[QUERY] Recommended lifetime to DefaultAzureCredential

[alefranz]

Library name and version

Azure.Identity 1.6.1

Query/Question

What is the recommended lifecycle for the DefaultAzureCredential?

There is no need to keep more than one instance of a client for a given set of constructor parameters or client options
https://devblogs.microsoft.com/azure-sdk/lifetime-management-and-thread-safety-guarantees-of-azure-sdk-net-clients/

Does this recommendation also apply for DefaultAzureCredential?

For example, if we need to retrieve a token for a HTTP dependency, a common pattern is via a Delegating Handler

public class AuthorizationHandler : DelegatingHandler
{
  protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
  {
    var credentials = new DefaultAzureCredential();
    var tokenResult = await credentials.GetTokenAsync(new TokenRequestContext(new[] { "foo" }), cancellationToken);
    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", tokenResult.Token);
    return await base.SendAsync(request, cancellationToken);
  }
}

Is the recommended approach to create a new instance of DefaultAzureCredential every time? or should it be a singleton? or one per type of client?

It would be great to document this, defining the different compromises e.g. token caching

Thank you!

Environment

No response

[jsquire]

Thank you for your feedback. Tagging and routing to the team member best able to assist.

[devlie]

I'm curious about this too, also will the answer change once built-in caching is introduced by #25361?

[christothes]

As an implementation detail, when using DefaultAzureCredential without any options, the credential chain created and the selected credential is a static singleton. The only reason to intentionally use a different instance of the credential is if you intend to discover a different credential in the chain. So generally speaking, it's better to use a singleton credential.

The token caching implications are dependent on which credential you end up selecting in the chain, but I'd say that the impact is not significant to whether or not the credential is a singleton, unless you have some specific requirements around caching.

[ghost]

Hi, we're sending this friendly reminder because we haven't heard back from you in 7 days. We need more information about this issue to help address it. Please be sure to give us your input. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!