Weak or unknown asymmetric padding

[hvedati]

• Package Name:
• Package Version:
• Operating System:
• Python Version:

Describe the bug
Use of unapproved, weak, or unknown asymmetric padding algorithm or API : PKCS1V15

To Reproduce
Steps to reproduce the behavior:
The code in question is coming from here - https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/azure/identity/_internal/aadclient_certificate.py.

Expected behavior
The padding algorithm needs to be updated.

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.

[kashifkhan]

Thank you for the feedback @hvedati . Can you provide some screenshots, the error message or code that can help us see this issue.

[github-actions]

Hi @hvedati. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue.

[hvedati]

Thank you for the feedback @hvedati . Can you provide some screenshots, the error message or code that can help us see this issue.

@kashifkhan This is the s360 item that was assigned to our team.

> We consume the azure_identity sdk for python in our repo when building the stack-hci-vm cli. We want to keep the code we use in our repo in sync with the python sdk.

[pvaneck]

@xiangyan99 Looks like this is for the async certificate credential, and it is in need of an update to use the PS256 algorithm with PSS padding based on Entra guidance. Based on MSAL's implementation, PS256 is used for most cases, however, there still might be a need to use RS256. Looks like it might still be used in cases of ADFS? Not sure if this is actually be the case, but if there's still a valid reason to keep the weak padding in, then we'd also need a way to suppress the CodeQL warnings (I think # noqa might suppress).

[hvedati]

Hi @pvaneck! Is there an ETA for when this padding issue will be resolved?

[pvaneck]

Hey, @hvedati, I have a PR out to update the logic, and I am aiming to get it out in the early March release. However, I will likely still have to keep the old padding algorithm around to maintain support for older ADFS auth scenarios. CodeQL will likely still flag the use of PKCS1v15 padding here, and it's something that'll just have to be dismissed.