-resourcemanager-recoveryservicessiterecovery/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/redisenterprise/azure-resourcemanager-redisenterprise/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/remoterendering/azure-mixedreality-remoterendering/pom.xml+1 −1 modified
    @@ -91,7 +91,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/reservations/azure-resourcemanager-reservations/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/resourceconnector/azure-resourcemanager-resourceconnector/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/resourcegraph/azure-resourcemanager-resourcegraph/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/resourcehealth/azure-resourcemanager-resourcehealth/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/resourcemanager/azure-resourcemanager-samples/pom.xml+1 −1 modified
    @@ -74,7 +74,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
     </dependency>
     <dependency>
       <groupId>com.jcraft</groupId>
  • sdk/resourcemanager/azure-resourcemanager-test/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
     </dependency>
     <dependency>
       <groupId>com.azure</groupId>
  • sdk/resourcemanagerhybrid/azure-resourcemanager-test/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
     </dependency>
     <dependency>
       <groupId>com.azure</groupId>
  • sdk/resourcemanagerhybrid/README.md+1 −1 modified
    @@ -85,7 +85,7 @@ Azure Management Libraries require a `TokenCredential` implementation for authen
 <dependency>
   <groupId>com.azure</groupId>
   <artifactId>azure-identity</artifactId>
-  <version>1.12.0</version>
+  <version>1.12.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/resourcemanager/README.md+1 −1 modified
    @@ -100,7 +100,7 @@ Azure Management Libraries require a `TokenCredential` implementation for authen
 <dependency>
   <groupId>com.azure</groupId>
   <artifactId>azure-identity</artifactId>
-  <version>1.12.1</version>
+  <version>1.12.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/resourcemover/azure-resourcemanager-resourcemover/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/schemaregistry/azure-data-schemaregistry-apacheavro/pom.xml+1 −1 modified
    @@ -110,7 +110,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/schemaregistry/azure-data-schemaregistry-apacheavro/README.md+1 −1 modified
    @@ -51,7 +51,7 @@ with the Azure SDK, please include the `azure-identity` package:
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
  • sdk/schemaregistry/azure-data-schemaregistry-jsonschema/pom.xml+1 −1 modified
    @@ -91,7 +91,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/schemaregistry/azure-data-schemaregistry-jsonschema/README.md+1 −1 modified
    @@ -50,7 +50,7 @@ with the Azure SDK, please include the `azure-identity` package:
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
  • sdk/schemaregistry/azure-data-schemaregistry/pom.xml+1 −1 modified
    @@ -100,7 +100,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/schemaregistry/azure-data-schemaregistry/README.md+1 −1 modified
    @@ -75,7 +75,7 @@ To use the [DefaultAzureCredential][DefaultAzureCredential] provider shown below
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
  • sdk/search/azure-search-documents/pom.xml+1 −1 modified
    @@ -100,7 +100,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/security/azure-resourcemanager-security/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/securitydevops/azure-resourcemanager-securitydevops/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/selfhelp/azure-resourcemanager-selfhelp/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/servicebus/azure-messaging-servicebus/pom.xml+1 −1 modified
    @@ -97,7 +97,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/servicebus/azure-messaging-servicebus/README.md+1 −1 modified
    @@ -89,7 +89,7 @@ First, add the package:
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/servicefabric/azure-resourcemanager-servicefabric/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/servicelinker/azure-resourcemanager-servicelinker/pom.xml+1 −1 modified
    @@ -54,7 +54,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/servicenetworking/azure-resourcemanager-servicenetworking/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/signalr/azure-resourcemanager-signalr/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/sphere/azure-resourcemanager-sphere/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/springappdiscovery/azure-resourcemanager-springappdiscovery/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/spring/spring-cloud-azure-appconfiguration-config/pom.xml+1 −1 modified
    @@ -53,7 +53,7 @@
 		<dependency>
 			<groupId>com.azure</groupId>
 			<artifactId>azure-identity</artifactId>
-			<version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+			<version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
 		</dependency>
 		<dependency>
 			<groupId>com.azure</groupId>
  • sdk/spring/spring-cloud-azure-autoconfigure/pom.xml+1 −1 modified
    @@ -157,7 +157,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <optional>true</optional>
     </dependency>
     <dependency>
  • sdk/spring/spring-cloud-azure-core/pom.xml+1 −1 modified
    @@ -46,7 +46,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
     </dependency>
     <dependency>
       <groupId>com.azure</groupId>
  • sdk/spring/spring-cloud-azure-integration-tests/pom.xml+1 −1 modified
    @@ -131,7 +131,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
     </dependency>
   </dependencies>
  • sdk/spring/spring-cloud-azure-starter-servicebus-jms/pom.xml+1 −1 modified
    @@ -128,7 +128,7 @@ currently released version and a lower version is resolved. -->
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <optional>true</optional>
     </dependency>
     <!-- We should keep these netty dependencies, for the netty version in qpid-jms-client is lower than the ones in azure sdks.  -->
  • sdk/sqlvirtualmachine/azure-resourcemanager-sqlvirtualmachine/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/standbypool/azure-resourcemanager-standbypool/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@ Code generated by Microsoft (R) AutoRest Code Generator.
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/storageactions/azure-resourcemanager-storageactions/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/storage/azure-storage-blob-batch/pom.xml+1 −1 modified
    @@ -101,7 +101,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/storage/azure-storage-blob-changefeed/pom.xml+1 −1 modified
    @@ -108,7 +108,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/storage/azure-storage-blob-cryptography/pom.xml+1 −1 modified
    @@ -126,7 +126,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/storage/azure-storage-blob/pom.xml+1 −1 modified
    @@ -120,7 +120,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/storage/azure-storage-common/pom.xml+1 −1 modified
    @@ -91,7 +91,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/storage/azure-storage-file-datalake/pom.xml+1 −1 modified
    @@ -112,7 +112,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/storage/azure-storage-file-share/pom.xml+1 −1 modified
    @@ -136,7 +136,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/storage/azure-storage-perf/pom.xml+1 −1 modified
    @@ -130,7 +130,7 @@
         <dependency>
           <groupId>com.azure</groupId>
           <artifactId>azure-identity</artifactId>
-          <version>1.12.1</version>  <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+          <version>1.12.2</version>  <!-- {x-version-update;com.azure:azure-identity;dependency} -->
         </dependency>
       </dependencies>
     </profile>
  • sdk/storage/azure-storage-queue/pom.xml+1 −1 modified
    @@ -120,7 +120,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/storagecache/azure-resourcemanager-storagecache/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/storageimportexport/azure-resourcemanager-storageimportexport/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/storagemover/azure-resourcemanager-storagemover/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/storagepool/azure-resourcemanager-storagepool/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/streamanalytics/azure-resourcemanager-streamanalytics/pom.xml+1 −1 modified
    @@ -67,7 +67,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/subscription/azure-resourcemanager-subscription/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/support/azure-resourcemanager-support/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/synapse/azure-analytics-synapse-accesscontrol/pom.xml+1 −1 modified
    @@ -89,7 +89,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/synapse/azure-analytics-synapse-artifacts/pom.xml+1 −1 modified
    @@ -89,7 +89,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/synapse/azure-analytics-synapse-managedprivateendpoints/pom.xml+1 −1 modified
    @@ -89,7 +89,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/synapse/azure-analytics-synapse-monitoring/pom.xml+1 −1 modified
    @@ -89,7 +89,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/synapse/azure-analytics-synapse-spark/pom.xml+1 −1 modified
    @@ -95,7 +95,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/synapse/azure-resourcemanager-synapse/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/tables/azure-data-tables/pom.xml+1 −1 modified
    @@ -99,7 +99,7 @@ Licensed under the MIT License.
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/textanalytics/azure-ai-textanalytics-perf/pom.xml+1 −1 modified
    @@ -107,7 +107,7 @@
         <dependency>
           <groupId>com.azure</groupId>
           <artifactId>azure-identity</artifactId>
-          <version>1.12.1</version>  <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+          <version>1.12.2</version>  <!-- {x-version-update;com.azure:azure-identity;dependency} -->
         </dependency>
       </dependencies>
     </profile>
  • sdk/textanalytics/azure-ai-textanalytics/pom.xml+1 −1 modified
    @@ -109,7 +109,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
   </dependencies>
  • sdk/textanalytics/azure-ai-textanalytics/README.md+1 −1 modified
    @@ -141,7 +141,7 @@ Authentication with AAD requires some initial setup:
 <dependency>
     <groupId>com.azure</groupId>
     <artifactId>azure-identity</artifactId>
-    <version>1.12.0</version>
+    <version>1.12.2</version>
 </dependency>
 ```
 [//]: # ({x-version-update-end})
  • sdk/timeseriesinsights/azure-resourcemanager-timeseriesinsights/pom.xml+1 −1 modified
    @@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/translation/azure-ai-documenttranslator/pom.xml+1 −1 modified
    @@ -82,7 +82,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/translation/azure-ai-translation-text/pom.xml+1 −1 modified
    @@ -83,7 +83,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/vision/azure-ai-vision-imageanalysis/pom.xml+1 −1 modified
    @@ -96,7 +96,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
  • sdk/vmwarecloudsimple/azure-resourcemanager-vmwarecloudsimple/pom.xml+1 −1 modified
    @@ -60,7 +60,7 @@
     <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-identity</artifactId>
-      <version>1.12.1</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
+      <version>1.12.2</version> <!-- {x-version-update;com.azure:azure-identity;dependency} -->
       <scope>test</scope>
     </dependency>
     <dependency>
c6aa75d312ae

[identity] Identity bug fix (#29982)

https://github.com/Azure/azure-sdk-for-jsMaor LegerJun 10, 2024via ghsa
commit
14 files changed · +614 −503
  • common/config/rush/pnpm-lock.yaml+409 −395 modified
  • sdk/communication/communication-identity/package.json+1 −1 modified
    @@ -113,7 +113,7 @@
     "@azure/dev-tool": "^1.0.0",
     "@azure/eslint-plugin-azure-sdk": "^3.0.0",
     "@azure/identity": "^4.0.1",
-    "@azure/msal-node": "^2.7.0",
+    "@azure/msal-node": "^2.9.2",
     "@azure-tools/test-utils": "^1.0.1",
     "@microsoft/api-extractor": "^7.31.1",
     "@types/chai": "^4.1.6",
  • sdk/identity/identity-broker/CHANGELOG.md+3 −7 modified
    @@ -1,15 +1,11 @@
 # Release History
 
-## 1.0.1 (Unreleased)
-
-### Features Added
-
-### Breaking Changes
-
-### Bugs Fixed
+## 1.0.1 (2024-06-10)
 
 ### Other Changes
 
+- Upgraded @azure/msal-node to the latest version
+
 ## 1.0.0 (2023-11-07)
 
 ### Features Added
  • sdk/identity/identity-broker/package.json+1 −1 modified
    @@ -59,7 +59,7 @@
   "dependencies": {
     "@azure/core-auth": "^1.4.0",
     "@azure/identity": "^4.0.1",
-    "@azure/msal-node": "^2.5.1",
+    "@azure/msal-node": "^2.9.2",
     "@azure/msal-node-extensions": "^1.0.7",
     "tslib": "^2.2.0"
   },
  • sdk/identity/identity-cache-persistence/CHANGELOG.md+3 −7 modified
    @@ -1,15 +1,11 @@
 # Release History
 
-## 1.1.1 (Unreleased)
-
-### Features Added
-
-### Breaking Changes
-
-### Bugs Fixed
+## 1.1.1 (2024-06-10)
 
 ### Other Changes
 
+- Updated msal-node to the latest version
+
 ## 1.1.0 (2024-03-05)
 
 ### Other Changes
  • sdk/identity/identity-cache-persistence/package.json+1 −1 modified
    @@ -61,7 +61,7 @@
   "dependencies": {
     "@azure/core-auth": "^1.5.0",
     "@azure/identity": "^4.0.1",
-    "@azure/msal-node": "^2.5.1",
+    "@azure/msal-node": "^2.9.2",
     "@azure/msal-node-extensions": "^1.0.8",
     "keytar": "^7.6.0",
     "tslib": "^2.2.0"
  • sdk/identity/identity/CHANGELOG.md+6 −0 modified
    @@ -1,5 +1,11 @@
 # Release History
 
+## 4.3.0-beta.2 (2024-06-10)
+
+### Bugs Fixed
+
+- Managed identity bug fixes
+
 ## 4.3.0-beta.1 (2024-05-08)
 
 ### Features Added
  • sdk/identity/identity/package.json+2 −2 modified
    @@ -1,7 +1,7 @@
 {
   "name": "@azure/identity",
   "sdk-type": "client",
-  "version": "4.3.0-beta.1",
+  "version": "4.3.0-beta.2",
   "description": "Provides credential implementations for Azure SDK libraries that can authenticate with Microsoft Entra ID",
   "main": "dist/index.js",
   "module": "dist-esm/src/index.js",
@@ -116,7 +116,7 @@
     "@azure/core-util": "^1.3.0",
     "@azure/logger": "^1.0.0",
     "@azure/msal-browser": "^3.11.1",
-    "@azure/msal-node": "^2.6.6",
+    "@azure/msal-node": "^2.9.2",
     "events": "^3.0.0",
     "jws": "^4.0.0",
     "open": "^8.0.0",
  • sdk/identity/identity/src/constants.ts+1 −1 modified
    @@ -4,7 +4,7 @@
 /**
  * Current version of the `@azure/identity` package.
  */
-export const SDK_VERSION = `4.3.0-beta.1`;
+export const SDK_VERSION = `4.3.0-beta.2`;
 
 /**
  * The default client ID for authentication
  • sdk/identity/identity/src/credentials/managedIdentityCredential/arcMsi.ts+52 −25 modified
    @@ -1,19 +1,20 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 
+import { MSI, MSIConfiguration, MSIToken } from "./models";
 import {
   PipelineRequestOptions,
   createHttpHeaders,
   createPipelineRequest,
 } from "@azure/core-rest-pipeline";
-import { GetTokenOptions } from "@azure/core-auth";
-import { readFile } from "fs";
+
 import { AuthenticationError } from "../../errors";
-import { credentialLogger } from "../../util/logging";
+import { GetTokenOptions } from "@azure/core-auth";
 import { IdentityClient } from "../../client/identityClient";
-import { mapScopesToResource } from "./utils";
-import { MSI, MSIConfiguration, MSIToken } from "./models";
 import { azureArcAPIVersion } from "./constants";
+import { credentialLogger } from "../../util/logging";
+import fs from "node:fs";
+import { mapScopesToResource } from "./utils";
 
 const msiName = "ManagedIdentityCredential - Azure Arc MSI";
 const logger = credentialLogger(msiName);
@@ -60,21 +61,6 @@ function prepareRequestOptions(
   });
 }
 
-/**
- * Retrieves the file contents at the given path using promises.
- * Useful since `fs`'s readFileSync locks the thread, and to avoid extra dependencies.
- */
-function readFileAsync(path: string, options: { encoding: BufferEncoding }): Promise<string> {
-  return new Promise((resolve, reject) =>
-    readFile(path, options, (err, data) => {
-      if (err) {
-        reject(err);
-      }
-      resolve(data);
-    }),
-  );
-}
-
 /**
  * Does a request to the authentication provider that results in a file path.
  */
@@ -103,6 +89,50 @@ async function filePathRequest(
   }
 }
 
+export function platformToFilePath(): string {
+  switch (process.platform) {
+    case "win32":
+      if (!process.env.PROGRAMDATA) {
+        throw new Error(`${msiName}: PROGRAMDATA environment variable has no value.`);
+      }
+      return `${process.env.PROGRAMDATA}\\AzureConnectedMachineAgent\\Tokens`;
+    case "linux":
+      return "/var/opt/azcmagent/tokens";
+    default:
+      throw new Error(`${msiName}: Unsupported platform ${process.platform}.`);
+  }
+}
+
+/**
+ * Validates that a given Azure Arc MSI file path is valid for use.
+ *
+ * A valid file will:
+ * 1. Be in the expected path for the current platform.
+ * 2. Have a `.key` extension.
+ * 3. Be at most 4096 bytes in size.
+ */
+export function validateKeyFile(filePath?: string): asserts filePath is string {
+  if (!filePath) {
+    throw new Error(`${msiName}: Failed to find the token file.`);
+  }
+
+  if (!filePath.endsWith(".key")) {
+    throw new Error(`${msiName}: unexpected file path from HIMDS service: ${filePath}.`);
+  }
+
+  const expectedPath = platformToFilePath();
+  if (!filePath.startsWith(expectedPath)) {
+    throw new Error(`${msiName}: unexpected file path from HIMDS service: ${filePath}.`);
+  }
+
+  const stats = fs.statSync(filePath);
+  if (stats.size > 4096) {
+    throw new Error(
+      `${msiName}: The file at ${filePath} is larger than expected at ${stats.size} bytes.`,
+    );
+  }
+}
+
 /**
  * Defines how to determine whether the Azure Arc MSI is available, and also how to retrieve a token from the Azure Arc MSI.
  */
@@ -150,12 +180,9 @@ export const arcMsi: MSI = {
     };
 
     const filePath = await filePathRequest(identityClient, requestOptions);
+    validateKeyFile(filePath);
 
-    if (!filePath) {
-      throw new Error(`${msiName}: Failed to find the token file.`);
-    }
-
-    const key = await readFileAsync(filePath, { encoding: "utf-8" });
+    const key = await fs.promises.readFile(filePath, { encoding: "utf-8" });
     requestOptions.headers?.set("Authorization", `Basic ${key}`);
 
     const request = createPipelineRequest({
  • sdk/identity/identity/test/internal/node/managedIdentityCredential/arcMsi.spec.ts+85 −0 added
    @@ -0,0 +1,85 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+
+import {
+  platformToFilePath,
+  validateKeyFile,
+} from "../../../../src/credentials/managedIdentityCredential/arcMsi";
+
+import { Context } from "mocha";
+import Sinon from "sinon";
+import { assert } from "chai";
+import fs from "node:fs";
+import path from "node:path";
+
+describe("arcMsi", function () {
+  afterEach(function () {
+    Sinon.restore();
+  });
+
+  describe("validateKeyFile", function () {
+    let expectedDirectory: string;
+
+    beforeEach(function () {
+      if (process.platform !== "win32" && process.platform !== "linux") {
+        // Not supported on this platform
+        this.skip();
+      }
+      expectedDirectory = platformToFilePath();
+    });
+
+    it("succeeds if the file is valid", function (this: Context) {
+      const filePath = path.join(expectedDirectory, "file.key");
+      Sinon.stub(fs, "statSync").returns({ size: 4096 } as any);
+      assert.doesNotThrow(() => validateKeyFile(filePath));
+    });
+
+    it("throws if file path is empty", function () {
+      assert.throws(() => validateKeyFile(""), /Failed to find/);
+      assert.throws(() => validateKeyFile(undefined), /Failed to find/);
+    });
+
+    describe("on Windows", function () {
+      it("throws when the file is not in the expected path", function () {
+        Sinon.stub(process, "platform").value("win32");
+        Sinon.stub(process, "env").get(() => {
+          return {
+            PROGRAMDATA: "C:\\ProgramData",
+          };
+        });
+        assert.throws(() => validateKeyFile("C:\\Users\\user\\file.key"), /unexpected file path/);
+      });
+
+      it("throws if ProgramData is undefined", function () {
+        Sinon.stub(process, "platform").value("win32");
+        Sinon.stub(process, "env").get(() => {
+          return {
+            PROGRAMDATA: undefined,
+          };
+        });
+        assert.throws(
+          () => validateKeyFile("C:\\Users\\user\\file.key"),
+          /PROGRAMDATA environment variable/,
+        );
+      });
+    });
+
+    describe("on Linux", function () {
+      it("throws when the file is not in the expected path", function () {
+        Sinon.stub(process, "platform").value("linux");
+        assert.throws(() => validateKeyFile("/home/user/file.key"), /unexpected file path/);
+      });
+    });
+
+    it("throws if the file extension is not .key", function () {
+      const filePath = path.join(expectedDirectory, "file.pem");
+      assert.throws(() => validateKeyFile(filePath), /unexpected file path/);
+    });
+
+    it("throws if the file size is invalid", function () {
+      const filePath = path.join(expectedDirectory, "file.key");
+      Sinon.stub(fs, "statSync").returns({ size: 4097 } as any);
+      assert.throws(() => validateKeyFile(filePath), /larger than expected/);
+    });
+  });
+});
  • sdk/identity/identity/test/internal/node/managedIdentityCredential.spec.ts+44 −62 modified
    @@ -1,25 +1,27 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 
+import * as arcMsi from "../../../src/credentials/managedIdentityCredential/arcMsi";
+
 import { AzureLogger, setLogLevel } from "@azure/logger";
 import { IdentityTestContextInterface, createResponse } from "../../httpRequestsCommon";
 import {
   imdsApiVersion,
   imdsEndpointPath,
   imdsHost,
 } from "../../../src/credentials/managedIdentityCredential/constants";
-import { imdsMsi } from "../../../src/credentials/managedIdentityCredential/imdsMsi";
-import { mkdtempSync, rmdirSync, unlinkSync, writeFileSync } from "fs";
+
 import { Context } from "mocha";
 import { GetTokenOptions } from "@azure/core-auth";
 import { IdentityTestContext } from "../../httpRequests";
 import { ManagedIdentityCredential } from "../../../src";
 import { RestError } from "@azure/core-rest-pipeline";
 import Sinon from "sinon";
 import { assert } from "chai";
+import fs from "node:fs";
+import { imdsMsi } from "../../../src/credentials/managedIdentityCredential/imdsMsi";
 import { join } from "path";
 import { logger } from "../../../src/credentials/managedIdentityCredential/cloudShellMsi";
-import { tmpdir } from "os";
 
 describe("ManagedIdentityCredential", function () {
   let testContext: IdentityTestContextInterface;
@@ -761,20 +763,32 @@ describe("ManagedIdentityCredential", function () {
     ]);
   });
 
-  it("sends an authorization request correctly in an Azure Arc environment", async function (this: Mocha.Context) {
-    // Trigger Azure Arc behavior by setting environment variables
+  describe("Azure Arc", function () {
+    const keyContents = "challenge key";
+    let expectedDirectory: string;
 
-    process.env.IMDS_ENDPOINT = "http://endpoint";
-    process.env.IDENTITY_ENDPOINT = "http://endpoint";
+    beforeEach(function () {
+      if (process.platform !== "win32" && process.platform !== "linux") {
+        // not supported on this platform
+        this.skip();
+      }
+      expectedDirectory = arcMsi.platformToFilePath();
+
+      // Trigger Azure Arc behavior by setting environment variables
+      process.env.IMDS_ENDPOINT = "http://endpoint";
+      process.env.IDENTITY_ENDPOINT = "http://endpoint";
+      // Stub out a valid key file
+      Sinon.stub(fs, "statSync").returns({ size: 400 } as any);
+      Sinon.stub(fs.promises, "readFile").resolves(keyContents);
+    });
 
-    // eslint-disable-next-line @typescript-eslint/no-invalid-this
-    const testTitle = this.test?.title || `test-Date.time()`;
-    const tempDir = mkdtempSync(join(tmpdir(), testTitle));
-    const tempFile = join(tempDir, testTitle);
-    const key = "challenge key";
-    writeFileSync(tempFile, key, { encoding: "utf8" });
+    afterEach(function () {
+      Sinon.restore();
+    });
+
+    it("sends an authorization request correctly in an Azure Arc environment", async function (this: Mocha.Context) {
+      const tempFile = join(expectedDirectory, "fake.key");
 
-    try {
       const authDetails = await testContext.sendCredentialRequests({
         scopes: ["https://service/.default"],
         credential: new ManagedIdentityCredential(),
@@ -800,6 +814,7 @@ describe("ManagedIdentityCredential", function () {
       assert.equal(validationRequest.method, "GET");
       assert.equal(decodeURIComponent(query.get("resource")!), "https://service");
 
+      assert.exists(process.env.IDENTITY_ENDPOINT);
       assert.ok(
         validationRequest.url.startsWith(process.env.IDENTITY_ENDPOINT),
         "URL does not start with expected host and path",
@@ -813,37 +828,22 @@ describe("ManagedIdentityCredential", function () {
       assert.equal(decodeURIComponent(query.get("resource")!), "https://service");
 
       assert.ok(
-        authRequest.url.startsWith(process.env.IDENTITY_ENDPOINT),
+        authRequest.url.startsWith(process.env.IDENTITY_ENDPOINT!),
         "URL does not start with expected host and path",
       );
 
-      assert.equal(authRequest.headers.Authorization, `Basic ${key}`);
+      assert.equal(authRequest.headers.Authorization, `Basic ${keyContents}`);
       if (authDetails.result!.token) {
         // We use Date.now underneath.
         assert.ok(authDetails.result!.expiresOnTimestamp);
       } else {
         assert.fail("No token was returned!");
       }
-    } finally {
-      unlinkSync(tempFile);
-      rmdirSync(tempDir);
-    }
-  });
-
-  it("sends an authorization request correctly in an Azure Arc environment (with resourceId)", async function (this: Mocha.Context) {
-    // Trigger Azure Arc behavior by setting environment variables
-
-    process.env.IMDS_ENDPOINT = "http://endpoint";
-    process.env.IDENTITY_ENDPOINT = "http://endpoint";
+    });
 
-    // eslint-disable-next-line @typescript-eslint/no-invalid-this
-    const testTitle = this.test?.title || `test-Date.time()`;
-    const tempDir = mkdtempSync(join(tmpdir(), testTitle));
-    const tempFile = join(tempDir, testTitle);
-    const key = "challenge key";
-    writeFileSync(tempFile, key, { encoding: "utf8" });
+    it("sends an authorization request correctly in an Azure Arc environment (with resourceId)", async function (this: Mocha.Context) {
+      const filePath = join(expectedDirectory, "fake.key");
 
-    try {
       const authDetails = await testContext.sendCredentialRequests({
         scopes: ["https://service/.default"],
         credential: new ManagedIdentityCredential({ resourceId: "RESOURCE-ID" }),
@@ -852,7 +852,7 @@ describe("ManagedIdentityCredential", function () {
             401,
             {},
             {
-              "www-authenticate": `we don't pay much attention about this format=${tempFile}`,
+              "www-authenticate": `we don't pay much attention about this format=${filePath}`,
             },
           ),
           createResponse(200, {
@@ -864,20 +864,19 @@ describe("ManagedIdentityCredential", function () {
 
       // File request
       const validationRequest = authDetails.requests[0];
-      console.log(validationRequest.url.split("?")[1]);
       let query = new URLSearchParams(validationRequest.url.split("?")[1]);
 
       assert.equal(validationRequest.method, "GET");
       assert.equal(decodeURIComponent(query.get("resource")!), "https://service");
 
+      assert.exists(process.env.IDENTITY_ENDPOINT);
       assert.ok(
         validationRequest.url.startsWith(process.env.IDENTITY_ENDPOINT),
         "URL does not start with expected host and path",
       );
 
       // Authorization request, which comes after getting the file path, for now at least.
       const authRequest = authDetails.requests[1];
-      console.log(authRequest.url.split("?")[1]);
       query = new URLSearchParams(authRequest.url.split("?")[1]);
 
       assert.equal(authRequest.method, "GET");
@@ -889,33 +888,18 @@ describe("ManagedIdentityCredential", function () {
         "URL does not start with expected host and path",
       );
 
-      assert.equal(authRequest.headers.Authorization, `Basic ${key}`);
+      assert.equal(authRequest.headers.Authorization, `Basic ${keyContents}`);
       if (authDetails.result!.token) {
         // We use Date.now underneath.
         assert.ok(authDetails.result!.expiresOnTimestamp);
       } else {
         assert.fail("No token was returned!");
       }
-    } finally {
-      unlinkSync(tempFile);
-      rmdirSync(tempDir);
-    }
-  });
-
-  it("sends an authorization request correctly in an Azure Arc environment (with clientId)", async function (this: Mocha.Context) {
-    // Trigger Azure Arc behavior by setting environment variables
-
-    process.env.IMDS_ENDPOINT = "http://endpoint";
-    process.env.IDENTITY_ENDPOINT = "http://endpoint";
+    });
 
-    // eslint-disable-next-line @typescript-eslint/no-invalid-this
-    const testTitle = this.test?.title || `test-Date.time()`;
-    const tempDir = mkdtempSync(join(tmpdir(), testTitle));
-    const tempFile = join(tempDir, testTitle);
-    const key = "challenge key";
-    writeFileSync(tempFile, key, { encoding: "utf8" });
+    it("sends an authorization request correctly in an Azure Arc environment (with clientId)", async function (this: Mocha.Context) {
+      const filePath = join(expectedDirectory, "fake.key");
 
-    try {
       const authDetails = await testContext.sendCredentialRequests({
         scopes: ["https://service/.default"],
         credential: new ManagedIdentityCredential({ clientId: "CLIENT-ID" }),
@@ -924,7 +908,7 @@ describe("ManagedIdentityCredential", function () {
             401,
             {},
             {
-              "www-authenticate": `we don't pay much attention about this format=${tempFile}`,
+              "www-authenticate": `we don't pay much attention about this format=${filePath}`,
             },
           ),
           createResponse(200, {
@@ -942,6 +926,7 @@ describe("ManagedIdentityCredential", function () {
       assert.equal(validationRequest.method, "GET");
       assert.equal(decodeURIComponent(query.get("resource")!), "https://service");
 
+      assert.exists(process.env.IDENTITY_ENDPOINT);
       assert.ok(
         validationRequest.url.startsWith(process.env.IDENTITY_ENDPOINT),
         "URL does not start with expected host and path",
@@ -961,17 +946,14 @@ describe("ManagedIdentityCredential", function () {
         "URL does not start with expected host and path",
       );
 
-      assert.equal(authRequest.headers.Authorization, `Basic ${key}`);
+      assert.equal(authRequest.headers.Authorization, `Basic ${keyContents}`);
       if (authDetails.result!.token) {
         // We use Date.now underneath.
         assert.ok(authDetails.result!.expiresOnTimestamp);
       } else {
         assert.fail("No token was returned!");
       }
-    } finally {
-      unlinkSync(tempFile);
-      rmdirSync(tempDir);
-    }
+    });
   });
 
   it("sends an authorization request correctly in an Azure Fabric environment", async () => {
  • sdk/identity/identity/test/internal/node/workloadIdentityCredential.spec.ts+1 −0 modified
    @@ -70,6 +70,7 @@ describe("WorkloadIdentityCredential", function () {
   });
 
   it("authenticates with ManagedIdentity Credential", async function (this: Context) {
+    process.env.AZURE_FEDERATED_TOKEN_FILE = tokenFilePath;
     const credential = new ManagedIdentityCredential("dummy-clientId");
     assert.equal(credential["clientId"], "dummy-clientId");
     const token = await credential.getToken(scope);
  • .vscode/cspell.json+5 −1 modified
    @@ -189,7 +189,7 @@
         "sipx",
         "ssml",
         "unhold",
-		    "Unhold"
+        "Unhold"
       ]
     },
     {
@@ -287,6 +287,10 @@
       "filename": "sdk/identity/**/*.md",
       "words": ["MSAL", "PKCE"]
     },
+    {
+      "filename": "sdk/identity/**/*.ts",
+      "words": ["azcmagent", "HIMDS"]
+    },
     {
       "filename": "sdk/iot/iot-modelsrepository/review/**/*.md",
       "words": ["Dtmi", "dtmis"]
cb065acd7d0f

[Identity] Managed identity bug fix (#36010)

https://github.com/Azure/azure-sdk-for-pythonPaul Van EckJun 10, 2024via ghsa
commit
6 files changed · +309 −18
  • sdk/identity/azure-identity/azure/identity/_credentials/azure_arc.py+55 −1 modified
    @@ -4,6 +4,7 @@
 # ------------------------------------
 import functools
 import os
+import sys
 from typing import Any, Dict, Optional
 
 from azure.core.exceptions import ClientAuthenticationError
@@ -24,7 +25,7 @@ def get_client(self, **kwargs: Any) -> Optional[ManagedIdentityClient]:
             return ManagedIdentityClient(
                 _per_retry_policies=[ArcChallengeAuthPolicy()],
                 request_factory=functools.partial(_get_request, url),
-                **kwargs
+                **kwargs,
             )
         return None
 
@@ -70,6 +71,12 @@ def _get_secret_key(response: PipelineResponse) -> str:
         raise ClientAuthenticationError(
             message="Did not receive a correct value from WWW-Authenticate header: {}".format(header)
         ) from ex
+
+    try:
+        _validate_key_file(key_file)
+    except ValueError as ex:
+        raise ClientAuthenticationError(message="The key file path is invalid: {}".format(ex)) from ex
+
     with open(key_file, "r", encoding="utf-8") as file:
         try:
             return file.read()
@@ -80,6 +87,53 @@ def _get_secret_key(response: PipelineResponse) -> str:
             ) from error
 
 
+def _get_key_file_path() -> str:
+    """Returns the expected path for the Azure Arc MSI key file based on the current platform.
+
+    Only Linux and Windows are supported.
+
+    :return: The expected path.
+    :rtype: str
+    :raises ValueError: If the current platform is not supported.
+    """
+    if sys.platform.startswith("linux"):
+        return "/var/opt/azcmagent/tokens"
+    if sys.platform.startswith("win"):
+        program_data_path = os.environ.get("PROGRAMDATA")
+        if not program_data_path:
+            raise ValueError("PROGRAMDATA environment variable is not set or is empty.")
+        return os.path.join(f"{program_data_path}", "AzureConnectedMachineAgent", "Tokens")
+    raise ValueError(f"Azure Arc MSI is not supported on this platform {sys.platform}")
+
+
+def _validate_key_file(file_path: str) -> None:
+    """Validates that a given Azure Arc MSI file path is valid for use.
+
+    A valid file will:
+        1. Be in the expected path for the current platform.
+        2. Have a `.key` extension.
+        3. Be at most 4096 bytes in size.
+
+    :param str file_path: The path to the key file.
+    :raises ClientAuthenticationError: If the file path is invalid.
+    """
+    if not file_path:
+        raise ValueError("The file path must not be empty.")
+
+    if not os.path.exists(file_path):
+        raise ValueError(f"The file path does not exist: {file_path}")
+
+    expected_directory = _get_key_file_path()
+    if not os.path.dirname(file_path) == expected_directory:
+        raise ValueError(f"Unexpected file path from HIMDS service: {file_path}")
+
+    if not file_path.endswith(".key"):
+        raise ValueError("The file path must have a '.key' extension.")
+
+    if os.path.getsize(file_path) > 4096:
+        raise ValueError("The file size must be less than or equal to 4096 bytes.")
+
+
 class ArcChallengeAuthPolicy(HTTPPolicy):
     """Policy for handling Azure Arc's challenge authentication"""
  • sdk/identity/azure-identity/azure/identity/_version.py+1 −1 modified
    @@ -2,4 +2,4 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT License.
 # ------------------------------------
-VERSION = "1.17.0"
+VERSION = "1.17.0b2"
  • sdk/identity/azure-identity/CHANGELOG.md+11 −1 modified
    @@ -1,11 +1,21 @@
 # Release History
 
-## 1.17.0 (2024-06-11)
+## 1.17.0b2 (2024-06-11)
 
 ### Features Added
 
 - `OnBehalfOfCredential` now supports client assertion callbacks through the `client_assertion_func` keyword argument. This enables authenticating with client assertions such as federated credentials.  ([#35812](https://github.com/Azure/azure-sdk-for-python/pull/35812))
 
+### Bugs Fixed
+
+- Managed identity bug fixes
+
+## 1.16.1 (2024-06-11)
+
+### Bugs Fixed
+
+- Managed identity bug fixes
+
 ## 1.17.0b1 (2024-05-13)
 
 ### Features Added
  • sdk/identity/azure-identity/setup.py+1 −1 modified
    @@ -38,7 +38,7 @@
     url="https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/identity/azure-identity",
     keywords="azure, azure sdk",
     classifiers=[
-        "Development Status :: 5 - Production/Stable",
+        "Development Status :: 4 - Beta",
         "Programming Language :: Python",
         "Programming Language :: Python :: 3 :: Only",
         "Programming Language :: Python :: 3",
  • sdk/identity/azure-identity/tests/test_managed_identity_async.py+117 −6 modified
    @@ -848,9 +848,10 @@ async def test_azure_arc(tmpdir):
         "os.environ",
         {EnvironmentVariables.IDENTITY_ENDPOINT: identity_endpoint, EnvironmentVariables.IMDS_ENDPOINT: imds_endpoint},
     ):
-        token = await ManagedIdentityCredential(transport=transport).get_token(scope)
-        assert token.token == access_token
-        assert token.expires_on == expires_on
+        with mock.patch("azure.identity._credentials.azure_arc._validate_key_file", lambda x: None):
+            token = await ManagedIdentityCredential(transport=transport).get_token(scope)
+            assert token.token == access_token
+            assert token.expires_on == expires_on
 
 
 @pytest.mark.asyncio
@@ -901,9 +902,10 @@ async def test_azure_arc_tenant_id(tmpdir):
         "os.environ",
         {EnvironmentVariables.IDENTITY_ENDPOINT: identity_endpoint, EnvironmentVariables.IMDS_ENDPOINT: imds_endpoint},
     ):
-        token = await ManagedIdentityCredential(transport=transport).get_token(scope, tenant_id="tenant_id")
-        assert token.token == access_token
-        assert token.expires_on == expires_on
+        with mock.patch("azure.identity._credentials.azure_arc._validate_key_file", lambda x: None):
+            token = await ManagedIdentityCredential(transport=transport).get_token(scope, tenant_id="tenant_id")
+            assert token.token == access_token
+            assert token.expires_on == expires_on
 
 
 @pytest.mark.asyncio
@@ -922,6 +924,115 @@ async def test_azure_arc_client_id():
         await credential.get_token("scope")
 
 
+@pytest.mark.asyncio
+async def test_azure_arc_key_too_large(tmp_path):
+    api_version = "2019-11-01"
+    identity_endpoint = "http://localhost:42/token"
+    imds_endpoint = "http://localhost:42"
+    scope = "scope"
+    secret_key = "X" * 4097
+
+    key_file = tmp_path / "key_file.key"
+    key_file.write_text(secret_key)
+    assert key_file.read_text() == secret_key
+
+    transport = async_validating_transport(
+        requests=[
+            Request(
+                base_url=identity_endpoint,
+                method="GET",
+                required_headers={"Metadata": "true"},
+                required_params={"api-version": api_version, "resource": scope},
+            ),
+        ],
+        responses=[
+            mock_response(status_code=401, headers={"WWW-Authenticate": "Basic realm={}".format(key_file)}),
+        ],
+    )
+    with mock.patch(
+        "os.environ",
+        {EnvironmentVariables.IDENTITY_ENDPOINT: identity_endpoint, EnvironmentVariables.IMDS_ENDPOINT: imds_endpoint},
+    ):
+        with mock.patch("azure.identity._credentials.azure_arc._get_key_file_path", lambda: str(tmp_path)):
+            with pytest.raises(ClientAuthenticationError) as ex:
+                await ManagedIdentityCredential(transport=transport).get_token(scope)
+            assert "file size" in str(ex.value)
+
+
+@pytest.mark.asyncio
+async def test_azure_arc_key_not_exist(tmp_path):
+    api_version = "2019-11-01"
+    identity_endpoint = "http://localhost:42/token"
+    imds_endpoint = "http://localhost:42"
+    scope = "scope"
+
+    transport = async_validating_transport(
+        requests=[
+            Request(
+                base_url=identity_endpoint,
+                method="GET",
+                required_headers={"Metadata": "true"},
+                required_params={"api-version": api_version, "resource": scope},
+            ),
+        ],
+        responses=[
+            mock_response(status_code=401, headers={"WWW-Authenticate": "Basic realm=key_file"}),
+        ],
+    )
+    with mock.patch(
+        "os.environ",
+        {EnvironmentVariables.IDENTITY_ENDPOINT: identity_endpoint, EnvironmentVariables.IMDS_ENDPOINT: imds_endpoint},
+    ):
+        with pytest.raises(ClientAuthenticationError) as ex:
+            await ManagedIdentityCredential(transport=transport).get_token(scope)
+        assert "not exist" in str(ex.value)
+
+
+@pytest.mark.asyncio
+async def test_azure_arc_key_invalid(tmp_path):
+    api_version = "2019-11-01"
+    identity_endpoint = "http://localhost:42/token"
+    imds_endpoint = "http://localhost:42"
+    scope = "scope"
+    key_file = tmp_path / "key_file.txt"
+    key_file.write_text("secret")
+
+    transport = async_validating_transport(
+        requests=[
+            Request(
+                base_url=identity_endpoint,
+                method="GET",
+                required_headers={"Metadata": "true"},
+                required_params={"api-version": api_version, "resource": scope},
+            ),
+            Request(
+                base_url=identity_endpoint,
+                method="GET",
+                required_headers={"Metadata": "true"},
+                required_params={"api-version": api_version, "resource": scope},
+            ),
+        ],
+        responses=[
+            mock_response(status_code=401, headers={"WWW-Authenticate": "Basic realm={}".format(key_file)}),
+            mock_response(status_code=401, headers={"WWW-Authenticate": "Basic realm={}".format(key_file)}),
+        ],
+    )
+
+    with mock.patch(
+        "os.environ",
+        {EnvironmentVariables.IDENTITY_ENDPOINT: identity_endpoint, EnvironmentVariables.IMDS_ENDPOINT: imds_endpoint},
+    ):
+        with mock.patch("azure.identity._credentials.azure_arc._get_key_file_path", lambda: "/foo"):
+            with pytest.raises(ClientAuthenticationError) as ex:
+                await ManagedIdentityCredential(transport=transport).get_token(scope)
+            assert "Unexpected file path" in str(ex.value)
+
+        with mock.patch("azure.identity._credentials.azure_arc._get_key_file_path", lambda: str(tmp_path)):
+            with pytest.raises(ClientAuthenticationError) as ex:
+                await ManagedIdentityCredential(transport=transport).get_token(scope)
+            assert "extension" in str(ex.value)
+
+
 @pytest.mark.asyncio
 async def test_token_exchange(tmpdir):
     exchange_token = "exchange-token"
  • sdk/identity/azure-identity/tests/test_managed_identity.py+124 −8 modified
    @@ -3,6 +3,7 @@
 # Licensed under the MIT License.
 # ------------------------------------
 import os
+import sys
 import time
 
 try:
@@ -883,9 +884,10 @@ def test_azure_arc(tmpdir):
         "os.environ",
         {EnvironmentVariables.IDENTITY_ENDPOINT: identity_endpoint, EnvironmentVariables.IMDS_ENDPOINT: imds_endpoint},
     ):
-        token = ManagedIdentityCredential(transport=transport).get_token(scope)
-        assert token.token == access_token
-        assert token.expires_on == expires_on
+        with mock.patch("azure.identity._credentials.azure_arc._validate_key_file", lambda x: None):
+            token = ManagedIdentityCredential(transport=transport).get_token(scope)
+            assert token.token == access_token
+            assert token.expires_on == expires_on
 
 
 def test_azure_arc_tenant_id(tmpdir):
@@ -936,9 +938,10 @@ def test_azure_arc_tenant_id(tmpdir):
         "os.environ",
         {EnvironmentVariables.IDENTITY_ENDPOINT: identity_endpoint, EnvironmentVariables.IMDS_ENDPOINT: imds_endpoint},
     ):
-        token = ManagedIdentityCredential(transport=transport).get_token(scope, tenant_id="tenant_id")
-        assert token.token == access_token
-        assert token.expires_on == expires_on
+        with mock.patch("azure.identity._credentials.azure_arc._validate_key_file", lambda x: None):
+            token = ManagedIdentityCredential(transport=transport).get_token(scope, tenant_id="tenant_id")
+            assert token.token == access_token
+            assert token.expires_on == expires_on
 
 
 def test_azure_arc_client_id():
@@ -950,10 +953,123 @@ def test_azure_arc_client_id():
             EnvironmentVariables.IMDS_ENDPOINT: "http://localhost:42",
         },
     ):
-        credential = ManagedIdentityCredential(client_id="some-guid")
+        with mock.patch("azure.identity._credentials.azure_arc._validate_key_file", lambda x: None):
+            credential = ManagedIdentityCredential(client_id="some-guid")
 
-    with pytest.raises(ClientAuthenticationError):
+    with pytest.raises(ClientAuthenticationError) as ex:
         credential.get_token("scope")
+    assert "not supported" in str(ex.value)
+
+
+def test_azure_arc_key_too_large(tmp_path):
+
+    api_version = "2019-11-01"
+    identity_endpoint = "http://localhost:42/token"
+    imds_endpoint = "http://localhost:42"
+    scope = "scope"
+    secret_key = "X" * 4097
+
+    key_file = tmp_path / "key_file.key"
+    key_file.write_text(secret_key)
+    assert key_file.read_text() == secret_key
+
+    transport = validating_transport(
+        requests=[
+            Request(
+                base_url=identity_endpoint,
+                method="GET",
+                required_headers={"Metadata": "true"},
+                required_params={"api-version": api_version, "resource": scope},
+            ),
+        ],
+        responses=[
+            mock_response(status_code=401, headers={"WWW-Authenticate": "Basic realm={}".format(key_file)}),
+        ],
+    )
+
+    with mock.patch(
+        "os.environ",
+        {EnvironmentVariables.IDENTITY_ENDPOINT: identity_endpoint, EnvironmentVariables.IMDS_ENDPOINT: imds_endpoint},
+    ):
+        with mock.patch("azure.identity._credentials.azure_arc._get_key_file_path", lambda: str(tmp_path)):
+            with pytest.raises(ClientAuthenticationError) as ex:
+                ManagedIdentityCredential(transport=transport).get_token(scope)
+            assert "file size" in str(ex.value)
+
+
+def test_azure_arc_key_not_exist(tmp_path):
+
+    api_version = "2019-11-01"
+    identity_endpoint = "http://localhost:42/token"
+    imds_endpoint = "http://localhost:42"
+    scope = "scope"
+
+    transport = validating_transport(
+        requests=[
+            Request(
+                base_url=identity_endpoint,
+                method="GET",
+                required_headers={"Metadata": "true"},
+                required_params={"api-version": api_version, "resource": scope},
+            ),
+        ],
+        responses=[
+            mock_response(status_code=401, headers={"WWW-Authenticate": "Basic realm=/path/to/key_file"}),
+        ],
+    )
+
+    with mock.patch(
+        "os.environ",
+        {EnvironmentVariables.IDENTITY_ENDPOINT: identity_endpoint, EnvironmentVariables.IMDS_ENDPOINT: imds_endpoint},
+    ):
+        with pytest.raises(ClientAuthenticationError) as ex:
+            ManagedIdentityCredential(transport=transport).get_token(scope)
+        assert "not exist" in str(ex.value)
+
+
+def test_azure_arc_key_invalid(tmp_path):
+
+    api_version = "2019-11-01"
+    identity_endpoint = "http://localhost:42/token"
+    imds_endpoint = "http://localhost:42"
+    scope = "scope"
+    key_file = tmp_path / "key_file.txt"
+    key_file.write_text("secret")
+
+    transport = validating_transport(
+        requests=[
+            Request(
+                base_url=identity_endpoint,
+                method="GET",
+                required_headers={"Metadata": "true"},
+                required_params={"api-version": api_version, "resource": scope},
+            ),
+            Request(
+                base_url=identity_endpoint,
+                method="GET",
+                required_headers={"Metadata": "true"},
+                required_params={"api-version": api_version, "resource": scope},
+            ),
+        ],
+        responses=[
+            mock_response(status_code=401, headers={"WWW-Authenticate": "Basic realm={}".format(key_file)}),
+            mock_response(status_code=401, headers={"WWW-Authenticate": "Basic realm={}".format(key_file)}),
+        ],
+    )
+
+    with mock.patch(
+        "os.environ",
+        {EnvironmentVariables.IDENTITY_ENDPOINT: identity_endpoint, EnvironmentVariables.IMDS_ENDPOINT: imds_endpoint},
+    ):
+        with mock.patch("azure.identity._credentials.azure_arc._get_key_file_path", lambda: "/foo"):
+            with pytest.raises(ClientAuthenticationError) as ex:
+                ManagedIdentityCredential(transport=transport).get_token(scope)
+            assert "Unexpected file path" in str(ex.value)
+
+        with mock.patch("azure.identity._credentials.azure_arc._get_key_file_path", lambda: str(tmp_path)):
+            with pytest.raises(ClientAuthenticationError) as ex:
+                ManagedIdentityCredential(transport=transport).get_token(scope)
+            assert "extension" in str(ex.value)
 
 
 def test_token_exchange(tmpdir):
9279a4f38bf6

MI fixes (#44483)

https://github.com/Azure/azure-sdk-for-netChristopher ScottJun 10, 2024via ghsa
commit
4 files changed · +121 −7
  • sdk/identity/Azure.Identity/CHANGELOG.md+9 −7 modified
    @@ -1,22 +1,19 @@
 # Release History
 
-## 1.12.0-beta.3 (Unreleased)
+## 1.12.0-beta.3 (2024-06-11)
 
 ### Features Added
 - `OnBehalfOfCredential` now supports client assertion callbacks for acquiring tokens on behalf of a user.
 - All credentials now support setting RefreshOn value if received from MSAL.
 - ManagedIdentityCredential sets RefreshOn value of half the token lifetime for AccessTokens with an ExpiresOn value greater than 2 hours in the future.
 
-### Breaking Changes
-
 ### Bugs Fixed
+- Managed identity bug fixes.
 
-### Other Changes
-
-## 1.11.3 (2024-05-07)
+## 1.11.4 (2024-06-10)
 
 ### Bugs Fixed
-- Fixed a regression in `DefaultAzureCredential` probe request behavior for IMDS managed identity environments. [#43796](https://github.com/Azure/azure-sdk-for-net/issues/43796)
+- Managed identity bug fixes.
 
 ## 1.12.0-beta.2 (2024-05-07)
 
@@ -27,6 +24,11 @@
 ### Bugs Fixed
 - Fixed a regression in `DefaultAzureCredential` probe request behavior for IMDS managed identity environments. [#43796](https://github.com/Azure/azure-sdk-for-net/issues/43796)
 
+## 1.11.3 (2024-05-07)
+
+### Bugs Fixed
+- Fixed a regression in `DefaultAzureCredential` probe request behavior for IMDS managed identity environments. [#43796](https://github.com/Azure/azure-sdk-for-net/issues/43796)
+
 ## 1.12.0-beta.1 (2024-04-23)
 
 ### Bugs Fixed
  • sdk/identity/Azure.Identity/src/AzureArcManagedIdentitySource.cs+37 −0 modified
    @@ -88,7 +88,9 @@ protected override async ValueTask<AccessToken> HandleResponseAsync(bool async,
                 {
                     throw new AuthenticationFailedException(InvalidChallangeErrorMessage);
                 }
+                string filePath = splitChallenge[1];
 
+                ValidatePath(filePath);
                 var authHeaderValue = "Basic " + File.ReadAllText(splitChallenge[1]);
 
                 using Request request = CreateRequest(context.Scopes);
@@ -112,5 +114,40 @@ protected override async ValueTask<AccessToken> HandleResponseAsync(bool async,
 
             return await base.HandleResponseAsync(async, context, message, cancellationToken).ConfigureAwait(false);
         }
+
+        private void ValidatePath(string filePath)
+        {
+            // check that the file ends with '.key'
+            if (!filePath.EndsWith(".key"))
+            {
+                throw new AuthenticationFailedException("The secret key file failed validation. File name is invalid.");
+            }
+            // if the current platform is windows check that the file is in the path %ProgramData%\AzureConnectedMachineAgent\Tokens
+            if (Environment.OSVersion.Platform == PlatformID.Win32NT)
+            {
+                var programData = Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData);
+                var expectedPath = Path.Combine(programData, "AzureConnectedMachineAgent", "Tokens");
+                if (!filePath.StartsWith(expectedPath))
+                {
+                    throw new AuthenticationFailedException("The secret key file failed validation. File path is invalid.");
+                }
+            }
+
+            // if the current platform is linux check that the file is in the path /var/opt/azcmagent/tokens
+            if (Environment.OSVersion.Platform == PlatformID.Unix)
+            {
+                var expectedPath = Path.Combine("/", "var", "opt", "azcmagent", "tokens");
+                if (!filePath.StartsWith(expectedPath))
+                {
+                    throw new AuthenticationFailedException("The secret key file failed validation. File path is invalid.");
+                }
+            }
+
+            // Check that the file length is no larger than 4096 bytes
+            if (new FileInfo(filePath).Length > 4096)
+            {
+                throw new AuthenticationFailedException("The secret key file failed validation. File is too large.");
+            }
+        }
     }
 }
  • sdk/identity/Azure.Identity/tests/ManagedIdentityCredentialArcLiveTests.cs+1 −0 modified
    @@ -18,6 +18,7 @@ public ManagedIdentityCredentialArcLiveTests(bool isAsync) : base(isAsync)
 
         [NonParallelizable]
         [Test]
+        [LiveOnly(Reason = "path validation fails in playback mode")]
         public async Task ValidateSystemAssignedIdentity()
         {
             if (string.IsNullOrEmpty(TestEnvironment.ArcEnable))
  • sdk/identity/Azure.Identity/tests/ManagedIdentityCredentialTests.cs+74 −0 modified
    @@ -853,6 +853,80 @@ public async Task VerifyAuthenticationFailedExceptionsAreDeferredToGetToken(Dict
             await Task.CompletedTask;
         }
 
+        [Test]
+        public void VerifyArcIdentitySourceFilePathValidation_DoesNotEndInDotKey()
+        {
+            using var environment = new TestEnvVar(
+                new()
+                {
+                    { "MSI_ENDPOINT", null },
+                    { "MSI_SECRET", null },
+                    { "IDENTITY_ENDPOINT", "https://identity.constoso.com" },
+                    { "IMDS_ENDPOINT", "https://imds.constoso.com" },
+                    { "IDENTITY_HEADER", null },
+                    { "AZURE_POD_IDENTITY_AUTHORITY_HOST", null }
+                });
+
+            var mockTransport = new MockTransport(request =>
+            {
+                var response = new MockResponse(401);
+                if (Environment.OSVersion.Platform == PlatformID.Win32NT)
+                {
+                    response.AddHeader("WWW-Authenticate", "file=c:\\ProgramData\\AzureConnectedMachineAgent\\Tokens\\secret.foo");
+                }
+                else
+                {
+                    response.AddHeader("WWW-Authenticate", "file=/var/opt/azcmagent/tokens/secret.foo");
+                }
+                return response;
+            });
+            var options = new TokenCredentialOptions() { Transport = mockTransport };
+            options.Retry.MaxDelay = TimeSpan.Zero;
+            var pipeline = CredentialPipeline.GetInstance(options);
+
+            ManagedIdentityCredential credential = InstrumentClient(new ManagedIdentityCredential(null, pipeline));
+
+            var ex = Assert.ThrowsAsync<AuthenticationFailedException>(async () => await credential.GetTokenAsync(new TokenRequestContext(MockScopes.Default)));
+            Assert.That(ex.Message, Does.Contain("File name is invalid."));
+        }
+
+        [Test]
+        public void VerifyArcIdentitySourceFilePathValidation_FilePathInvalid()
+        {
+            using var environment = new TestEnvVar(
+                new()
+                {
+                    { "MSI_ENDPOINT", null },
+                    { "MSI_SECRET", null },
+                    { "IDENTITY_ENDPOINT", "https://identity.constoso.com" },
+                    { "IMDS_ENDPOINT", "https://imds.constoso.com" },
+                    { "IDENTITY_HEADER", null },
+                    { "AZURE_POD_IDENTITY_AUTHORITY_HOST", null }
+                });
+
+            var mockTransport = new MockTransport(request =>
+            {
+                var response = new MockResponse(401);
+                if (Environment.OSVersion.Platform == PlatformID.Win32NT)
+                {
+                    response.AddHeader("WWW-Authenticate", "file=c:\\ProgramData\\bugus\\AzureConnectedMachineAgent\\Tokens\\secret.key");
+                }
+                else
+                {
+                    response.AddHeader("WWW-Authenticate", "file=/var/opt/bogus/azcmagent/tokens/secret.key");
+                }
+                return response;
+            });
+            var options = new TokenCredentialOptions() { Transport = mockTransport };
+            options.Retry.MaxDelay = TimeSpan.Zero;
+            var pipeline = CredentialPipeline.GetInstance(options);
+
+            ManagedIdentityCredential credential = InstrumentClient(new ManagedIdentityCredential(null, pipeline));
+
+            var ex = Assert.ThrowsAsync<AuthenticationFailedException>(async () => await credential.GetTokenAsync(new TokenRequestContext(MockScopes.Default)));
+            Assert.That(ex.Message, Does.Contain("File path is invalid."));
+        }
+
         private static IEnumerable<TestCaseData> ResourceAndClientIds()
         {
             yield return new TestCaseData(new object[] { null, false });
50774cd97099

managed identity bug fixes

https://github.com/Azure/azure-sdk-for-goCharles LowellMay 22, 2024via ghsa
commit
3 files changed · +106 −22
  • sdk/azidentity/CHANGELOG.md+3 −0 modified
    @@ -11,6 +11,9 @@
 * Removed `AzurePipelinesCredential` and the persistent token caching API.
   They will return in v1.7.0-beta.1
 
+### Bugs Fixed
+* Managed identity bug fixes
+
 ## 1.6.0-beta.4 (2024-05-14)
 
 ### Features Added
  • sdk/azidentity/managed_identity_client.go+49 −21 modified
    @@ -14,13 +14,15 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"path/filepath"
+	"runtime"
 	"strconv"
 	"strings"
 	"time"
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
+	azruntime "github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/streaming"
 	"github.com/Azure/azure-sdk-for-go/sdk/internal/log"
 	"github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential"
@@ -65,6 +67,18 @@ type managedIdentityClient struct {
 	probeIMDS bool
 }
 
+// arcKeyDirectory returns the directory expected to contain Azure Arc keys
+var arcKeyDirectory = func() (string, error) {
+	switch runtime.GOOS {
+	case "linux":
+		return "/var/opt/azcmagent/tokens", nil
+	case "windows":
+		return filepath.Join(os.Getenv("ProgramData"), "AzureConnectedMachineAgent", "Tokens"), nil
+	default:
+		return "", fmt.Errorf("unsupported OS %q", runtime.GOOS)
+	}
+}
+
 type wrappedNumber json.Number
 
 func (n *wrappedNumber) UnmarshalJSON(b []byte) error {
@@ -152,8 +166,8 @@ func newManagedIdentityClient(options *ManagedIdentityCredentialOptions) (*manag
 		setIMDSRetryOptionDefaults(&cp.Retry)
 	}
 
-	client, err := azcore.NewClient(module, version, runtime.PipelineOptions{
-		Tracing: runtime.TracingOptions{
+	client, err := azcore.NewClient(module, version, azruntime.PipelineOptions{
+		Tracing: azruntime.TracingOptions{
 			Namespace: traceNamespace,
 		},
 	}, &cp)
@@ -188,7 +202,7 @@ func (c *managedIdentityClient) authenticate(ctx context.Context, id ManagedIDKi
 		cx, cancel := context.WithTimeout(ctx, imdsProbeTimeout)
 		defer cancel()
 		cx = policy.WithRetryOptions(cx, policy.RetryOptions{MaxRetries: -1})
-		req, err := runtime.NewRequest(cx, http.MethodGet, c.endpoint)
+		req, err := azruntime.NewRequest(cx, http.MethodGet, c.endpoint)
 		if err == nil {
 			_, err = c.azClient.Pipeline().Do(req)
 		}
@@ -213,7 +227,7 @@ func (c *managedIdentityClient) authenticate(ctx context.Context, id ManagedIDKi
 		return azcore.AccessToken{}, newAuthenticationFailedError(credNameManagedIdentity, err.Error(), nil, err)
 	}
 
-	if runtime.HasStatusCode(resp, http.StatusOK, http.StatusCreated) {
+	if azruntime.HasStatusCode(resp, http.StatusOK, http.StatusCreated) {
 		return c.createAccessToken(resp)
 	}
 
@@ -224,14 +238,14 @@ func (c *managedIdentityClient) authenticate(ctx context.Context, id ManagedIDKi
 				return azcore.AccessToken{}, newAuthenticationFailedError(credNameManagedIdentity, "the requested identity isn't assigned to this resource", resp, nil)
 			}
 			msg := "failed to authenticate a system assigned identity"
-			if body, err := runtime.Payload(resp); err == nil && len(body) > 0 {
+			if body, err := azruntime.Payload(resp); err == nil && len(body) > 0 {
 				msg += fmt.Sprintf(". The endpoint responded with %s", body)
 			}
 			return azcore.AccessToken{}, newCredentialUnavailableError(credNameManagedIdentity, msg)
 		case http.StatusForbidden:
 			// Docker Desktop runs a proxy that responds 403 to IMDS token requests. If we get that response,
 			// we return credentialUnavailableError so credential chains continue to their next credential
-			body, err := runtime.Payload(resp)
+			body, err := azruntime.Payload(resp)
 			if err == nil && strings.Contains(string(body), "unreachable") {
 				return azcore.AccessToken{}, newCredentialUnavailableError(credNameManagedIdentity, fmt.Sprintf("unexpected response %q", string(body)))
 			}
@@ -249,7 +263,7 @@ func (c *managedIdentityClient) createAccessToken(res *http.Response) (azcore.Ac
 		ExpiresIn    wrappedNumber `json:"expires_in,omitempty"` // this field should always return the number of seconds for which a token is valid
 		ExpiresOn    interface{}   `json:"expires_on,omitempty"` // the value returned in this field varies between a number and a date string
 	}{}
-	if err := runtime.UnmarshalAsJSON(res, &value); err != nil {
+	if err := azruntime.UnmarshalAsJSON(res, &value); err != nil {
 		return azcore.AccessToken{}, fmt.Errorf("internal AccessToken: %v", err)
 	}
 	if value.ExpiresIn != "" {
@@ -299,7 +313,7 @@ func (c *managedIdentityClient) createAuthRequest(ctx context.Context, id Manage
 }
 
 func (c *managedIdentityClient) createIMDSAuthRequest(ctx context.Context, id ManagedIDKind, scopes []string) (*policy.Request, error) {
-	request, err := runtime.NewRequest(ctx, http.MethodGet, c.endpoint)
+	request, err := azruntime.NewRequest(ctx, http.MethodGet, c.endpoint)
 	if err != nil {
 		return nil, err
 	}
@@ -319,7 +333,7 @@ func (c *managedIdentityClient) createIMDSAuthRequest(ctx context.Context, id Ma
 }
 
 func (c *managedIdentityClient) createAppServiceAuthRequest(ctx context.Context, id ManagedIDKind, scopes []string) (*policy.Request, error) {
-	request, err := runtime.NewRequest(ctx, http.MethodGet, c.endpoint)
+	request, err := azruntime.NewRequest(ctx, http.MethodGet, c.endpoint)
 	if err != nil {
 		return nil, err
 	}
@@ -339,7 +353,7 @@ func (c *managedIdentityClient) createAppServiceAuthRequest(ctx context.Context,
 }
 
 func (c *managedIdentityClient) createAzureMLAuthRequest(ctx context.Context, id ManagedIDKind, scopes []string) (*policy.Request, error) {
-	request, err := runtime.NewRequest(ctx, http.MethodGet, c.endpoint)
+	request, err := azruntime.NewRequest(ctx, http.MethodGet, c.endpoint)
 	if err != nil {
 		return nil, err
 	}
@@ -362,7 +376,7 @@ func (c *managedIdentityClient) createAzureMLAuthRequest(ctx context.Context, id
 }
 
 func (c *managedIdentityClient) createServiceFabricAuthRequest(ctx context.Context, id ManagedIDKind, scopes []string) (*policy.Request, error) {
-	request, err := runtime.NewRequest(ctx, http.MethodGet, c.endpoint)
+	request, err := azruntime.NewRequest(ctx, http.MethodGet, c.endpoint)
 	if err != nil {
 		return nil, err
 	}
@@ -385,7 +399,7 @@ func (c *managedIdentityClient) createServiceFabricAuthRequest(ctx context.Conte
 
 func (c *managedIdentityClient) getAzureArcSecretKey(ctx context.Context, resources []string) (string, error) {
 	// create the request to retreive the secret key challenge provided by the HIMDS service
-	request, err := runtime.NewRequest(ctx, http.MethodGet, c.endpoint)
+	request, err := azruntime.NewRequest(ctx, http.MethodGet, c.endpoint)
 	if err != nil {
 		return "", err
 	}
@@ -407,22 +421,36 @@ func (c *managedIdentityClient) getAzureArcSecretKey(ctx context.Context, resour
 	}
 	header := response.Header.Get("WWW-Authenticate")
 	if len(header) == 0 {
-		return "", errors.New("did not receive a value from WWW-Authenticate header")
+		return "", errors.New("response has no WWW-Authenticate header")
 	}
 	// the WWW-Authenticate header is expected in the following format: Basic realm=/some/file/path.key
-	pos := strings.LastIndex(header, "=")
-	if pos == -1 {
-		return "", fmt.Errorf("did not receive a correct value from WWW-Authenticate header: %s", header)
+	_, p, found := strings.Cut(header, "=")
+	if !found {
+		return "", fmt.Errorf("unexpected WWW-Authenticate header: %s", header)
+	}
+	expected, err := arcKeyDirectory()
+	if err != nil {
+		return "", err
+	}
+	if filepath.Dir(p) != expected || !strings.HasSuffix(p, ".key") {
+		return "", fmt.Errorf("unexpected file path from HIMDS service: %s", p)
+	}
+	f, err := os.Stat(p)
+	if err != nil {
+		return "", fmt.Errorf("could not stat %q: %v", p, err)
+	}
+	if s := f.Size(); s > 4096 {
+		return "", fmt.Errorf("key is too large (%d bytes)", s)
 	}
-	key, err := os.ReadFile(header[pos+1:])
+	key, err := os.ReadFile(p)
 	if err != nil {
-		return "", fmt.Errorf("could not read file (%s) contents: %v", header[pos+1:], err)
+		return "", fmt.Errorf("could not read %q: %v", p, err)
 	}
 	return string(key), nil
 }
 
 func (c *managedIdentityClient) createAzureArcAuthRequest(ctx context.Context, id ManagedIDKind, resources []string, key string) (*policy.Request, error) {
-	request, err := runtime.NewRequest(ctx, http.MethodGet, c.endpoint)
+	request, err := azruntime.NewRequest(ctx, http.MethodGet, c.endpoint)
 	if err != nil {
 		return nil, err
 	}
@@ -444,7 +472,7 @@ func (c *managedIdentityClient) createAzureArcAuthRequest(ctx context.Context, i
 }
 
 func (c *managedIdentityClient) createCloudShellAuthRequest(ctx context.Context, id ManagedIDKind, scopes []string) (*policy.Request, error) {
-	request, err := runtime.NewRequest(ctx, http.MethodPost, c.endpoint)
+	request, err := azruntime.NewRequest(ctx, http.MethodPost, c.endpoint)
 	if err != nil {
 		return nil, err
 	}
  • sdk/azidentity/managed_identity_credential_test.go+54 −1 modified
    @@ -7,6 +7,7 @@
 package azidentity
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
@@ -32,7 +33,11 @@ const (
 )
 
 func TestManagedIdentityCredential_AzureArc(t *testing.T) {
-	file, err := os.Create(filepath.Join(t.TempDir(), "arc.key"))
+	d := t.TempDir()
+	before := arcKeyDirectory
+	arcKeyDirectory = func() (string, error) { return d, nil }
+	defer func() { arcKeyDirectory = before }()
+	file, err := os.Create(filepath.Join(d, "arc.key"))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -150,6 +155,54 @@ func TestManagedIdentityCredential_AzureArcErrors(t *testing.T) {
 			t.Fatal("expected an error")
 		}
 	})
+	t.Run("key too large", func(t *testing.T) {
+		d := t.TempDir()
+		f := filepath.Join(d, "test.key")
+		err := os.WriteFile(f, bytes.Repeat([]byte("."), 4097), 0600)
+		require.NoError(t, err)
+		before := arcKeyDirectory
+		arcKeyDirectory = func() (string, error) { return d, nil }
+		defer func() { arcKeyDirectory = before }()
+		srv, close := mock.NewServer(mock.WithTransformAllRequestsToTestServerUrl())
+		defer close()
+		srv.AppendResponse(
+			mock.WithHeader("WWW-Authenticate", "Basic realm="+f),
+			mock.WithStatusCode(http.StatusUnauthorized),
+		)
+		cred, err := NewManagedIdentityCredential(&ManagedIdentityCredentialOptions{ClientOptions: azcore.ClientOptions{Transport: srv}})
+		require.NoError(t, err)
+		_, err = cred.GetToken(context.Background(), testTRO)
+		require.ErrorContains(t, err, "too large")
+	})
+	t.Run("unexpected file paths", func(t *testing.T) {
+		d, err := arcKeyDirectory()
+		if err != nil {
+			// test is running on an unsupported OS e.g. darwin
+			t.Skip(err)
+		}
+		srv, close := mock.NewServer(mock.WithTransformAllRequestsToTestServerUrl())
+		defer close()
+		srv.AppendResponse(
+			// unexpected directory
+			mock.WithHeader("WWW-Authenticate", "Basic realm="+filepath.Join("foo", "bar.key")),
+			mock.WithStatusCode(http.StatusUnauthorized),
+		)
+		o := ManagedIdentityCredentialOptions{ClientOptions: azcore.ClientOptions{Transport: srv}}
+		cred, err := NewManagedIdentityCredential(&o)
+		require.NoError(t, err)
+		_, err = cred.GetToken(context.Background(), testTRO)
+		require.ErrorContains(t, err, "unexpected file path")
+
+		srv.AppendResponse(
+			// unexpected extension
+			mock.WithHeader("WWW-Authenticate", "Basic realm="+filepath.Join(d, "foo")),
+			mock.WithStatusCode(http.StatusUnauthorized),
+		)
+		cred, err = NewManagedIdentityCredential(&o)
+		require.NoError(t, err)
+		_, err = cred.GetToken(context.Background(), testTRO)
+		require.ErrorContains(t, err, "unexpected file path")
+	})
 }
 
 func TestManagedIdentityCredential_AzureContainerInstanceLive(t *testing.T) {

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.