@azure/identity

• Fixed a bug introduced on 1.5.0 that caused the ManagedIdentityCredential to fail authenticating in Arc environments. Since our new core disables unsafe requests by default, we had to change the security settings for the first request of the Arc MSI, which retrieves the file path where the authentication value is stored since this request generally happens through an HTTP endpoint.

• Fixed how we verify the IMDS endpoint is available. Now, besides skipping the Metadata header, we skip the URL query. Both will ensure that all the known IMDS endpoints return as early as possible.
• Added support for the AZURE_POD_IDENTITY_AUTHORITY_HOST environment variable. If present, the IMDS endpoint initial verification will be skipped.

• With this release, we've migrated from using @azure/core-http to @azure/core-rest-pipeline for the handling of HTTP requests. See Azure Core v1 vs v2 for more on the difference and benefits of the move. This removes our dependency on node-fetch and along with it issues we have seen in using this dependency in specific environments like Kubernetes pods.

• With this release, we drop support for Node.js versions that have reached the end of life, like Node.js 8. Read our support policy for more details.

• Updated the default timeout of the first request of the IMDS MSI from half a second to three seconds to compensate for the slowness caused by node-fetch for initial requests in specific environments, like Kubernetes pods.

• Upgraded @azure/core-http to version ^2.0.0, and @azure/core-tracing to version 1.0.0-preview.12.

• Upgraded the AuthorizationCodeCredential to use the latest @azure/msal-node.

Tracing Changes

• Updated @azure/core-tracing to version 1.0.0-preview.11. See @azure/core-tracing CHANGELOG for details about breaking changes with tracing.

This release doesn't have the changes from 1.2.4-beta.1.

• Bug fix: Now if the managedIdentityClientId optional parameter is provided to DefaultAzureCredential, it will be properly passed through to the underlying ManagedIdentityCredential. Related to customer issue: 13872.
• Bug fix: ManagedIdentityCredential now also properly handles EHOSTUNREACH errors. Fixes issue 13894.

• Breaking Change: Updated InteractiveBrowserCredential to use the Auth Code Flow with PKCE rather than Implicit Grant Flow by default in the browser, to better support browsers with enhanced security restrictions. A new file was added to provide more information about this credential here.

• Fixed Azure Stack support for the Node.js version of the InteractiveBrowserCredential. Fixes issue 11220.
• The 'keytar' dependency has been updated to the latest version.
• No longer overrides global Axios defaults. This includes an update in @azure/identity's source, and an update of the @azure/msal-node dependency. Fixes issue 13343.

• Upgrading to the msal-node dependency due to a severe vulnerability in Axios. Link to the documented vulnerability: link. Fixes issue 13088.

• Upgrading to Axios 0.21.1 due to a severe vulnerability in Axios. Link to the documented vulnerability: link. Fixes issue 13088.

Changes since 1.1.*

• With 1.2, we've added support for Azure Arc to our Managed Identity credential.
• We've also added an Interactive Browser credential for Node, which spawns the user's browser and connects via a browser-based auth code flow. This is powered by the Microsoft Authentication Library (MSAL)
• We've moved DeviceCodeCredential to also use the Microsoft Authentication Library (MSAL)
• Identity now supports Subject Name/Issuer (SNI) as part of authentication for ClientCertificateCredential.
• Added Active Directory Federation Services authority host support to the node credentials.
• ManagedIdentityCredential has been aligned with other languages, and now treats expected errors properly.
• Added support for multiple clouds on VisualStudioCodeCredential.

Changes since the latest 1.2-beta

• ManagedIdentityCredential now only checks for available MSIs once per class instance.
• ManagedIdentityCredential now supports Azure Arc environments.
• ManagedIdentityCredential now supports Azure Service Fabric environments.
• Added authority host for multiple clouds on VisualStudioCodeCredential, and specified AzureCloud as the default cloud name.
• DeviceCodeCredential now has both of its constructor parameters, tenantId and clientId, as optional parameters. The default value of tenantId is "organizations", and the Azure CLI's client ID is the default value of clientId.
• We've removed the persistent cache support from the previous beta.

• DeviceCodeCredential now by default shows the Device Code message on the console. This can still be overwritten with a custom behavior by specifying a function as the third parameter, userPromptCallback.
• Added support for multiple clouds on VisualStudioCodeCredential. Fixes customer issue 11452.
• ManagedIdentityCredential has been aligned with other languages, now treating expected errors properly. This fixes customer issue 11451.
• InteractiveBrowserCredential authentication now uses the silent flow if the user provides a cache and authentication record for lookup.
• Added Active Directory Federation Services authority host support to the node credentials.
• Reverted a change in 1.2.0-beta.1 which moved @rollup/plugin-json from devDependencies to dependencies. @rollup/plugin-json was placed as a dependency due to an oversight, and it is not a necessary dependency for @azure/identity.

• A new InteractiveBrowserCredential for node which will spawn a web server, start a web browser, and allow the user to interactively authenticate with the browser.
• With 1.2.0-beta.1, Identity will now use MSAL to perform authentication. With this beta, DeviceCodeCredential and a new InteractiveBrowserCredential for node are powered by MSAL.
• Identity now supports Subject Name/Issuer (SNI) as part of authentication for ClientCertificateCredential
• Upgraded App Services MSI API version