|
| 1 | +# Authentication |
| 2 | + |
| 3 | +To create a settings file interactively use: `mathworks.internal.adx.buildSettingsFile`. |
| 4 | + |
| 5 | +Template JSON configuration files for various authentication approaches can be |
| 6 | +found in `matlab-azure-adx/Software/MATLAB/config` |
| 7 | + |
| 8 | +In general for initial testing Client Secret based authentication is the simplest |
| 9 | +to configure an work with. To use other approaches it is recommended to contact |
| 10 | +MathWorks®: <mwlab@mathworks.com>. |
| 11 | + |
| 12 | +Certain authentication methods require the additional use of the Azure Java SDK |
| 13 | +authentication support as documented in [Authentication.md](Authentication.md). |
| 14 | + |
| 15 | +| Authentication Method | JSON file field value | Java SDK support required | |
| 16 | +|:----------------------|:----------------------|:-------------------------:| |
| 17 | +| Client Secret | clientSecret | No | |
| 18 | +| Interactive Browser | interactiveBrowser | Yes | |
| 19 | +| Device Code | deviceCode | Yes | |
| 20 | +| Managed Identity | managedIdentity | Yes | |
| 21 | + |
| 22 | +If you wish to use an Azure authentication method that is not listed please contact MathWorks at: <mwlab@mathworks.com>. |
| 23 | + |
| 24 | +## Settings file fields |
| 25 | + |
| 26 | +The default settings file is: `matlab-azure-adx/Software/MATLAB/config/adx.Client.Settings.json` |
| 27 | +Alternative names and paths can be used if required. |
| 28 | +Depending on the authentication method used different fields are required. The |
| 29 | +template files for the documented methods show the fields for the various methods. |
| 30 | + |
| 31 | +For example Interactive Browser uses: |
| 32 | + |
| 33 | +```json |
| 34 | +{ |
| 35 | + "preferredAuthMethod" : "interactiveBrowser", |
| 36 | + "subscriptionId" : "<REDACTED>", |
| 37 | + "tenantId" : "<REDACTED>", |
| 38 | + "clientId" : "<REDACTED>", |
| 39 | + "database" : "<defaultDatabaseName>", |
| 40 | + "resourceGroup": "<resourceGroupName>", |
| 41 | + "cluster" : "https://<defaultClusterName>.<region>.kusto.windows.net" |
| 42 | +} |
| 43 | +``` |
| 44 | + |
| 45 | +In use the fields `controlBearerToken` and `dataBearerToken` will be added to the file |
| 46 | +to cache the short lived bearer token values the control and data planes. These values are sensitive and should not be exposed. |
| 47 | + |
| 48 | +| Field name | Description | |
| 49 | +|:--------------------|:------------| |
| 50 | +| preferredAuthMethod | Indicated the authentication approach to use, e.g. clientSecret | |
| 51 | +| tenantId | Azure tenant ID | |
| 52 | +| subscriptionId | Azure subscriptions ID | |
| 53 | +| clientId | ID of the Application Registration used to connect to ADX | |
| 54 | +| clientSecret | Secret value corresponding to the clientId, this value is sensitive and should not be exposed | |
| 55 | +| resourceGroup | Azure resource group containing the ADX instance | |
| 56 | +| database | Default database name to use | |
| 57 | +| cluster | Default cluster name to use | |
| 58 | + |
| 59 | +## Client Secret |
| 60 | + |
| 61 | +Client Secret authentication is sometimes referred to as "Application Secret" as the |
| 62 | +secrets created apply to Application Registrations. This package uses the term "Client |
| 63 | +Secret or `clientSecret`as appropriate. |
| 64 | + |
| 65 | +Client secret does not use the "Secret ID" value and it should not be confused with the |
| 66 | +Client ID (sometimes called the App ID) or the Client Secret itself. |
| 67 | + |
| 68 | +## BaseClient extension |
| 69 | + |
| 70 | +The file `matlab-azure-adx/Software/MATLAB/app/system/+adx/+control/BaseClient.m` |
| 71 | +implements the base client for the interface's API call classes. |
| 72 | +In this file there are well commented hook points to which custom authentication |
| 73 | +code can be integrated if required. This topic should be discussed with MathWorks |
| 74 | +to clarify is custom code is necessary. |
| 75 | + |
| 76 | +## Bearer Tokens |
| 77 | + |
| 78 | +The lower-level `+api` classes and some higher-level functions accept an optional |
| 79 | +argument `bearerToken` directly if the authentication process to obtain the token |
| 80 | +is handled by some external means. Note that the KQL queries and management commands |
| 81 | +will require different tokens as they use different endpoints. |
| 82 | + |
| 83 | +## References |
| 84 | + |
| 85 | +* Azure Services authentication [https://github.com/mathworks-ref-arch/matlab-azure-services/blob/main/Documentation/Authentication.md](https://github.com/mathworks-ref-arch/matlab-azure-services/blob/main/Documentation/Authentication.md) |
| 86 | + |
| 87 | +[//]: # (Copyright 2023-2024 The MathWorks, Inc.) |
0 commit comments