Fix Key Vault challenge-based authentication tenant ID parsing for DSTSv2 authorities by prasanna164-code · Pull Request #49007 · Azure/azure-sdk-for-python

prasanna164-code · 2026-09-15T00:06:26Z

Description

HttpChallenge extracts the tenant ID from the authorization / authorization_uri parameter of the WWW-Authenticate challenge by taking the first path segment of the URI. That is correct for Microsoft Entra ID authorities (https://login.microsoftonline.com/{tenant-id}), but DSTSv2 authorities have the form https://<host>/dstsv2/{tenant-id}, so the literal string dstsv2 was passed to the credential as tenant_id and token acquisition failed or targeted the wrong tenant.

This change moves the parsing into HttpChallenge._parse_tenant_id, which detects the dstsv2 path segment (case-insensitively) and reads the tenant ID from the segment that follows it. It matches the fix that shipped in the .NET libraries in Azure/azure-sdk-for-net#56416. All other authorization URIs are parsed exactly as before, including the existing None result for a URI without a path.

The fix is applied to every copy of http_challenge.py: azure-keyvault-keys, azure-keyvault-secrets, azure-keyvault-certificates, azure-keyvault-administration and azure-keyvault-securitydomain.

CHANGELOG entries were added under Bugs Fixed. azure-keyvault-secrets had no unreleased section (4.11.2 was released on 2026-08-25), so a 4.11.3 (Unreleased) section was added and _version.py bumped accordingly, mirroring what the release automation does.

Testing

New tests in test_challenge_auth.py / test_challenge_auth_async.py for each of the five packages:

test_challenge_parsing_tenant_id - parametrized over Entra ID authorities (with and without a trailing path), DSTSv2 authorities (mixed case, trailing slash), a DSTSv2 authority without a tenant segment, and an authority without a path.
test_tenant_dstsv2 (sync and async, parametrized over AccessToken / AccessTokenInfo) - full 401 -> 200 pipeline flow asserting the tenant ID that follows dstsv2 is passed to the credential.

Without the source change the DSTSv2 cases fail with assert 'dstsv2' == 'de763a21-...', confirming they cover the bug.

Verified locally (Python 3.14): the challenge-auth test modules of all five packages pass, and the added code is black-clean at line length 120.

All SDK Contribution checklist:

The pull request does not introduce [breaking changes]
CHANGELOG is updated for new features, bug fixes or other significant changes.
I have read the contribution guidelines.

General Guidelines and Best Practices

Title of the pull request is clear and informative.
There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

Pull request includes test coverage for the included changes.

HttpChallenge assumed the tenant ID is always the first path segment of the challenge's authorization URI. DSTSv2 authorities use the form https://<host>/dstsv2/<tenant-id>, so the literal string "dstsv2" was passed to the credential as tenant_id and token acquisition targeted the wrong tenant. Detect the "dstsv2" path segment and read the tenant ID from the segment that follows it, matching the behavior of the .NET Key Vault libraries. Applied to azure-keyvault-keys, -secrets, -certificates, -administration and -securitydomain. Added parsing tests covering Microsoft Entra ID and DSTSv2 authorization URIs plus sync and async 401 -> 200 pipeline tests asserting the tenant ID passed to the credential. Fixes Azure#45326

github-actions · 2026-09-15T00:06:51Z

Thank you for your contribution prasanna164-code! We will review the pull request and get back to you soon.

azure-pipelines · 2026-09-15T00:06:58Z

Azure Pipelines: Successfully started running 1 pipeline(s). 7 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

prasanna164-code · 2026-09-15T00:10:04Z

@microsoft-github-policy-service agree

Copilot

🟢 Approval recommended

No unresolved blocking issues were identified.

Pull request overview

Fixes DSTSv2 tenant ID parsing in Key Vault challenge authentication across five packages.

Changes:

Parses tenant IDs following the case-insensitive dstsv2 path segment.
Adds synchronous and asynchronous regression tests.
Updates changelogs and the Secrets package version.

File summaries

File	Description
`sdk/keyvault/azure-keyvault-securitydomain/tests/test_challenge_auth.py`	Adds parsing and sync flow tests.
`sdk/keyvault/azure-keyvault-securitydomain/tests/test_challenge_auth_async.py`	Adds async flow coverage.
`sdk/keyvault/azure-keyvault-securitydomain/CHANGELOG.md`	Documents the fix.
`sdk/keyvault/azure-keyvault-securitydomain/azure/keyvault/securitydomain/_internal/http_challenge.py`	Adds DSTSv2 tenant parsing.
`sdk/keyvault/azure-keyvault-secrets/tests/test_challenge_auth.py`	Adds parsing and sync flow tests.
`sdk/keyvault/azure-keyvault-secrets/tests/test_challenge_auth_async.py`	Adds async flow coverage.
`sdk/keyvault/azure-keyvault-secrets/CHANGELOG.md`	Adds unreleased fix notes.
`sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_version.py`	Bumps the package version.
`sdk/keyvault/azure-keyvault-secrets/azure/keyvault/secrets/_shared/http_challenge.py`	Adds DSTSv2 tenant parsing.
`sdk/keyvault/azure-keyvault-keys/tests/test_challenge_auth.py`	Adds parsing and sync flow tests.
`sdk/keyvault/azure-keyvault-keys/tests/test_challenge_auth_async.py`	Adds async flow coverage.
`sdk/keyvault/azure-keyvault-keys/CHANGELOG.md`	Documents the fix.
`sdk/keyvault/azure-keyvault-keys/azure/keyvault/keys/_shared/http_challenge.py`	Adds DSTSv2 tenant parsing.
`sdk/keyvault/azure-keyvault-certificates/tests/test_challenge_auth.py`	Adds parsing and sync flow tests.
`sdk/keyvault/azure-keyvault-certificates/tests/test_challenge_auth_async.py`	Adds async flow coverage.
`sdk/keyvault/azure-keyvault-certificates/CHANGELOG.md`	Documents the fix.
`sdk/keyvault/azure-keyvault-certificates/azure/keyvault/certificates/_shared/http_challenge.py`	Adds DSTSv2 tenant parsing.
`sdk/keyvault/azure-keyvault-administration/tests/test_challenge_auth.py`	Adds sync and async regression coverage.
`sdk/keyvault/azure-keyvault-administration/CHANGELOG.md`	Documents the fix.
`sdk/keyvault/azure-keyvault-administration/azure/keyvault/administration/_internal/http_challenge.py`	Adds DSTSv2 tenant parsing.

Review details

Files reviewed: 20/20 changed files
Comments generated: 0
Review effort level: Lite (auto)

Note

Copilot is running an experiment and ran this review at Lite.

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Copilot

🟢 Approval recommended

The fix is consistent across all affected packages and includes comprehensive regression coverage.

Review details

Files reviewed: 21/21 changed files
Comments generated: 0 new
Review effort level: Balanced

Copilot AI balanced review requested due to automatic review settings September 15, 2026 00:06

prasanna164-code requested a review from a team as a code owner September 15, 2026 00:06

github-actions Bot added Community Contribution Community members are working on the issue customer-reported Issues that are reported by GitHub users external to the Azure organization. KeyVault labels Sep 15, 2026

github-project-automation Bot added this to Azure SDK for Key Vault Sep 15, 2026

github-project-automation Bot moved this to Untriaged in Azure SDK for Key Vault Sep 15, 2026

Copilot started reviewing on behalf of prasanna164-code September 15, 2026 00:07 View session

Copilot AI reviewed Sep 15, 2026

View reviewed changes

Add DSTS terms to the Key Vault cspell words

c8fa6b0

Copilot AI review requested due to automatic review settings September 15, 2026 00:51

prasanna164-code requested review from jenny (JennyPng), Daniel Jurek (danieljurek), Libba Lawrence (l0lawrence) and Laia Patiño (laiapat) as code owners September 15, 2026 00:51

Copilot started reviewing on behalf of prasanna164-code September 15, 2026 00:51 View session

Copilot AI reviewed Sep 15, 2026

View reviewed changes

Navigation Menu

Uh oh!

Fix Key Vault challenge-based authentication tenant ID parsing for DSTSv2 authorities - #49007

Fix Key Vault challenge-based authentication tenant ID parsing for DSTSv2 authorities#49007
prasanna164-code wants to merge 2 commits into
Azure:mainfrom
prasanna164-code:keyvault-dstsv2-tenant

prasanna164-code commented Sep 15, 2026

Uh oh!

github-actions Bot commented Sep 15, 2026

Uh oh!

azure-pipelines Bot commented Sep 15, 2026

Uh oh!

prasanna164-code commented Sep 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

prasanna164-code commented Sep 15, 2026

Description

Testing

All SDK Contribution checklist:

General Guidelines and Best Practices

Testing Guidelines

Uh oh!

github-actions Bot commented Sep 15, 2026

Uh oh!

azure-pipelines Bot commented Sep 15, 2026

Uh oh!

prasanna164-code commented Sep 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants