Skip to content

Commit 1d96efd

Browse files
author
docsreference@microsoft.com
committed
CI Update
 Build.Reason:Schedule Build.Url:https://apidrop.visualstudio.com/Content%20CI/_build/results?buildId=592317&view=results
1 parent a8134c7 commit 1d96efd

2 files changed

Lines changed: 93 additions & 79 deletions

File tree

‎python/docs-ref-autogen/msal/msal.application.ClientApplication.yml‎

Lines changed: 60 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -27,32 +27,28 @@ constructor:
2727
\ here.\n\nFor <xref:msal.application.ConfidentialClientApplication>,\nit supports\
2828
\ many different input formats for different scenarios.\n\n\n\n## Support using\
2929
\ a client secret.Just feed in a string, such as `\"your client secret\"`.\n\
30-
\n\n\n## Support using a certificate in X.509 (.pem) formatFeed in a dict in\
31-
\ this form:\n\n<!-- literal_block {\"ids\": [], \"classes\": [], \"names\"\
32-
: [], \"dupnames\": [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\"\
33-
: \"default\", \"force\": false, \"linenos\": false} -->\n\n````default\n\n\
34-
\ {\n \"private_key\": \"...-----BEGIN PRIVATE KEY-----... in PEM format\"\
35-
,\n \"thumbprint\": \"A1B2C3D4E5F6...\",\n \"passphrase\": \"Passphrase\
36-
\ if the private_key is encrypted (Optional. Added in version 1.6.0)\",\n \
37-
\ }\n ````\n\nMSAL Python requires a \"private_key\" in PEM format.\nIf your\
38-
\ cert is in PKCS12 (.pfx) format,\nyou can convert it to X.509 (.pem) format,\n\
39-
by `openssl pkcs12 -in file.pfx -out file.pem -nodes`.The thumbprint is available\
40-
\ in your app's registration in Azure Portal.\nAlternatively, you can [calculate\
41-
\ the thumbprint](https://github.com/Azure/azure-sdk-for-python/blob/07d10639d7e47f4852eaeb74aef5d569db499d6e/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py#L94-L97).\n\
42-
\n\n\n## Support Subject Name/Issuer Auth with a cert in .pem[Subject Name/Issuer\
43-
\ Auth](https://github.com/AzureAD/microsoft-authentication-library-for-python/issues/60)\n\
44-
is an approach to allow easier certificate rotation.*Added in version 0.5.0*:\n\
45-
\n<!-- literal_block {\"ids\": [], \"classes\": [], \"names\": [], \"dupnames\"\
46-
: [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\": \"default\"\
47-
, \"force\": false, \"linenos\": false} -->\n\n````default\n\n {\n \"\
48-
private_key\": \"...-----BEGIN PRIVATE KEY-----... in PEM format\",\n \
49-
\ \"thumbprint\": \"A1B2C3D4E5F6...\",\n \"public_certificate\": \"...-----BEGIN\
50-
\ CERTIFICATE-----...\",\n \"passphrase\": \"Passphrase if the private_key\
51-
\ is encrypted (Optional. Added in version 1.6.0)\",\n }\n ````\n\n`public_certificate`\
30+
\n\n\n## Support using a certificate in X.509 (.pem) formatDeprecated because\
31+
\ it uses SHA-1 thumbprint,\nunless you are still using ADFS which supports\
32+
\ SHA-1 thumbprint only.\nPlease use the .pfx option documented later in this\
33+
\ page.Feed in a dict in this form:\n\n<!-- literal_block {\"ids\": [], \"classes\"\
34+
: [], \"names\": [], \"dupnames\": [], \"backrefs\": [], \"xml:space\": \"preserve\"\
35+
, \"language\": \"default\", \"force\": false, \"linenos\": false} -->\n\n````default\n\
36+
\n {\n \"private_key\": \"...-----BEGIN PRIVATE KEY-----... in PEM format\"\
37+
,\n \"thumbprint\": \"An SHA-1 thumbprint such as A1B2C3D4E5F6...\"\n\
38+
\ \"Changed in version 1.35.0, if thumbprint is absent\"\n \
39+
\ \"and a public_certificate is present, MSAL will\"\n \"automatically\
40+
\ calculate an SHA-256 thumbprint instead.\",\n \"passphrase\": \"Needed\
41+
\ if the private_key is encrypted (Added in version 1.6.0)\",\n \"public_certificate\"\
42+
: \"...-----BEGIN CERTIFICATE-----...\", # Needed if you use Subject Name/Issuer\
43+
\ auth. Added in version 0.5.0.\n }\n ````\n\nMSAL Python requires a \"\
44+
private_key\" in PEM format.\nIf your cert is in PKCS12 (.pfx) format,\nyou\
45+
\ can convert it to X.509 (.pem) format,\nby `openssl pkcs12 -in file.pfx -out\
46+
\ file.pem -nodes`.The thumbprint is available in your app's registration in\
47+
\ Azure Portal.\nAlternatively, you can [calculate the thumbprint](https://github.com/Azure/azure-sdk-for-python/blob/07d10639d7e47f4852eaeb74aef5d569db499d6e/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py#L94-L97).`public_certificate`\
5248
\ (optional) is public key certificate\nwhich will be sent through 'x5c' JWT\
53-
\ header only for\nsubject name and issuer authentication to support cert auto\
54-
\ rolls.Per [specs](https://tools.ietf.org/html/rfc7515#section-4.1.6),\n\"\
55-
the certificate containing\nthe public key corresponding to the key used to\
49+
\ header.\nThis is useful when you use [Subject Name/Issuer Authentication](https://github.com/AzureAD/microsoft-authentication-library-for-python/issues/60)\n\
50+
which is an approach to allow easier certificate rotation.\nPer [specs](https://tools.ietf.org/html/rfc7515#section-4.1.6),\n\
51+
\"the certificate containing\nthe public key corresponding to the key used to\
5652
\ digitally sign the\nJWS MUST be the first certificate. This MAY be followed\
5753
\ by\nadditional certificates, with each subsequent certificate being the\n\
5854
one used to certify the previous one.\"\nHowever, your certificate's issuer\
@@ -66,26 +62,25 @@ constructor:
6662
: [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\": \"default\"\
6763
, \"force\": false, \"linenos\": false} -->\n\n````default\n\n {\n \"\
6864
client_assertion\": \"...a JWT with claims aud, exp, iss, jti, nbf, and sub...\"\
69-
\n }\n ````\n\n\n\n## Supporting reading client certificates from PFX files*Added\
65+
\n }\n ````\n\n\n\n## Supporting reading client certificates from PFX filesThis\
66+
\ usage will automatically use SHA-256 thumbprint of the certificate.*Added\
7067
\ in version 1.29.0*:\nFeed in a dictionary containing the path to a PFX file:\n\
7168
\n<!-- literal_block {\"ids\": [], \"classes\": [], \"names\": [], \"dupnames\"\
7269
: [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\": \"default\"\
7370
, \"force\": false, \"linenos\": false} -->\n\n````default\n\n {\n \"\
74-
private_key_pfx_path\": \"/path/to/your.pfx\",\n \"passphrase\": \"Passphrase\
75-
\ if the private_key is encrypted (Optional)\",\n }\n ````\n\nThe following\
76-
\ command will generate a .pfx file from your .key and .pem file:\n\n<!-- literal_block\
71+
private_key_pfx_path\": \"/path/to/your.pfx\", # Added in version 1.29.0\n\
72+
\ \"public_certificate\": True, # Only needed if you use Subject Name/Issuer\
73+
\ auth. Added in version 1.30.0\n \"passphrase\": \"Passphrase if the\
74+
\ private_key is encrypted (Optional)\",\n }\n ````\n\nThe following command\
75+
\ will generate a .pfx file from your .key and .pem file:\n\n<!-- literal_block\
7776
\ {\"ids\": [], \"classes\": [], \"names\": [], \"dupnames\": [], \"backrefs\"\
7877
: [], \"xml:space\": \"preserve\", \"language\": \"default\", \"force\": false,\
7978
\ \"linenos\": false} -->\n\n````default\n\n openssl pkcs12 -export -out certificate.pfx\
80-
\ -inkey privateKey.key -in certificate.pem\n ````\n\n\n\n## Support Subject\
81-
\ Name/Issuer Auth with a cert in .pfx*Added in version 1.30.0*:\nIf your .pfx\
82-
\ file contains both the private key and public cert,\nyou can opt in for Subject\
83-
\ Name/Issuer Auth like this:\n\n<!-- literal_block {\"ids\": [], \"classes\"\
84-
: [], \"names\": [], \"dupnames\": [], \"backrefs\": [], \"xml:space\": \"preserve\"\
85-
, \"language\": \"default\", \"force\": false, \"linenos\": false} -->\n\n````default\n\
86-
\n {\n \"private_key_pfx_path\": \"/path/to/your.pfx\",\n \"public_certificate\"\
87-
: True,\n \"passphrase\": \"Passphrase if the private_key is encrypted\
88-
\ (Optional)\",\n }\n ````"
79+
\ -inkey privateKey.key -in certificate.pem\n ````\n\n[Subject Name/Issuer\
80+
\ Auth](https://github.com/AzureAD/microsoft-authentication-library-for-python/issues/60)\n\
81+
is an approach to allow easier certificate rotation.\nIf your .pfx file contains\
82+
\ both the private key and public cert,\nyou can opt in for Subject Name/Issuer\
83+
\ Auth by setting \"public_certificate\" to `True`."
8984
defaultValue: None
9085
types:
9186
- <xref:typing.Union>[<xref:dict>, <xref:str>, <xref:None>]
@@ -536,7 +531,14 @@ methods:
536531
537532
See this page for constraints of Username Password Flow.
538533
539-
[https://github.com/AzureAD/microsoft-authentication-library-for-python/wiki/Username-Password-Authentication](https://github.com/AzureAD/microsoft-authentication-library-for-python/wiki/Username-Password-Authentication)'
534+
[https://github.com/AzureAD/microsoft-authentication-library-for-python/wiki/Username-Password-Authentication](https://github.com/AzureAD/microsoft-authentication-library-for-python/wiki/Username-Password-Authentication)
535+
536+
537+
[Deprecated] This API is deprecated for public client flows and will be
538+
539+
removed in a future release. Use a more secure flow instead.
540+
541+
Migration guide: [https://aka.ms/msal-ropc-migration](https://aka.ms/msal-ropc-migration)'
540542
signature: acquire_token_by_username_password(username, password, scopes, claims_challenge=None,
541543
auth_scheme=None, **kwargs)
542544
parameters:
@@ -884,7 +886,7 @@ methods:
884886
description: 'OPTIONAL. Specifies the method with which response parameters should
885887
be returned.
886888
887-
The default value is equivalent to `query`, which is still secure enough in
889+
The default value is equivalent to `query`, which was still secure enough in
888890
MSAL Python
889891
890892
(because MSAL Python does not transfer tokens via query parameter in the first
@@ -907,7 +909,24 @@ methods:
907909
908910
*here <https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#ResponseModes>*
909911
910-
and *here <https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html#FormPostResponseMode>*'
912+
and *here <https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html#FormPostResponseMode>*
913+
914+
915+
916+
> [!NOTE]
917+
918+
> You should configure your web framework to accept form_post responses instead
919+
of query responses.
920+
921+
>
922+
923+
> While this parameter still works, it will be removed in a future version.
924+
925+
>
926+
927+
> Using query-based response modes is less secure and should be avoided.
928+
929+
>'
911930
defaultValue: None
912931
types:
913932
- <xref:str>

‎python/docs-ref-autogen/msal/msal.application.ConfidentialClientApplication.yml‎

Lines changed: 33 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -27,32 +27,28 @@ constructor:
2727
\ here.\n\nFor <xref:msal.application.ConfidentialClientApplication>,\nit supports\
2828
\ many different input formats for different scenarios.\n\n\n\n## Support using\
2929
\ a client secret.Just feed in a string, such as `\"your client secret\"`.\n\
30-
\n\n\n## Support using a certificate in X.509 (.pem) formatFeed in a dict in\
31-
\ this form:\n\n<!-- literal_block {\"ids\": [], \"classes\": [], \"names\"\
32-
: [], \"dupnames\": [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\"\
33-
: \"default\", \"force\": false, \"linenos\": false} -->\n\n````default\n\n\
34-
\ {\n \"private_key\": \"...-----BEGIN PRIVATE KEY-----... in PEM format\"\
35-
,\n \"thumbprint\": \"A1B2C3D4E5F6...\",\n \"passphrase\": \"Passphrase\
36-
\ if the private_key is encrypted (Optional. Added in version 1.6.0)\",\n \
37-
\ }\n ````\n\nMSAL Python requires a \"private_key\" in PEM format.\nIf your\
38-
\ cert is in PKCS12 (.pfx) format,\nyou can convert it to X.509 (.pem) format,\n\
39-
by `openssl pkcs12 -in file.pfx -out file.pem -nodes`.The thumbprint is available\
40-
\ in your app's registration in Azure Portal.\nAlternatively, you can [calculate\
41-
\ the thumbprint](https://github.com/Azure/azure-sdk-for-python/blob/07d10639d7e47f4852eaeb74aef5d569db499d6e/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py#L94-L97).\n\
42-
\n\n\n## Support Subject Name/Issuer Auth with a cert in .pem[Subject Name/Issuer\
43-
\ Auth](https://github.com/AzureAD/microsoft-authentication-library-for-python/issues/60)\n\
44-
is an approach to allow easier certificate rotation.*Added in version 0.5.0*:\n\
45-
\n<!-- literal_block {\"ids\": [], \"classes\": [], \"names\": [], \"dupnames\"\
46-
: [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\": \"default\"\
47-
, \"force\": false, \"linenos\": false} -->\n\n````default\n\n {\n \"\
48-
private_key\": \"...-----BEGIN PRIVATE KEY-----... in PEM format\",\n \
49-
\ \"thumbprint\": \"A1B2C3D4E5F6...\",\n \"public_certificate\": \"...-----BEGIN\
50-
\ CERTIFICATE-----...\",\n \"passphrase\": \"Passphrase if the private_key\
51-
\ is encrypted (Optional. Added in version 1.6.0)\",\n }\n ````\n\n`public_certificate`\
30+
\n\n\n## Support using a certificate in X.509 (.pem) formatDeprecated because\
31+
\ it uses SHA-1 thumbprint,\nunless you are still using ADFS which supports\
32+
\ SHA-1 thumbprint only.\nPlease use the .pfx option documented later in this\
33+
\ page.Feed in a dict in this form:\n\n<!-- literal_block {\"ids\": [], \"classes\"\
34+
: [], \"names\": [], \"dupnames\": [], \"backrefs\": [], \"xml:space\": \"preserve\"\
35+
, \"language\": \"default\", \"force\": false, \"linenos\": false} -->\n\n````default\n\
36+
\n {\n \"private_key\": \"...-----BEGIN PRIVATE KEY-----... in PEM format\"\
37+
,\n \"thumbprint\": \"An SHA-1 thumbprint such as A1B2C3D4E5F6...\"\n\
38+
\ \"Changed in version 1.35.0, if thumbprint is absent\"\n \
39+
\ \"and a public_certificate is present, MSAL will\"\n \"automatically\
40+
\ calculate an SHA-256 thumbprint instead.\",\n \"passphrase\": \"Needed\
41+
\ if the private_key is encrypted (Added in version 1.6.0)\",\n \"public_certificate\"\
42+
: \"...-----BEGIN CERTIFICATE-----...\", # Needed if you use Subject Name/Issuer\
43+
\ auth. Added in version 0.5.0.\n }\n ````\n\nMSAL Python requires a \"\
44+
private_key\" in PEM format.\nIf your cert is in PKCS12 (.pfx) format,\nyou\
45+
\ can convert it to X.509 (.pem) format,\nby `openssl pkcs12 -in file.pfx -out\
46+
\ file.pem -nodes`.The thumbprint is available in your app's registration in\
47+
\ Azure Portal.\nAlternatively, you can [calculate the thumbprint](https://github.com/Azure/azure-sdk-for-python/blob/07d10639d7e47f4852eaeb74aef5d569db499d6e/sdk/identity/azure-identity/azure/identity/_credentials/certificate.py#L94-L97).`public_certificate`\
5248
\ (optional) is public key certificate\nwhich will be sent through 'x5c' JWT\
53-
\ header only for\nsubject name and issuer authentication to support cert auto\
54-
\ rolls.Per [specs](https://tools.ietf.org/html/rfc7515#section-4.1.6),\n\"\
55-
the certificate containing\nthe public key corresponding to the key used to\
49+
\ header.\nThis is useful when you use [Subject Name/Issuer Authentication](https://github.com/AzureAD/microsoft-authentication-library-for-python/issues/60)\n\
50+
which is an approach to allow easier certificate rotation.\nPer [specs](https://tools.ietf.org/html/rfc7515#section-4.1.6),\n\
51+
\"the certificate containing\nthe public key corresponding to the key used to\
5652
\ digitally sign the\nJWS MUST be the first certificate. This MAY be followed\
5753
\ by\nadditional certificates, with each subsequent certificate being the\n\
5854
one used to certify the previous one.\"\nHowever, your certificate's issuer\
@@ -66,26 +62,25 @@ constructor:
6662
: [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\": \"default\"\
6763
, \"force\": false, \"linenos\": false} -->\n\n````default\n\n {\n \"\
6864
client_assertion\": \"...a JWT with claims aud, exp, iss, jti, nbf, and sub...\"\
69-
\n }\n ````\n\n\n\n## Supporting reading client certificates from PFX files*Added\
65+
\n }\n ````\n\n\n\n## Supporting reading client certificates from PFX filesThis\
66+
\ usage will automatically use SHA-256 thumbprint of the certificate.*Added\
7067
\ in version 1.29.0*:\nFeed in a dictionary containing the path to a PFX file:\n\
7168
\n<!-- literal_block {\"ids\": [], \"classes\": [], \"names\": [], \"dupnames\"\
7269
: [], \"backrefs\": [], \"xml:space\": \"preserve\", \"language\": \"default\"\
7370
, \"force\": false, \"linenos\": false} -->\n\n````default\n\n {\n \"\
74-
private_key_pfx_path\": \"/path/to/your.pfx\",\n \"passphrase\": \"Passphrase\
75-
\ if the private_key is encrypted (Optional)\",\n }\n ````\n\nThe following\
76-
\ command will generate a .pfx file from your .key and .pem file:\n\n<!-- literal_block\
71+
private_key_pfx_path\": \"/path/to/your.pfx\", # Added in version 1.29.0\n\
72+
\ \"public_certificate\": True, # Only needed if you use Subject Name/Issuer\
73+
\ auth. Added in version 1.30.0\n \"passphrase\": \"Passphrase if the\
74+
\ private_key is encrypted (Optional)\",\n }\n ````\n\nThe following command\
75+
\ will generate a .pfx file from your .key and .pem file:\n\n<!-- literal_block\
7776
\ {\"ids\": [], \"classes\": [], \"names\": [], \"dupnames\": [], \"backrefs\"\
7877
: [], \"xml:space\": \"preserve\", \"language\": \"default\", \"force\": false,\
7978
\ \"linenos\": false} -->\n\n````default\n\n openssl pkcs12 -export -out certificate.pfx\
80-
\ -inkey privateKey.key -in certificate.pem\n ````\n\n\n\n## Support Subject\
81-
\ Name/Issuer Auth with a cert in .pfx*Added in version 1.30.0*:\nIf your .pfx\
82-
\ file contains both the private key and public cert,\nyou can opt in for Subject\
83-
\ Name/Issuer Auth like this:\n\n<!-- literal_block {\"ids\": [], \"classes\"\
84-
: [], \"names\": [], \"dupnames\": [], \"backrefs\": [], \"xml:space\": \"preserve\"\
85-
, \"language\": \"default\", \"force\": false, \"linenos\": false} -->\n\n````default\n\
86-
\n {\n \"private_key_pfx_path\": \"/path/to/your.pfx\",\n \"public_certificate\"\
87-
: True,\n \"passphrase\": \"Passphrase if the private_key is encrypted\
88-
\ (Optional)\",\n }\n ````"
79+
\ -inkey privateKey.key -in certificate.pem\n ````\n\n[Subject Name/Issuer\
80+
\ Auth](https://github.com/AzureAD/microsoft-authentication-library-for-python/issues/60)\n\
81+
is an approach to allow easier certificate rotation.\nIf your .pfx file contains\
82+
\ both the private key and public cert,\nyou can opt in for Subject Name/Issuer\
83+
\ Auth by setting \"public_certificate\" to `True`."
8984
defaultValue: None
9085
types:
9186
- <xref:typing.Union>[<xref:dict>, <xref:str>, <xref:None>]

0 commit comments

Comments
 (0)