AppAuthentication 1.1.0-preview: TenantId is mandatory in connection string with RunAs=App

The ClientCertificateAzureServiceTokenProvider seams to only use the tenant id in its method GetTokenAsync if the authority parameter is null or white space. But some clients, for example the KeyVaultClient of Microsoft.Azure.KeyVault, provides a authority parameter. This makes the TenantId-part of the connection string possibly redundant.

For example, the following code works just fine:

var azureServiceTokenProvider = new AzureServiceTokenProvider(
    $"RunAs=App;AppId={appId};TenantId=NotNeeded;CertificateThumbprint={thumbprint};CertificateStoreLocation=CurrentUser");
var keyVaultClient = new KeyVaultClient(
    new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
var secret = await keyVaultClient.GetSecretAsync(secretIdentifier).ConfigureAwait(false);

I propose making the TenantId optional and instead throw in ClientCertificateAzureServiceTokenProvider.GetTokenAsync if authority is null or white space and _tenantId is not set.

[varunsh-coder]

Thanks for the feedback. I agree, the TenantId should not be mandatory if it will not be used in some scenarios. We will make a change in a future release to make it optional in the connection string, and throw in GetTokenAsync, if it is needed for that scenario.

[varunsh-coder]

Closing this as per the details provided above.