NAME

Azure::AD::DeviceLogin - Azure AD Device Login authentication flow

SYNOPSIS

use Azure::AD::DeviceLogin;
my $creds = Azure::AD::DeviceLogin->new(
  resource_id => 'https://management.core.windows.net/',
  message_handler => sub { say $_[0] },
  client_id => '',
  tenant_id => '',
);
say $creds->access_token;

DESCRIPTION

Implements the Azure AD Device Login flow. See Azure::AD::Auth for more information and alternative flows.

ATTRIBUTES

resource_id

The URL for which you want a token extended (the URL of the service which you want to obtain a token for).

https://graph.windows.net/ for using the MS Graph API

https://management.core.windows.net/ for using the Azure Management APIs

message_handler

Callback that receives the message for the user as it's first argument. This callback should transmit the message to the end user, who has to follow the instructions embedded in it.

tenant_id

The ID of the Azure Active Directory Tenant

client_id

The Client ID (also referred to as the Application ID) of an application

ad_url

This defaults to https://login.microsoftonline.com, and generally doesn't need to be specified. Azure AD has more endpoints for some clouds:

https://login.chinacloudapi.cn China Cloud

https://login.microsoftonline.us US Gov Cloud

https://login.microsoftonline.de German Cloud

METHODS

access_token

Returns the access token that has to be sent to the APIs you want to access. This is normally sent in the Authentication header of HTTPS requests as a Bearer token.

The call to access_token will start the Device Login flow, which involves transmitting a message to the user (see message_handler attribute). The user will have to visit a URL with a browser, insert the code in the message, authorize the application, and then the authentication will proceed. Meanwhile the call to access_code will be blocked, awaiting the user to complete the flow. Once the user completes the instructions the access_code will be returned.

The access_token is cached in the object as long as it's valid, so subsequent calls to access_token will return the appropriate token without reauthenticating to Azure AD. If the token has expired, access_token will call Azure AD to obtain a new token.

Example usage:

my $auth = Azure::AD::DeviceLogin->new(...);

use HTTP::Tiny;
my $ua = HTTP::Tiny->new;
my $response = $ua->get(
  'http://aservice.com/orders/list', 
  {
    headers => { Authorization => 'Bearer ' . $auth->access_token }
  }
);

SEE ALSO

Azure::AD::Auth

COPYRIGHT and LICENSE

Copyright (c) 2020 by Jose Luis Martinez

This code is distributed under the Apache 2 License. The full text of the license can be found in the LICENSE file included with this module.

cpanm Azure::AD::Auth

perl -MCPAN -e shell
install Azure::AD::Auth