$ show AzureAD/microsoft-authentication-library-for-python
MSAL Python is a production-grade OAuth2/OIDC client library for the Microsoft identity platform (Entra ID / Azure AD, ADFS, MSA). It implements the full token acquisition lifecycle: authorization code, client credentials, device code, ROPC, on-behalf-of, and managed identity flows, plus WS-Trust for legacy ADFS federation. The library exposes two primary application classes — PublicClientApplication (desktop/mobile) and ConfidentialClientApplication (web apps/daemons) — built on a shared ClientApplication base with an embedded oauth2cli sub-package for low-level OAuth2 protocol handling. It also supports broker integration via pymsalruntime, proof-of-possession tokens, and regional endpoints.
The LLM identified 5 files worth highlighting for reuse:
Implements a serializable token cache with cross-SDK compatible key computation. The `_compute_ext_cache_key` uses SHA-256 over length-prefixed netstring serialization, byte-identical to MSAL Go/.NET/Java/JS. The `modify()` method provides unified add/modify/remove for all credential types. `SerializableTokenCache` adds a `has_state_changed` flag for efficient persistence. This is a self-contained, injective cache-key algorithm that can be extracted and reused in any multi-SDK identity system.
Self-contained OAuth2 client implementing all standard grants (authorization code, client credentials, device flow, ROPC, JWT/SAML assertions). Includes `JwtAssertionCreator` for client assertions and `AuthCodeReceiver` for local redirect handling. This is a reusable OAuth2 protocol layer decoupled from Microsoft-specific logic — an engineer could extract it into a standalone OAuth2 client library with minimal modification.
HTTP client wrapper that caches 429/5xx responses with configurable retry-after (default 5s). The `IndividualCache` decorator provides per-endpoint expiring cache. Demonstrates a clean, reusable pattern for resilient HTTP interactions in identity protocols — applicable to any service client that needs to respect rate limits without persisting state.
Authority validation and OIDC discovery. Handles instance discovery, issuer validation (exact, regional, B2C/CIAM suffix check), and supports custom OIDC authorities, CIAM, B2C, and dSTS. The `has_valid_issuer` logic is security-critical and carefully implemented with regional fallback. This module encapsulates the tricky issuer-matching rules that vary across Microsoft cloud endpoints.
Multi-backend managed identity token acquisition with source detection (VM, App Service, Azure Arc, Service Fabric, Cloud Shell). Each backend implements `_obtain_token` with source-specific protocol details. Includes environment detection via env vars and file existence checks, plus regional endpoint support. The backend-selection strategy pattern is reusable for any multi-environment identity provider.