[QUERY] Should the UserAssertion parameter be used as part of the TokenRequestContext

Library name and version

Azure.Identity

Query/Question

When trying to use the OnBehalfOfCredential it looks like the _userAssertion property is initialized with the instance of the credential class.

https://github.com/Azure/azure-sdk-for-net/blob/9c4203dc877e870145d7e684f0a53bc36808dfed/sdk/identity/Azure.Identity/src/Credentials/OnBehalfOfCredential.cs#L24

In the event that an application with many users, multiple instances of the OnBehalfOfCredential would need to be created to handle the multiple userAssertions. This will in turn create multiple clients for requesting the token when it may be possible to have a single credential and have the userAssertion passed in the request context to avoid the multiple instances.

Is creating of new credential instances on changing userAssertions the desired flow and is it expected for one to keep a collection of the instances if they want to leverage the cache used in an instance?

Environment

When trying to use the OnBehalfOfCredential it looks like the _userAssertion property is initialized with the instance of the credential class.

https://github.com/Azure/azure-sdk-for-net/blob/9c4203dc877e870145d7e684f0a53bc36808dfed/sdk/identity/Azure.Identity/src/Credentials/OnBehalfOfCredential.cs#L24

In the event that an application with many users, multiple instances of the OnBehalfOfCredential would need to be created to handle the multiple userAssertions. This will in turn create multiple clients for requesting the token when it may be possible to have a single credential and have the userAssertion passed in the request context to avoid the multiple instances.

Is creating of new credential instances on changing userAssertions` the desired flow or should one keep the instances in collection to leverage the cache in an instance?

[christothes]

Is there a scenario where the library looks into the userAssertion being passable via the TokenRequestContext thus enabling one credential to be used for the authentication of the users?

No we don’t support this today.

If your environment is asp.net, you may want to use the Microsoft.Identity.Web library, which supports the On-Behalf-Of flow https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-web-api-call-api-overview

[msftbot[bot]]

Hi, we’re sending this friendly reminder because we haven’t heard back from you in 7 days. We need more information about this issue to help address it. Please be sure to give us your input. If we don’t hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!