Overview

• Added MSAL Managed Identity and Service Principal Token Providers to Microsoft.Artifacts.Authentication Library.
• Created new endpoint ARTIFACTS_CREDENTIALPROVIDER_FEED_ENDPOINTS environment variable with new json schema for MI/SP required fields.
• Updated VstsBuildTaskServiceEndpointCredentialProvider to call Microsoft.Artifacts.Authentication for MI/SP token providers.
• Reverted Revert System.Text.Json change #485 Changes to use system.text.json for de/serialization everywhere except for the VSS_NUGET_EXTERNAL_FEED_ENDPOINTS environment variable.

Design Decisions

• Intentionally not supporting SP secrets authentication to promote security best practices.
• The new environment variable name and json schema were created instead of reusing or extending the existing VSS_NUGET_EXTERNAL_FEED_ENDPOINTS to reduce password usage and clarify the environment variable will be available to our other credproviders such as the artifacs-keyring not just NuGet.

Environment Variable

ARTIFACTS_CREDENTIALPROVIDER_FEED_ENDPOINTS

 {"endpointCredentials": [{"endpoint":"http://example.index.json", "clientId":"required", "clientCertificateSubjectName":"optional", "clientCertificateFilePath":"optional"}]}

• endpoint: required. Feed url to authenticate against.
• clientId: required for both MI/SP. For user assigned managed identities enter the Entra client id. For system assigned variables set the value to system.
• clientCertificateSubjectName: Subject Name of the certificate located in the My/ CurrentUser or LocalMachine certificate store. Optional field. Only used by SP authentication.
• clientCertificateFilePath: File path location of the certificate on the machine. Optional field. Only used by SP authentication.

Will throw error if both clientCertificateSubjectName or clientCertificateFilePath are specified.