Async credential classes missing from azure.identity.aio

[tonybaloney]

azure.identity.aio is missing many Credential classes that exist in the azure.identity namespace.

https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/azure/identity/aio/__init__.py#L7-L20

compared with

https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/azure/identity/__init__.py#L11-L27

missing:

• AzureApplicationCredential
• DeviceCodeCredential
• InteractiveBrowserCredential
• UsernamePasswordCredential

The implementations don't exist at all. I was trying to implement an asyncio application using InteractiveBrowser and DeviceCodeCredential, only to find they don't exist

[chlowell]

Thanks for opening this issue! An async AzureApplicationCredential does exist but wasn't importable from azure.identity.aio. #19961 fixes that.

The other credentials you list don't exist because their implementation relies on MSAL Python, which doesn't yet have an async API (AzureAD/microsoft-authentication-library-for-python#88). Our #6354 tracks the SDK work needed to use an async MSAL once it exists. One workaround in the meantime is to wrap a blocking credential, for example:

class _AsyncDeviceCodeCredential(DeviceCodeCredential):
    async def get_token(self, *scopes, **kwargs):
        return super().get_token(*scopes, **kwargs)

[MrNickArcher]

I had a different work-around for this problem but I see there is a tidier one above; it is useful because the pandas.read_parquet() uses packages ffspec and adlfs which only accept async credentials.

from azure.identity import InteractiveBrowserCredential
import pandas
import functools
import asyncio

# define an async wrapper
def run_in_executor(f):
    @functools.wraps(f)
    def inner(*args, **kwargs):
        loop = asyncio.get_running_loop()
        return loop.run_in_executor(None, lambda: f(*args, **kwargs))
    return inner

# apply the wrapper to the get_token function of the credential
interactive_browser_credential_async = InteractiveBrowserCredential()
interactive_browser_credential_async.get_token = run_in_executor(interactive_browser_credential_async.get_token)

# use the wrapped credential in async context:
df = pandas.read_parquet(
    f"abfss://{conainter}@{account_name}.dfs.core.windows.net/{path_to_parquet}",
    storage_options={
        "credential":interactive_browser_credential_async,
    }
)

Also works for DeviceCodeCredential. Have not tested the others. Very handy for testing and debugging until scripts are deployed to environments that have better options.

[basnijholt]

Over the last 2 years several workaround have been reported and implemented, e.g., #19943 (comment) and microsoft/azure-quantum-python#162. However none of these provide a smooth integration with AzureDefaultCredential.

In the absence of an async MSAL, one could just provide a class that uses the sync version and runs the methods in an executor like @MrNickArcher posted above.

Most users probably don't care about where the asynchronous-ness comes from. As long as it provides any async API, it will work with packages that depend on azure-identity's async auth implementations (such as adlfs, ffspec).

I see that @xiangyan99 has been assigned to this issue. Is solving this any priority at all?

(edit: the async MSAL issue has been open for almost 4 years, so I wouldn't expect them to implement this any time soon (AzureAD/microsoft-authentication-library-for-python#88))