Skip to content

Conversation

isra-fel
Copy link
Member

Description

This pull request introduces support for claims challenge authentication in the Connect-AzAccount cmdlet and refines error handling for policy violations related to Multi-Factor Authentication (MFA). Key changes include the addition of a new parameter, improved error messages, and updates to authentication logic across multiple files.

Claims Challenge Authentication Enhancements:

  • Added a new -ClaimsChallenge parameter to the Connect-AzAccount cmdlet to support claims challenge authentication for MFA. [1] [2]
  • Updated authentication logic in RMProfileClient and ContextAdapter to handle claims challenges, including parsing and processing claims challenge strings. [1] [2]

Error Handling Improvements:

  • Refined error messages for MFA-related policy violations to provide actionable guidance, including replacing AuthenticationFailedException with AzPSAuthenticationFailedException for better clarity. [1] [2]
  • Added localized error message for invalid claims challenge format in Resources.resx. [1] [2]

Mandatory Checklist

  • SHOULD update ChangeLog.md file(s) appropriately
    • Update src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.
      • A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header in the past tense.
    • Should not change ChangeLog.md if no new release is required, such as fixing test case only.
  • SHOULD regenerate markdown help files if there is cmdlet API change. Instruction
  • SHOULD have proper test coverage for changes in pull request.
  • SHOULD NOT adjust version of module manually in pull request

@Copilot Copilot AI review requested due to automatic review settings July 16, 2025 07:07
Copy link

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

@isra-fel
Copy link
Member Author

isra-fel commented Jul 16, 2025

Updates are aleady reviewed and the PR can be squashed

Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds support for claims challenge authentication to Connect-AzAccount and improves error handling for MFA policy violations.

  • Introduces a new -ClaimsChallenge parameter and propagates it through authentication flows.
  • Implements parsing, formatting, and processing of claims challenges in MSAL and HTTP handlers.
  • Refines exception types and error messages, including localized resources and updated tests.

Reviewed Changes

Copilot reviewed 17 out of 19 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
src/Accounts/Authenticators/MsalAccessToken.cs Implemented IClaimsChallengeProcessor and OnClaimsChallenageAsync.
src/Accounts/Authenticators/InteractiveWamAuthenticator.cs Pass claimsChallenge into TokenRequestContext.
src/Accounts/Authenticators/InteractiveUserAuthenticator.cs Pass claimsChallenge into TokenRequestContext.
src/Accounts/Authentication/Utilities/ClaimsChallengeUtilities.cs Added parsing and formatting utilities for claims challenges.
src/Accounts/Authentication/Properties/Resources.resx Added localized error message for invalid claims challenge format.
src/Accounts/Authentication/Factories/AuthenticationFactory.cs Extended factory overloads to accept claimsChallenge.
src/Accounts/Authentication/ClaimsChallengeHandler.cs Updated HTTP handler to process claims challenges and throw AzPSAuthenticationFailedException.
src/Accounts/Authentication/Authentication/Parameters/InteractiveWamParameters.cs Added ClaimsChallenge property.
src/Accounts/Authentication/Authentication/Parameters/InteractiveParameters.cs Added ClaimsChallenge property.
src/Accounts/Authentication/Authentication/IClaimsChallengeProcessor.cs Updated documentation for OnClaimsChallenageAsync.
src/Accounts/Accounts/help/Connect-AzAccount.md Updated help examples and parameter listings for -ClaimsChallenge.
src/Accounts/Accounts/Properties/Resources.resx Added InvalidClaimsChallenge resource entry.
src/Accounts/Accounts/Models/RMProfileClient.cs Extended AcquireAccessToken and Login to accept claimsChallenge.
src/Accounts/Accounts/CommonModule/ContextAdapter.cs Adapted context authentication to handle claims challenges.
src/Accounts/Accounts/ChangeLog.md Updated changelog for upcoming release.
src/Accounts/Accounts/Account/ConnectAzureRmAccount.cs Added parameter and parsing logic for -ClaimsChallenge.
src/Accounts/Accounts.Test/SilentReAuthByTenantCmdletTest.cs Updated tests to expect AzPSAuthenticationFailedException.
Files not reviewed (2)
  • src/Accounts/Accounts/Properties/Resources.Designer.cs: Language not supported
  • src/Accounts/Authentication/Properties/Resources.Designer.cs: Language not supported
Comments suppressed due to low confidence (6)

src/Accounts/Authenticators/MsalAccessToken.cs:136

  • The method name 'OnClaimsChallenageAsync' contains a typo (Challenage → Challenge). Consider renaming it to 'OnClaimsChallengeAsync' for clarity.
        public async ValueTask<bool> OnClaimsChallenageAsync(HttpRequestMessage request, string claimsChallenge, CancellationToken cancellationToken)

src/Accounts/Authentication/Factories/AuthenticationFactory.cs:224

  • [nitpick] Typo in variable name 'authParamters'. It should be 'authParameters' to match standard naming conventions.
            var authParamters = GetAuthenticationParameters(tokenCacheProvider, account, environment, tenant, password, promptBehavior, promptAction, claimsChallenge, tokenCache, resourceId);

src/Accounts/Authentication/Authentication/Parameters/InteractiveWamParameters.cs:24

  • [nitpick] Add an XML doc-comment describing the purpose of the new ClaimsChallenge property.
        public string ClaimsChallenge { get; set; }

src/Accounts/Authentication/Authentication/Parameters/InteractiveParameters.cs:24

  • [nitpick] Add an XML doc-comment describing the purpose of the new ClaimsChallenge property.
        public string ClaimsChallenge { get; set; }

src/Accounts/Accounts/help/Connect-AzAccount.md:21

  • [nitpick] The [<CommonParameters>] line is detached from the main parameter list. Merge it into the previous line to maintain proper code example formatting.
 [<CommonParameters>]

src/Accounts/Accounts/Properties/Resources.resx:640

  • [nitpick] The new resource 'InvalidClaimsChallenge' is missing a <comment> element. Consider adding one to clarify usage or placeholders.
  <data name="InvalidClaimsChallenge" xml:space="preserve">

/// <param name="request"></param>
/// <param name="claimsChallenge"></param>
/// <param name="cancellationToken"></param>
/// <returns>A boolean indicated whether the request should be retried. Throws if the reauth fails.</returns>
Copy link

Copilot AI Jul 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] Grammar in the <returns> comment should use 'indicates' instead of 'indicated' to read: 'A boolean indicates whether…'.

Suggested change
/// <returns>A boolean indicated whether the request should be retried. Throws if the reauth fails.</returns>
/// <returns>A boolean indicates whether the request should be retried. Throws if the reauth fails.</returns>

Copilot uses AI. Check for mistakes.

{
return Enumerable.Repeat(response, 1)
.Where(r => r.MatchClaimsChallengePattern())
.Select(r => r.Headers.WwwAuthenticate.FirstOrDefault().ToString())
Copy link

Copilot AI Jul 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Calling .ToString() on FirstOrDefault() can throw a NullReferenceException when there is no WWW-Authenticate header. Add a filter or null-check before invoking .ToString().

Suggested change
.Select(r => r.Headers.WwwAuthenticate.FirstOrDefault().ToString())
.Select(r => r.Headers.WwwAuthenticate.FirstOrDefault()?.ToString() ?? string.Empty)

Copilot uses AI. Check for mistakes.

Copy link
Contributor

@vidai-msft vidai-msft left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@vidai-msft vidai-msft enabled auto-merge (squash) July 16, 2025 07:18
@vidai-msft vidai-msft merged commit 5c45b3b into main Jul 16, 2025
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants