mirror of
https://github.com/distribution/distribution.git
synced 2025-09-03 07:54:41 +00:00
Update Azure SDK and support additional authentication schemes
Microsoft has updated the golang Azure SDK significantly. Update the azure storage driver to use the new SDK. Add support for client secret and MSI authentication schemes in addition to shared key authentication. Implement rootDirectory support for the azure storage driver to mirror the S3 driver. Signed-off-by: Kirat Singh <kirat.singh@beacon.io> Co-authored-by: Cory Snider <corhere@gmail.com>
This commit is contained in:
Kirat Singh
355
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md
generated
vendored
Normal file
355
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md
generated
vendored
Normal file
@@ -0,0 +1,355 @@
|
||||
# Release History
|
||||
|
||||
## 1.2.1 (2023-01-26)
|
||||
|
||||
### Other Changes
|
||||
* Upgrade MSAL to v0.8.1
|
||||
|
||||
## 1.3.0-beta.2 (2023-01-10)
|
||||
|
||||
### Features Added
|
||||
* Added `OnBehalfOfCredential` to support the on-behalf-of flow
|
||||
([#16642](https://github.com/Azure/azure-sdk-for-go/issues/16642))
|
||||
|
||||
### Bugs Fixed
|
||||
* `AzureCLICredential` reports token expiration in local time (should be UTC)
|
||||
|
||||
### Other Changes
|
||||
* `AzureCLICredential` imposes its default timeout only when the `Context`
|
||||
passed to `GetToken()` has no deadline
|
||||
* Added `NewCredentialUnavailableError()`. This function constructs an error indicating
|
||||
a credential can't authenticate and an encompassing `ChainedTokenCredential` should
|
||||
try its next credential, if any.
|
||||
|
||||
## 1.3.0-beta.1 (2022-12-13)
|
||||
|
||||
### Features Added
|
||||
* `WorkloadIdentityCredential` and `DefaultAzureCredential` support
|
||||
Workload Identity Federation on Kubernetes. `DefaultAzureCredential`
|
||||
support requires environment variable configuration as set by the
|
||||
Workload Identity webhook.
|
||||
([#15615](https://github.com/Azure/azure-sdk-for-go/issues/15615))
|
||||
|
||||
## 1.2.0 (2022-11-08)
|
||||
|
||||
### Other Changes
|
||||
* This version includes all fixes and features from 1.2.0-beta.*
|
||||
|
||||
## 1.2.0-beta.3 (2022-10-11)
|
||||
|
||||
### Features Added
|
||||
* `ManagedIdentityCredential` caches tokens in memory
|
||||
|
||||
### Bugs Fixed
|
||||
* `ClientCertificateCredential` sends only the leaf cert for SNI authentication
|
||||
|
||||
## 1.2.0-beta.2 (2022-08-10)
|
||||
|
||||
### Features Added
|
||||
* Added `ClientAssertionCredential` to enable applications to authenticate
|
||||
with custom client assertions
|
||||
|
||||
### Other Changes
|
||||
* Updated AuthenticationFailedError with links to TROUBLESHOOTING.md for relevant errors
|
||||
* Upgraded `microsoft-authentication-library-for-go` requirement to v0.6.0
|
||||
|
||||
## 1.2.0-beta.1 (2022-06-07)
|
||||
|
||||
### Features Added
|
||||
* `EnvironmentCredential` reads certificate passwords from `AZURE_CLIENT_CERTIFICATE_PASSWORD`
|
||||
([#17099](https://github.com/Azure/azure-sdk-for-go/pull/17099))
|
||||
|
||||
## 1.1.0 (2022-06-07)
|
||||
|
||||
### Features Added
|
||||
* `ClientCertificateCredential` and `ClientSecretCredential` support ESTS-R. First-party
|
||||
applications can set environment variable `AZURE_REGIONAL_AUTHORITY_NAME` with a
|
||||
region name.
|
||||
([#15605](https://github.com/Azure/azure-sdk-for-go/issues/15605))
|
||||
|
||||
## 1.0.1 (2022-06-07)
|
||||
|
||||
### Other Changes
|
||||
* Upgrade `microsoft-authentication-library-for-go` requirement to v0.5.1
|
||||
([#18176](https://github.com/Azure/azure-sdk-for-go/issues/18176))
|
||||
|
||||
## 1.0.0 (2022-05-12)
|
||||
|
||||
### Features Added
|
||||
* `DefaultAzureCredential` reads environment variable `AZURE_CLIENT_ID` for the
|
||||
client ID of a user-assigned managed identity
|
||||
([#17293](https://github.com/Azure/azure-sdk-for-go/pull/17293))
|
||||
|
||||
### Breaking Changes
|
||||
* Removed `AuthorizationCodeCredential`. Use `InteractiveBrowserCredential` instead
|
||||
to authenticate a user with the authorization code flow.
|
||||
* Instances of `AuthenticationFailedError` are now returned by pointer.
|
||||
* `GetToken()` returns `azcore.AccessToken` by value
|
||||
|
||||
### Bugs Fixed
|
||||
* `AzureCLICredential` panics after receiving an unexpected error type
|
||||
([#17490](https://github.com/Azure/azure-sdk-for-go/issues/17490))
|
||||
|
||||
### Other Changes
|
||||
* `GetToken()` returns an error when the caller specifies no scope
|
||||
* Updated to the latest versions of `golang.org/x/crypto`, `azcore` and `internal`
|
||||
|
||||
## 0.14.0 (2022-04-05)
|
||||
|
||||
### Breaking Changes
|
||||
* This module now requires Go 1.18
|
||||
* Removed `AuthorityHost`. Credentials are now configured for sovereign or private
|
||||
clouds with the API in `azcore/cloud`, for example:
|
||||
```go
|
||||
// before
|
||||
opts := azidentity.ClientSecretCredentialOptions{AuthorityHost: azidentity.AzureGovernment}
|
||||
cred, err := azidentity.NewClientSecretCredential(tenantID, clientID, secret, &opts)
|
||||
|
||||
// after
|
||||
import "github.com/Azure/azure-sdk-for-go/sdk/azcore/cloud"
|
||||
|
||||
opts := azidentity.ClientSecretCredentialOptions{}
|
||||
opts.Cloud = cloud.AzureGovernment
|
||||
cred, err := azidentity.NewClientSecretCredential(tenantID, clientID, secret, &opts)
|
||||
```
|
||||
|
||||
## 0.13.2 (2022-03-08)
|
||||
|
||||
### Bugs Fixed
|
||||
* Prevented a data race in `DefaultAzureCredential` and `ChainedTokenCredential`
|
||||
([#17144](https://github.com/Azure/azure-sdk-for-go/issues/17144))
|
||||
|
||||
### Other Changes
|
||||
* Upgraded App Service managed identity version from 2017-09-01 to 2019-08-01
|
||||
([#17086](https://github.com/Azure/azure-sdk-for-go/pull/17086))
|
||||
|
||||
## 0.13.1 (2022-02-08)
|
||||
|
||||
### Features Added
|
||||
* `EnvironmentCredential` supports certificate SNI authentication when
|
||||
`AZURE_CLIENT_SEND_CERTIFICATE_CHAIN` is "true".
|
||||
([#16851](https://github.com/Azure/azure-sdk-for-go/pull/16851))
|
||||
|
||||
### Bugs Fixed
|
||||
* `ManagedIdentityCredential.GetToken()` now returns an error when configured for
|
||||
a user assigned identity in Azure Cloud Shell (which doesn't support such identities)
|
||||
([#16946](https://github.com/Azure/azure-sdk-for-go/pull/16946))
|
||||
|
||||
### Other Changes
|
||||
* `NewDefaultAzureCredential()` logs non-fatal errors. These errors are also included in the
|
||||
error returned by `DefaultAzureCredential.GetToken()` when it's unable to acquire a token
|
||||
from any source. ([#15923](https://github.com/Azure/azure-sdk-for-go/issues/15923))
|
||||
|
||||
## 0.13.0 (2022-01-11)
|
||||
|
||||
### Breaking Changes
|
||||
* Replaced `AuthenticationFailedError.RawResponse()` with a field having the same name
|
||||
* Unexported `CredentialUnavailableError`
|
||||
* Instances of `ChainedTokenCredential` will now skip looping through the list of source credentials and re-use the first successful credential on subsequent calls to `GetToken`.
|
||||
* If `ChainedTokenCredentialOptions.RetrySources` is true, `ChainedTokenCredential` will continue to try all of the originally provided credentials each time the `GetToken` method is called.
|
||||
* `ChainedTokenCredential.successfulCredential` will contain a reference to the last successful credential.
|
||||
* `DefaultAzureCredenial` will also re-use the first successful credential on subsequent calls to `GetToken`.
|
||||
* `DefaultAzureCredential.chain.successfulCredential` will also contain a reference to the last successful credential.
|
||||
|
||||
### Other Changes
|
||||
* `ManagedIdentityCredential` no longer probes IMDS before requesting a token
|
||||
from it. Also, an error response from IMDS no longer disables a credential
|
||||
instance. Following an error, a credential instance will continue to send
|
||||
requests to IMDS as necessary.
|
||||
* Adopted MSAL for user and service principal authentication
|
||||
* Updated `azcore` requirement to 0.21.0
|
||||
|
||||
## 0.12.0 (2021-11-02)
|
||||
### Breaking Changes
|
||||
* Raised minimum go version to 1.16
|
||||
* Removed `NewAuthenticationPolicy()` from credentials. Clients should instead use azcore's
|
||||
`runtime.NewBearerTokenPolicy()` to construct a bearer token authorization policy.
|
||||
* The `AuthorityHost` field in credential options structs is now a custom type,
|
||||
`AuthorityHost`, with underlying type `string`
|
||||
* `NewChainedTokenCredential` has a new signature to accommodate a placeholder
|
||||
options struct:
|
||||
```go
|
||||
// before
|
||||
cred, err := NewChainedTokenCredential(credA, credB)
|
||||
|
||||
// after
|
||||
cred, err := NewChainedTokenCredential([]azcore.TokenCredential{credA, credB}, nil)
|
||||
```
|
||||
* Removed `ExcludeAzureCLICredential`, `ExcludeEnvironmentCredential`, and `ExcludeMSICredential`
|
||||
from `DefaultAzureCredentialOptions`
|
||||
* `NewClientCertificateCredential` requires a `[]*x509.Certificate` and `crypto.PrivateKey` instead of
|
||||
a path to a certificate file. Added `ParseCertificates` to simplify getting these in common cases:
|
||||
```go
|
||||
// before
|
||||
cred, err := NewClientCertificateCredential("tenant", "client-id", "/cert.pem", nil)
|
||||
|
||||
// after
|
||||
certData, err := os.ReadFile("/cert.pem")
|
||||
certs, key, err := ParseCertificates(certData, password)
|
||||
cred, err := NewClientCertificateCredential(tenantID, clientID, certs, key, nil)
|
||||
```
|
||||
* Removed `InteractiveBrowserCredentialOptions.ClientSecret` and `.Port`
|
||||
* Removed `AADAuthenticationFailedError`
|
||||
* Removed `id` parameter of `NewManagedIdentityCredential()`. User assigned identities are now
|
||||
specified by `ManagedIdentityCredentialOptions.ID`:
|
||||
```go
|
||||
// before
|
||||
cred, err := NewManagedIdentityCredential("client-id", nil)
|
||||
// or, for a resource ID
|
||||
opts := &ManagedIdentityCredentialOptions{ID: ResourceID}
|
||||
cred, err := NewManagedIdentityCredential("/subscriptions/...", opts)
|
||||
|
||||
// after
|
||||
clientID := ClientID("7cf7db0d-...")
|
||||
opts := &ManagedIdentityCredentialOptions{ID: clientID}
|
||||
// or, for a resource ID
|
||||
resID: ResourceID("/subscriptions/...")
|
||||
opts := &ManagedIdentityCredentialOptions{ID: resID}
|
||||
cred, err := NewManagedIdentityCredential(opts)
|
||||
```
|
||||
* `DeviceCodeCredentialOptions.UserPrompt` has a new type: `func(context.Context, DeviceCodeMessage) error`
|
||||
* Credential options structs now embed `azcore.ClientOptions`. In addition to changing literal initialization
|
||||
syntax, this change renames `HTTPClient` fields to `Transport`.
|
||||
* Renamed `LogCredential` to `EventCredential`
|
||||
* `AzureCLICredential` no longer reads the environment variable `AZURE_CLI_PATH`
|
||||
* `NewManagedIdentityCredential` no longer reads environment variables `AZURE_CLIENT_ID` and
|
||||
`AZURE_RESOURCE_ID`. Use `ManagedIdentityCredentialOptions.ID` instead.
|
||||
* Unexported `AuthenticationFailedError` and `CredentialUnavailableError` structs. In their place are two
|
||||
interfaces having the same names.
|
||||
|
||||
### Bugs Fixed
|
||||
* `AzureCLICredential.GetToken` no longer mutates its `opts.Scopes`
|
||||
|
||||
### Features Added
|
||||
* Added connection configuration options to `DefaultAzureCredentialOptions`
|
||||
* `AuthenticationFailedError.RawResponse()` returns the HTTP response motivating the error,
|
||||
if available
|
||||
|
||||
### Other Changes
|
||||
* `NewDefaultAzureCredential()` returns `*DefaultAzureCredential` instead of `*ChainedTokenCredential`
|
||||
* Added `TenantID` field to `DefaultAzureCredentialOptions` and `AzureCLICredentialOptions`
|
||||
|
||||
## 0.11.0 (2021-09-08)
|
||||
### Breaking Changes
|
||||
* Unexported `AzureCLICredentialOptions.TokenProvider` and its type,
|
||||
`AzureCLITokenProvider`
|
||||
|
||||
### Bug Fixes
|
||||
* `ManagedIdentityCredential.GetToken` returns `CredentialUnavailableError`
|
||||
when IMDS has no assigned identity, signaling `DefaultAzureCredential` to
|
||||
try other credentials
|
||||
|
||||
|
||||
## 0.10.0 (2021-08-30)
|
||||
### Breaking Changes
|
||||
* Update based on `azcore` refactor [#15383](https://github.com/Azure/azure-sdk-for-go/pull/15383)
|
||||
|
||||
## 0.9.3 (2021-08-20)
|
||||
|
||||
### Bugs Fixed
|
||||
* `ManagedIdentityCredential.GetToken` no longer mutates its `opts.Scopes`
|
||||
|
||||
### Other Changes
|
||||
* Bumps version of `azcore` to `v0.18.1`
|
||||
|
||||
|
||||
## 0.9.2 (2021-07-23)
|
||||
### Features Added
|
||||
* Adding support for Service Fabric environment in `ManagedIdentityCredential`
|
||||
* Adding an option for using a resource ID instead of client ID in `ManagedIdentityCredential`
|
||||
|
||||
|
||||
## 0.9.1 (2021-05-24)
|
||||
### Features Added
|
||||
* Add LICENSE.txt and bump version information
|
||||
|
||||
|
||||
## 0.9.0 (2021-05-21)
|
||||
### Features Added
|
||||
* Add support for authenticating in Azure Stack environments
|
||||
* Enable user assigned identities for the IMDS scenario in `ManagedIdentityCredential`
|
||||
* Add scope to resource conversion in `GetToken()` on `ManagedIdentityCredential`
|
||||
|
||||
|
||||
## 0.8.0 (2021-01-20)
|
||||
### Features Added
|
||||
* Updating documentation
|
||||
|
||||
|
||||
## 0.7.1 (2021-01-04)
|
||||
### Features Added
|
||||
* Adding port option to `InteractiveBrowserCredential`
|
||||
|
||||
|
||||
## 0.7.0 (2020-12-11)
|
||||
### Features Added
|
||||
* Add `redirectURI` parameter back to authentication code flow
|
||||
|
||||
|
||||
## 0.6.1 (2020-12-09)
|
||||
### Features Added
|
||||
* Updating query parameter in `ManagedIdentityCredential` and updating datetime string for parsing managed identity access tokens.
|
||||
|
||||
|
||||
## 0.6.0 (2020-11-16)
|
||||
### Features Added
|
||||
* Remove `RedirectURL` parameter from auth code flow to align with the MSAL implementation which relies on the native client redirect URL.
|
||||
|
||||
|
||||
## 0.5.0 (2020-10-30)
|
||||
### Features Added
|
||||
* Flattening credential options
|
||||
|
||||
|
||||
## 0.4.3 (2020-10-21)
|
||||
### Features Added
|
||||
* Adding Azure Arc support in `ManagedIdentityCredential`
|
||||
|
||||
|
||||
## 0.4.2 (2020-10-16)
|
||||
### Features Added
|
||||
* Typo fixes
|
||||
|
||||
|
||||
## 0.4.1 (2020-10-16)
|
||||
### Features Added
|
||||
* Ensure authority hosts are only HTTPs
|
||||
|
||||
|
||||
## 0.4.0 (2020-10-16)
|
||||
### Features Added
|
||||
* Adding options structs for credentials
|
||||
|
||||
|
||||
## 0.3.0 (2020-10-09)
|
||||
### Features Added
|
||||
* Update `DeviceCodeCredential` callback
|
||||
|
||||
|
||||
## 0.2.2 (2020-10-09)
|
||||
### Features Added
|
||||
* Add `AuthorizationCodeCredential`
|
||||
|
||||
|
||||
## 0.2.1 (2020-10-06)
|
||||
### Features Added
|
||||
* Add `InteractiveBrowserCredential`
|
||||
|
||||
|
||||
## 0.2.0 (2020-09-11)
|
||||
### Features Added
|
||||
* Refactor `azidentity` on top of `azcore` refactor
|
||||
* Updated policies to conform to `policy.Policy` interface changes.
|
||||
* Updated non-retriable errors to conform to `azcore.NonRetriableError`.
|
||||
* Fixed calls to `Request.SetBody()` to include content type.
|
||||
* Switched endpoints to string types and removed extra parsing code.
|
||||
|
||||
|
||||
## 0.1.1 (2020-09-02)
|
||||
### Features Added
|
||||
* Add `AzureCLICredential` to `DefaultAzureCredential` chain
|
||||
|
||||
|
||||
## 0.1.0 (2020-07-23)
|
||||
### Features Added
|
||||
* Initial Release. Azure Identity library that provides Azure Active Directory token authentication support for the SDK.
|
||||
21
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/LICENSE.txt
generated
vendored
Normal file
21
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/LICENSE.txt
generated
vendored
Normal file
@@ -0,0 +1,21 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) Microsoft Corporation.
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE
|
||||
307
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/MIGRATION.md
generated
vendored
Normal file
307
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/MIGRATION.md
generated
vendored
Normal file
@@ -0,0 +1,307 @@
|
||||
# Migrating from autorest/adal to azidentity
|
||||
|
||||
`azidentity` provides Azure Active Directory (Azure AD) authentication for the newest Azure SDK modules (`github.com/azure-sdk-for-go/sdk/...`). Older Azure SDK packages (`github.com/azure-sdk-for-go/services/...`) use types from `github.com/go-autorest/autorest/adal` instead.
|
||||
|
||||
This guide shows common authentication code using `autorest/adal` and its equivalent using `azidentity`.
|
||||
|
||||
## Table of contents
|
||||
|
||||
- [Acquire a token](#acquire-a-token)
|
||||
- [Client certificate authentication](#client-certificate-authentication)
|
||||
- [Client secret authentication](#client-secret-authentication)
|
||||
- [Configuration](#configuration)
|
||||
- [Device code authentication](#device-code-authentication)
|
||||
- [Managed identity](#managed-identity)
|
||||
- [Use azidentity credentials with older packages](#use-azidentity-credentials-with-older-packages)
|
||||
|
||||
## Configuration
|
||||
|
||||
### `autorest/adal`
|
||||
|
||||
Token providers require a token audience (resource identifier) and an instance of `adal.OAuthConfig`, which requires an Azure AD endpoint and tenant:
|
||||
|
||||
```go
|
||||
import "github.com/Azure/go-autorest/autorest/adal"
|
||||
|
||||
oauthCfg, err := adal.NewOAuthConfig("https://login.chinacloudapi.cn", tenantID)
|
||||
handle(err)
|
||||
|
||||
spt, err := adal.NewServicePrincipalTokenWithSecret(
|
||||
*oauthCfg, clientID, "https://management.chinacloudapi.cn/", &adal.ServicePrincipalTokenSecret{ClientSecret: secret},
|
||||
)
|
||||
```
|
||||
|
||||
### `azidentity`
|
||||
|
||||
A credential instance can acquire tokens for any audience. The audience for each token is determined by the client requesting it. Credentials require endpoint configuration only for sovereign or private clouds. The `azcore/cloud` package has predefined configuration for sovereign clouds such as Azure China:
|
||||
|
||||
```go
|
||||
import (
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/cloud"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
|
||||
)
|
||||
|
||||
clientOpts := azcore.ClientOptions{Cloud: cloud.AzureChina}
|
||||
|
||||
cred, err := azidentity.NewClientSecretCredential(
|
||||
tenantID, clientID, secret, &azidentity.ClientSecretCredentialOptions{ClientOptions: clientOpts},
|
||||
)
|
||||
handle(err)
|
||||
```
|
||||
|
||||
## Client secret authentication
|
||||
|
||||
### `autorest/adal`
|
||||
|
||||
```go
|
||||
import (
|
||||
"github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2018-06-01/subscriptions"
|
||||
"github.com/Azure/go-autorest/autorest"
|
||||
"github.com/Azure/go-autorest/autorest/adal"
|
||||
)
|
||||
|
||||
oauthCfg, err := adal.NewOAuthConfig("https://login.microsoftonline.com", tenantID)
|
||||
handle(err)
|
||||
spt, err := adal.NewServicePrincipalTokenWithSecret(
|
||||
*oauthCfg, clientID, "https://management.azure.com/", &adal.ServicePrincipalTokenSecret{ClientSecret: secret},
|
||||
)
|
||||
handle(err)
|
||||
|
||||
client := subscriptions.NewClient()
|
||||
client.Authorizer = autorest.NewBearerAuthorizer(spt)
|
||||
```
|
||||
|
||||
### `azidentity`
|
||||
|
||||
```go
|
||||
import (
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions"
|
||||
)
|
||||
|
||||
cred, err := azidentity.NewClientSecretCredential(tenantID, clientID, secret, nil)
|
||||
handle(err)
|
||||
|
||||
client, err := armsubscriptions.NewClient(cred, nil)
|
||||
handle(err)
|
||||
```
|
||||
|
||||
## Client certificate authentication
|
||||
|
||||
### `autorest/adal`
|
||||
|
||||
```go
|
||||
import (
|
||||
"os"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2018-06-01/subscriptions"
|
||||
"github.com/Azure/go-autorest/autorest"
|
||||
"github.com/Azure/go-autorest/autorest/adal"
|
||||
)
|
||||
certData, err := os.ReadFile("./example.pfx")
|
||||
handle(err)
|
||||
|
||||
certificate, rsaPrivateKey, err := decodePkcs12(certData, "")
|
||||
handle(err)
|
||||
|
||||
oauthCfg, err := adal.NewOAuthConfig("https://login.microsoftonline.com", tenantID)
|
||||
handle(err)
|
||||
|
||||
spt, err := adal.NewServicePrincipalTokenFromCertificate(
|
||||
*oauthConfig, clientID, certificate, rsaPrivateKey, "https://management.azure.com/",
|
||||
)
|
||||
|
||||
client := subscriptions.NewClient()
|
||||
client.Authorizer = autorest.NewBearerAuthorizer(spt)
|
||||
```
|
||||
|
||||
### `azidentity`
|
||||
|
||||
```go
|
||||
import (
|
||||
"os"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions"
|
||||
)
|
||||
|
||||
certData, err := os.ReadFile("./example.pfx")
|
||||
handle(err)
|
||||
|
||||
certs, key, err := azidentity.ParseCertificates(certData, nil)
|
||||
handle(err)
|
||||
|
||||
cred, err = azidentity.NewClientCertificateCredential(tenantID, clientID, certs, key, nil)
|
||||
handle(err)
|
||||
|
||||
client, err := armsubscriptions.NewClient(cred, nil)
|
||||
handle(err)
|
||||
```
|
||||
|
||||
## Managed identity
|
||||
|
||||
### `autorest/adal`
|
||||
|
||||
```go
|
||||
import (
|
||||
"github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2018-06-01/subscriptions"
|
||||
"github.com/Azure/go-autorest/autorest"
|
||||
"github.com/Azure/go-autorest/autorest/adal"
|
||||
)
|
||||
|
||||
spt, err := adal.NewServicePrincipalTokenFromManagedIdentity("https://management.azure.com/", nil)
|
||||
handle(err)
|
||||
|
||||
client := subscriptions.NewClient()
|
||||
client.Authorizer = autorest.NewBearerAuthorizer(spt)
|
||||
```
|
||||
|
||||
### `azidentity`
|
||||
|
||||
```go
|
||||
import (
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions"
|
||||
)
|
||||
|
||||
cred, err := azidentity.NewManagedIdentityCredential(nil)
|
||||
handle(err)
|
||||
|
||||
client, err := armsubscriptions.NewClient(cred, nil)
|
||||
handle(err)
|
||||
```
|
||||
|
||||
### User-assigned identities
|
||||
|
||||
`autorest/adal`:
|
||||
|
||||
```go
|
||||
import "github.com/Azure/go-autorest/autorest/adal"
|
||||
|
||||
opts := &adal.ManagedIdentityOptions{ClientID: "..."}
|
||||
spt, err := adal.NewServicePrincipalTokenFromManagedIdentity("https://management.azure.com/")
|
||||
handle(err)
|
||||
```
|
||||
|
||||
`azidentity`:
|
||||
|
||||
```go
|
||||
import "github.com/Azure/azure-sdk-for-go/sdk/azidentity"
|
||||
|
||||
opts := azidentity.ManagedIdentityCredentialOptions{ID: azidentity.ClientID("...")}
|
||||
cred, err := azidentity.NewManagedIdentityCredential(&opts)
|
||||
handle(err)
|
||||
```
|
||||
|
||||
## Device code authentication
|
||||
|
||||
### `autorest/adal`
|
||||
|
||||
```go
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2018-06-01/subscriptions"
|
||||
"github.com/Azure/go-autorest/autorest"
|
||||
"github.com/Azure/go-autorest/autorest/adal"
|
||||
)
|
||||
|
||||
oauthClient := &http.Client{}
|
||||
oauthCfg, err := adal.NewOAuthConfig("https://login.microsoftonline.com", tenantID)
|
||||
handle(err)
|
||||
resource := "https://management.azure.com/"
|
||||
deviceCode, err := adal.InitiateDeviceAuth(oauthClient, *oauthCfg, clientID, resource)
|
||||
handle(err)
|
||||
|
||||
// display instructions, wait for the user to authenticate
|
||||
fmt.Println(*deviceCode.Message)
|
||||
token, err := adal.WaitForUserCompletion(oauthClient, deviceCode)
|
||||
handle(err)
|
||||
|
||||
spt, err := adal.NewServicePrincipalTokenFromManualToken(*oauthCfg, clientID, resource, *token)
|
||||
handle(err)
|
||||
|
||||
client := subscriptions.NewClient()
|
||||
client.Authorizer = autorest.NewBearerAuthorizer(spt)
|
||||
```
|
||||
|
||||
### `azidentity`
|
||||
|
||||
```go
|
||||
import (
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions"
|
||||
)
|
||||
|
||||
cred, err := azidentity.NewDeviceCodeCredential(nil)
|
||||
handle(err)
|
||||
|
||||
client, err := armsubscriptions.NewSubscriptionsClient(cred, nil)
|
||||
handle(err)
|
||||
```
|
||||
|
||||
`azidentity.DeviceCodeCredential` will guide a user through authentication, printing instructions to the console by default. The user prompt is customizable. For more information, see the [package documentation](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#DeviceCodeCredential).
|
||||
|
||||
## Acquire a token
|
||||
|
||||
### `autorest/adal`
|
||||
|
||||
```go
|
||||
import "github.com/Azure/go-autorest/autorest/adal"
|
||||
|
||||
oauthCfg, err := adal.NewOAuthConfig("https://login.microsoftonline.com", tenantID)
|
||||
handle(err)
|
||||
|
||||
spt, err := adal.NewServicePrincipalTokenWithSecret(
|
||||
*oauthCfg, clientID, "https://vault.azure.net", &adal.ServicePrincipalTokenSecret{ClientSecret: secret},
|
||||
)
|
||||
|
||||
err = spt.Refresh()
|
||||
if err == nil {
|
||||
token := spt.Token
|
||||
}
|
||||
```
|
||||
|
||||
### `azidentity`
|
||||
|
||||
In ordinary usage, application code doesn't need to request tokens from credentials directly. Azure SDK clients handle token acquisition and refreshing internally. However, applications may call `GetToken()` to do so. All credential types have this method.
|
||||
|
||||
```go
|
||||
import (
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
|
||||
)
|
||||
|
||||
cred, err := azidentity.NewClientSecretCredential(tenantID, clientID, secret, nil)
|
||||
handle(err)
|
||||
|
||||
tk, err := cred.GetToken(
|
||||
context.TODO(), policy.TokenRequestOptions{Scopes: []string{"https://vault.azure.net/.default"}},
|
||||
)
|
||||
if err == nil {
|
||||
token := tk.Token
|
||||
}
|
||||
```
|
||||
|
||||
Note that `azidentity` credentials use the Azure AD v2.0 endpoint, which requires OAuth 2 scopes instead of the resource identifiers `autorest/adal` expects. For more information, see [Azure AD documentation](https://docs.microsoft.com/azure/active-directory/develop/v2-permissions-and-consent).
|
||||
|
||||
## Use azidentity credentials with older packages
|
||||
|
||||
The [azidext module](https://pkg.go.dev/github.com/jongio/azidext/go/azidext) provides an adapter for `azidentity` credential types. The adapter enables using the credential types with older Azure SDK clients. For example:
|
||||
|
||||
```go
|
||||
import (
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
|
||||
"github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2018-06-01/subscriptions"
|
||||
"github.com/jongio/azidext/go/azidext"
|
||||
)
|
||||
|
||||
cred, err := azidentity.NewClientSecretCredential(tenantID, clientID, secret, nil)
|
||||
handle(err)
|
||||
|
||||
client := subscriptions.NewClient()
|
||||
client.Authorizer = azidext.NewTokenCredentialAdapter(cred, []string{"https://management.azure.com//.default"})
|
||||
```
|
||||
|
||||
|
||||
241
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/README.md
generated
vendored
Normal file
241
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/README.md
generated
vendored
Normal file
@@ -0,0 +1,241 @@
|
||||
# Azure Identity Client Module for Go
|
||||
|
||||
The Azure Identity module provides Azure Active Directory (Azure AD) token authentication support across the Azure SDK. It includes a set of `TokenCredential` implementations, which can be used with Azure SDK clients supporting token authentication.
|
||||
|
||||
[](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity)
|
||||
| [Azure Active Directory documentation](https://docs.microsoft.com/azure/active-directory/)
|
||||
| [Source code](https://github.com/Azure/azure-sdk-for-go/tree/main/sdk/azidentity)
|
||||
|
||||
# Getting started
|
||||
|
||||
## Install the module
|
||||
|
||||
This project uses [Go modules](https://github.com/golang/go/wiki/Modules) for versioning and dependency management.
|
||||
|
||||
Install the Azure Identity module:
|
||||
|
||||
```sh
|
||||
go get -u github.com/Azure/azure-sdk-for-go/sdk/azidentity
|
||||
```
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- an [Azure subscription](https://azure.microsoft.com/free/)
|
||||
- Go 1.18
|
||||
|
||||
### Authenticating during local development
|
||||
|
||||
When debugging and executing code locally, developers typically use their own accounts to authenticate calls to Azure services. The `azidentity` module supports authenticating through developer tools to simplify local development.
|
||||
|
||||
#### Authenticating via the Azure CLI
|
||||
|
||||
`DefaultAzureCredential` and `AzureCLICredential` can authenticate as the user
|
||||
signed in to the [Azure CLI](https://docs.microsoft.com/cli/azure). To sign in to the Azure CLI, run `az login`. On a system with a default web browser, the Azure CLI will launch the browser to authenticate a user.
|
||||
|
||||
When no default browser is available, `az login` will use the device code
|
||||
authentication flow. This can also be selected manually by running `az login --use-device-code`.
|
||||
|
||||
## Key concepts
|
||||
|
||||
### Credentials
|
||||
|
||||
A credential is a type which contains or can obtain the data needed for a
|
||||
service client to authenticate requests. Service clients across the Azure SDK
|
||||
accept a credential instance when they are constructed, and use that credential
|
||||
to authenticate requests.
|
||||
|
||||
The `azidentity` module focuses on OAuth authentication with Azure Active
|
||||
Directory (AAD). It offers a variety of credential types capable of acquiring
|
||||
an Azure AD access token. See [Credential Types](#credential-types "Credential Types") for a list of this module's credential types.
|
||||
|
||||
### DefaultAzureCredential
|
||||
|
||||
`DefaultAzureCredential` is appropriate for most apps that will be deployed to Azure. It combines common production credentials with development credentials. It attempts to authenticate via the following mechanisms in this order, stopping when one succeeds:
|
||||
|
||||
|
||||
|
||||
1. **Environment** - `DefaultAzureCredential` will read account information specified via [environment variables](#environment-variables) and use it to authenticate.
|
||||
2. **Managed Identity** - If the app is deployed to an Azure host with managed identity enabled, `DefaultAzureCredential` will authenticate with it.
|
||||
3. **Azure CLI** - If a user or service principal has authenticated via the Azure CLI `az login` command, `DefaultAzureCredential` will authenticate that identity.
|
||||
|
||||
> Note: `DefaultAzureCredential` is intended to simplify getting started with the SDK by handling common scenarios with reasonable default behaviors. Developers who want more control or whose scenario isn't served by the default settings should use other credential types.
|
||||
|
||||
## Managed Identity
|
||||
|
||||
`DefaultAzureCredential` and `ManagedIdentityCredential` support
|
||||
[managed identity authentication](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview)
|
||||
in any hosting environment which supports managed identities, such as (this list is not exhaustive):
|
||||
* [Azure App Service](https://docs.microsoft.com/azure/app-service/overview-managed-identity)
|
||||
* [Azure Arc](https://docs.microsoft.com/azure/azure-arc/servers/managed-identity-authentication)
|
||||
* [Azure Cloud Shell](https://docs.microsoft.com/azure/cloud-shell/msi-authorization)
|
||||
* [Azure Kubernetes Service](https://docs.microsoft.com/azure/aks/use-managed-identity)
|
||||
* [Azure Service Fabric](https://docs.microsoft.com/azure/service-fabric/concepts-managed-identity)
|
||||
* [Azure Virtual Machines](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token)
|
||||
|
||||
## Examples
|
||||
|
||||
- [Authenticate with DefaultAzureCredential](#authenticate-with-defaultazurecredential "Authenticate with DefaultAzureCredential")
|
||||
- [Define a custom authentication flow with ChainedTokenCredential](#define-a-custom-authentication-flow-with-chainedtokencredential "Define a custom authentication flow with ChainedTokenCredential")
|
||||
- [Specify a user-assigned managed identity for DefaultAzureCredential](#specify-a-user-assigned-managed-identity-for-defaultazurecredential)
|
||||
|
||||
### Authenticate with DefaultAzureCredential
|
||||
|
||||
This example demonstrates authenticating a client from the `armresources` module with `DefaultAzureCredential`.
|
||||
|
||||
```go
|
||||
cred, err := azidentity.NewDefaultAzureCredential(nil)
|
||||
if err != nil {
|
||||
// handle error
|
||||
}
|
||||
|
||||
client := armresources.NewResourceGroupsClient("subscription ID", cred, nil)
|
||||
```
|
||||
|
||||
### Specify a user-assigned managed identity for DefaultAzureCredential
|
||||
|
||||
To configure `DefaultAzureCredential` to authenticate a user-assigned managed identity, set the environment variable `AZURE_CLIENT_ID` to the identity's client ID.
|
||||
|
||||
### Define a custom authentication flow with `ChainedTokenCredential`
|
||||
|
||||
`DefaultAzureCredential` is generally the quickest way to get started developing apps for Azure. For more advanced scenarios, `ChainedTokenCredential` links multiple credential instances to be tried sequentially when authenticating. It will try each chained credential in turn until one provides a token or fails to authenticate due to an error.
|
||||
|
||||
The following example demonstrates creating a credential, which will attempt to authenticate using managed identity. It will fall back to authenticating via the Azure CLI when a managed identity is unavailable.
|
||||
|
||||
```go
|
||||
managed, err := azidentity.NewManagedIdentityCredential(nil)
|
||||
if err != nil {
|
||||
// handle error
|
||||
}
|
||||
azCLI, err := azidentity.NewAzureCLICredential(nil)
|
||||
if err != nil {
|
||||
// handle error
|
||||
}
|
||||
chain, err := azidentity.NewChainedTokenCredential([]azcore.TokenCredential{managed, azCLI}, nil)
|
||||
if err != nil {
|
||||
// handle error
|
||||
}
|
||||
|
||||
client := armresources.NewResourceGroupsClient("subscription ID", chain, nil)
|
||||
```
|
||||
|
||||
## Credential Types
|
||||
|
||||
### Authenticating Azure Hosted Applications
|
||||
|
||||
|Credential|Usage
|
||||
|-|-
|
||||
|[DefaultAzureCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#DefaultAzureCredential)|Simplified authentication experience for getting started developing Azure apps
|
||||
|[ChainedTokenCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#ChainedTokenCredential)|Define custom authentication flows, composing multiple credentials
|
||||
|[EnvironmentCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#EnvironmentCredential)|Authenticate a service principal or user configured by environment variables
|
||||
|[ManagedIdentityCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#ManagedIdentityCredential)|Authenticate the managed identity of an Azure resource
|
||||
|
||||
### Authenticating Service Principals
|
||||
|
||||
|Credential|Usage
|
||||
|-|-
|
||||
|[ClientAssertionCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.2.0-beta.2#ClientAssertionCredential)|Authenticate a service principal with a signed client assertion
|
||||
|[ClientCertificateCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#ClientCertificateCredential)|Authenticate a service principal with a certificate
|
||||
|[ClientSecretCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#ClientSecretCredential)|Authenticate a service principal with a secret
|
||||
|
||||
### Authenticating Users
|
||||
|
||||
|Credential|Usage
|
||||
|-|-
|
||||
|[InteractiveBrowserCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#InteractiveBrowserCredential)|Interactively authenticate a user with the default web browser
|
||||
|[DeviceCodeCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#DeviceCodeCredential)|Interactively authenticate a user on a device with limited UI
|
||||
|[UsernamePasswordCredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#UsernamePasswordCredential)|Authenticate a user with a username and password
|
||||
|
||||
### Authenticating via Development Tools
|
||||
|
||||
|Credential|Usage
|
||||
|-|-
|
||||
|[AzureCLICredential](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#AzureCLICredential)|Authenticate as the user signed in to the Azure CLI
|
||||
|
||||
## Environment Variables
|
||||
|
||||
`DefaultAzureCredential` and `EnvironmentCredential` can be configured with environment variables. Each type of authentication requires values for specific variables:
|
||||
|
||||
#### Service principal with secret
|
||||
|
||||
|variable name|value
|
||||
|-|-
|
||||
|`AZURE_CLIENT_ID`|ID of an Azure Active Directory application
|
||||
|`AZURE_TENANT_ID`|ID of the application's Azure Active Directory tenant
|
||||
|`AZURE_CLIENT_SECRET`|one of the application's client secrets
|
||||
|
||||
#### Service principal with certificate
|
||||
|
||||
|variable name|value
|
||||
|-|-
|
||||
|`AZURE_CLIENT_ID`|ID of an Azure Active Directory application
|
||||
|`AZURE_TENANT_ID`|ID of the application's Azure Active Directory tenant
|
||||
|`AZURE_CLIENT_CERTIFICATE_PATH`|path to a certificate file including private key
|
||||
|`AZURE_CLIENT_CERTIFICATE_PASSWORD`|password of the certificate file, if any
|
||||
|
||||
#### Username and password
|
||||
|
||||
|variable name|value
|
||||
|-|-
|
||||
|`AZURE_CLIENT_ID`|ID of an Azure Active Directory application
|
||||
|`AZURE_USERNAME`|a username (usually an email address)
|
||||
|`AZURE_PASSWORD`|that user's password
|
||||
|
||||
Configuration is attempted in the above order. For example, if values for a
|
||||
client secret and certificate are both present, the client secret will be used.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Error Handling
|
||||
|
||||
Credentials return an `error` when they fail to authenticate or lack data they require to authenticate. For guidance on resolving errors from specific credential types, see the [troubleshooting guide](https://aka.ms/azsdk/go/identity/troubleshoot).
|
||||
|
||||
For more details on handling specific Azure Active Directory errors please refer to the
|
||||
Azure Active Directory
|
||||
[error code documentation](https://docs.microsoft.com/azure/active-directory/develop/reference-aadsts-error-codes).
|
||||
|
||||
### Logging
|
||||
|
||||
This module uses the classification-based logging implementation in `azcore`. To enable console logging for all SDK modules, set `AZURE_SDK_GO_LOGGING` to `all`. Use the `azcore/log` package to control log event output or to enable logs for `azidentity` only. For example:
|
||||
```go
|
||||
import azlog "github.com/Azure/azure-sdk-for-go/sdk/azcore/log"
|
||||
|
||||
// print log output to stdout
|
||||
azlog.SetListener(func(event azlog.Event, s string) {
|
||||
fmt.Println(s)
|
||||
})
|
||||
|
||||
// include only azidentity credential logs
|
||||
azlog.SetEvents(azidentity.EventAuthentication)
|
||||
```
|
||||
|
||||
Credentials log basic information only, such as `GetToken` success or failure and errors. These log entries don't contain authentication secrets but may contain sensitive information.
|
||||
|
||||
## Next steps
|
||||
|
||||
Client and management modules listed on the [Azure SDK releases page](https://azure.github.io/azure-sdk/releases/latest/go.html) support authenticating with `azidentity` credential types. You can learn more about using these libraries in their documentation, which is linked from the release page.
|
||||
|
||||
## Provide Feedback
|
||||
|
||||
If you encounter bugs or have suggestions, please
|
||||
[open an issue](https://github.com/Azure/azure-sdk-for-go/issues).
|
||||
|
||||
## Contributing
|
||||
|
||||
This project welcomes contributions and suggestions. Most contributions require
|
||||
you to agree to a Contributor License Agreement (CLA) declaring that you have
|
||||
the right to, and actually do, grant us the rights to use your contribution.
|
||||
For details, visit [https://cla.microsoft.com](https://cla.microsoft.com).
|
||||
|
||||
When you submit a pull request, a CLA-bot will automatically determine whether
|
||||
you need to provide a CLA and decorate the PR appropriately (e.g., label,
|
||||
comment). Simply follow the instructions provided by the bot. You will only
|
||||
need to do this once across all repos using our CLA.
|
||||
|
||||
This project has adopted the
|
||||
[Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
|
||||
For more information, see the
|
||||
[Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/)
|
||||
or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any
|
||||
additional questions or comments.
|
||||
|
||||
|
||||
197
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/TROUBLESHOOTING.md
generated
vendored
Normal file
197
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/TROUBLESHOOTING.md
generated
vendored
Normal file
@@ -0,0 +1,197 @@
|
||||
# Troubleshoot Azure Identity authentication issues
|
||||
|
||||
This troubleshooting guide covers failure investigation techniques, common errors for the credential types in the `azidentity` module, and mitigation steps to resolve these errors.
|
||||
|
||||
## Table of contents
|
||||
|
||||
- [Handle azidentity errors](#handle-azidentity-errors)
|
||||
- [Permission issues](#permission-issues)
|
||||
- [Find relevant information in errors](#find-relevant-information-in-errors)
|
||||
- [Enable and configure logging](#enable-and-configure-logging)
|
||||
- [Troubleshoot DefaultAzureCredential authentication issues](#troubleshoot-defaultazurecredential-authentication-issues)
|
||||
- [Troubleshoot EnvironmentCredential authentication issues](#troubleshoot-environmentcredential-authentication-issues)
|
||||
- [Troubleshoot ClientSecretCredential authentication issues](#troubleshoot-clientsecretcredential-authentication-issues)
|
||||
- [Troubleshoot ClientCertificateCredential authentication issues](#troubleshoot-clientcertificatecredential-authentication-issues)
|
||||
- [Troubleshoot UsernamePasswordCredential authentication issues](#troubleshoot-usernamepasswordcredential-authentication-issues)
|
||||
- [Troubleshoot ManagedIdentityCredential authentication issues](#troubleshoot-managedidentitycredential-authentication-issues)
|
||||
- [Azure Virtual Machine managed identity](#azure-virtual-machine-managed-identity)
|
||||
- [Azure App Service and Azure Functions managed identity](#azure-app-service-and-azure-functions-managed-identity)
|
||||
- [Azure Kubernetes Service managed identity](#azure-kubernetes-service-managed-identity)
|
||||
- [Troubleshoot AzureCliCredential authentication issues](#troubleshoot-azureclicredential-authentication-issues)
|
||||
- [Get additional help](#get-additional-help)
|
||||
|
||||
## Handle azidentity errors
|
||||
|
||||
Any service client method that makes a request to the service may return an error due to authentication failure. This is because the credential authenticates on the first call to the service and on any subsequent call that needs to refresh an access token. Authentication errors include a description of the failure and possibly an error message from Azure Active Directory (Azure AD). Depending on the application, these errors may or may not be recoverable.
|
||||
|
||||
### Permission issues
|
||||
|
||||
Service client errors with a status code of 401 or 403 often indicate that authentication succeeded but the caller doesn't have permission to access the specified API. Check the service documentation to determine which RBAC roles are needed for the request, and ensure the authenticated user or service principal has the appropriate role assignments.
|
||||
|
||||
## Find relevant information in errors
|
||||
|
||||
Authentication errors can include responses from Azure AD and often contain information helpful in diagnosis. Consider the following error message:
|
||||
|
||||
```
|
||||
ClientSecretCredential authentication failed
|
||||
POST https://login.microsoftonline.com/3c631bb7-a9f7-4343-a5ba-a615913/oauth2/v2.0/token
|
||||
--------------------------------------------------------------------------------
|
||||
RESPONSE 401 Unauthorized
|
||||
--------------------------------------------------------------------------------
|
||||
{
|
||||
"error": "invalid_client",
|
||||
"error_description": "AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret added to app '86be4c01-505b-45e9-bfc0-9b825fd84'.\r\nTrace ID: 03da4b8e-5ffe-48ca-9754-aff4276f0100\r\nCorrelation ID: 7b12f9bb-2eef-42e3-ad75-eee69ec9088d\r\nTimestamp: 2022-03-02 18:25:26Z",
|
||||
"error_codes": [
|
||||
7000215
|
||||
],
|
||||
"timestamp": "2022-03-02 18:25:26Z",
|
||||
"trace_id": "03da4b8e-5ffe-48ca-9754-aff4276f0100",
|
||||
"correlation_id": "7b12f9bb-2eef-42e3-ad75-eee69ec9088d",
|
||||
"error_uri": "https://login.microsoftonline.com/error?code=7000215"
|
||||
}
|
||||
--------------------------------------------------------------------------------
|
||||
```
|
||||
|
||||
This error contains several pieces of information:
|
||||
|
||||
- __Failing Credential Type__: The type of credential that failed to authenticate. This can be helpful when diagnosing issues with chained credential types such as `DefaultAzureCredential` or `ChainedTokenCredential`.
|
||||
|
||||
- __Azure AD Error Code and Message__: The error code and message returned by Azure AD. This can give insight into the specific reason the request failed. For instance, in this case authentication failed because the provided client secret is incorrect. [Azure AD documentation](https://docs.microsoft.com/azure/active-directory/develop/reference-aadsts-error-codes#aadsts-error-codes) has more information on AADSTS error codes.
|
||||
|
||||
- __Correlation ID and Timestamp__: The correlation ID and timestamp identify the request in server-side logs. This information can be useful to support engineers diagnosing unexpected Azure AD failures.
|
||||
|
||||
### Enable and configure logging
|
||||
|
||||
`azidentity` provides the same logging capabilities as the rest of the Azure SDK. The simplest way to see the logs to help debug authentication issues is to print credential logs to the console.
|
||||
```go
|
||||
import azlog "github.com/Azure/azure-sdk-for-go/sdk/azcore/log"
|
||||
|
||||
// print log output to stdout
|
||||
azlog.SetListener(func(event azlog.Event, s string) {
|
||||
fmt.Println(s)
|
||||
})
|
||||
|
||||
// include only azidentity credential logs
|
||||
azlog.SetEvents(azidentity.EventAuthentication)
|
||||
```
|
||||
|
||||
## Troubleshoot DefaultAzureCredential authentication issues
|
||||
|
||||
| Error |Description| Mitigation |
|
||||
|---|---|---|
|
||||
|"DefaultAzureCredential failed to acquire a token"|No credential in the `DefaultAzureCredential` chain provided a token|<ul><li>[Enable logging](#enable-and-configure-logging) to get further diagnostic information.</li><li>Consult the troubleshooting guide for underlying credential types for more information.</li><ul><li>[EnvironmentCredential](#troubleshoot-environmentcredential-authentication-issues)</li><li>[ManagedIdentityCredential](#troubleshoot-visualstudiocredential-authentication-issues)</li><li>[AzureCLICredential](#troubleshoot-azureclicredential-authentication-issues)</li></ul>|
|
||||
|Error from the client with a status code of 401 or 403|Authentication succeeded but the authorizing Azure service responded with a 401 (Unauthorized), or 403 (Forbidden) status code|<ul><li>[Enable logging](#enable-and-configure-logging) to determine which credential in the chain returned the authenticating token.</li><li>If an unexpected credential is returning a token, check application configuration such as environment variables.</li><li>Ensure the correct role is assigned to the authenticated identity. For example, a service specific role rather than the subscription Owner role.</li></ul>|
|
||||
|
||||
## Troubleshoot EnvironmentCredential authentication issues
|
||||
|
||||
| Error Message |Description| Mitigation |
|
||||
|---|---|---|
|
||||
|Missing or incomplete environment variable configuration|A valid combination of environment variables wasn't set|Ensure the appropriate environment variables are set for the intended authentication method as described in the [module documentation](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#EnvironmentCredential)|
|
||||
|
||||
<a id="client-secret"></a>
|
||||
## Troubleshoot ClientSecretCredential authentication issues
|
||||
|
||||
| Error Code | Issue | Mitigation |
|
||||
|---|---|---|
|
||||
|AADSTS7000215|An invalid client secret was provided.|Ensure the secret provided to the credential constructor is valid. If unsure, create a new client secret using the Azure portal. Details on creating a new client secret are in [Azure AD documentation](https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal#option-2-create-a-new-application-secret).|
|
||||
|AADSTS7000222|An expired client secret was provided.|Create a new client secret using the Azure portal. Details on creating a new client secret are in [Azure AD documentation](https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal#option-2-create-a-new-application-secret).|
|
||||
|AADSTS700016|The specified application wasn't found in the specified tenant.|Ensure the client and tenant IDs provided to the credential constructor are correct for your application registration. For multi-tenant apps, ensure the application has been added to the desired tenant by a tenant admin. To add a new application in the desired tenant, follow the [Azure AD instructions](https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal).|
|
||||
|
||||
<a id="client-cert"></a>
|
||||
## Troubleshoot ClientCertificateCredential authentication issues
|
||||
|
||||
| Error Code | Description | Mitigation |
|
||||
|---|---|---|
|
||||
|AADSTS700027|Client assertion contains an invalid signature.|Ensure the specified certificate has been uploaded to the application registration as described in [Azure AD documentation](https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal#option-1-upload-a-certificate).|
|
||||
|AADSTS700016|The specified application wasn't found in the specified tenant.|Ensure the client and tenant IDs provided to the credential constructor are correct for your application registration. For multi-tenant apps, ensure the application has been added to the desired tenant by a tenant admin. To add a new application in the desired tenant, follow the [Azure AD instructions](https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal).|
|
||||
|
||||
<a id="username-password"></a>
|
||||
## Troubleshoot UsernamePasswordCredential authentication issues
|
||||
|
||||
| Error Code | Issue | Mitigation |
|
||||
|---|---|---|
|
||||
|AADSTS50126|The provided username or password is invalid.|Ensure the username and password provided to the credential constructor are valid.|
|
||||
|
||||
<a id="managed-id"></a>
|
||||
## Troubleshoot ManagedIdentityCredential authentication issues
|
||||
|
||||
`ManagedIdentityCredential` is designed to work on a variety of Azure hosts support managed identity. Configuration and troubleshooting vary from host to host. The below table lists the Azure hosts that can be assigned a managed identity and are supported by `ManagedIdentityCredential`.
|
||||
|
||||
|Host Environment| | |
|
||||
|---|---|---|
|
||||
|Azure Virtual Machines and Scale Sets|[Configuration](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm)|[Troubleshooting](#azure-virtual-machine-managed-identity)|
|
||||
|Azure App Service and Azure Functions|[Configuration](https://docs.microsoft.com/azure/app-service/overview-managed-identity)|[Troubleshooting](#azure-app-service-and-azure-functions-managed-identity)|
|
||||
|Azure Kubernetes Service|[Configuration](https://azure.github.io/aad-pod-identity/docs/)|[Troubleshooting](#azure-kubernetes-service-managed-identity)|
|
||||
|Azure Arc|[Configuration](https://docs.microsoft.com/azure/azure-arc/servers/managed-identity-authentication)||
|
||||
|Azure Service Fabric|[Configuration](https://docs.microsoft.com/azure/service-fabric/concepts-managed-identity)||
|
||||
|
||||
### Azure Virtual Machine managed identity
|
||||
|
||||
| Error Message |Description| Mitigation |
|
||||
|---|---|---|
|
||||
|The requested identity hasn’t been assigned to this resource.|The IMDS endpoint responded with a status code of 400, indicating the requested identity isn’t assigned to the VM.|If using a user assigned identity, ensure the specified ID is correct.<p/><p/>If using a system assigned identity, make sure it has been enabled as described in [managed identity documentation](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm#enable-system-assigned-managed-identity-on-an-existing-vm).|
|
||||
|The request failed due to a gateway error.|The request to the IMDS endpoint failed due to a gateway error, 502 or 504 status code.|IMDS doesn't support requests via proxy or gateway. Disable proxies or gateways running on the VM for requests to the IMDS endpoint `http://169.254.169.254`|
|
||||
|No response received from the managed identity endpoint.|No response was received for the request to IMDS or the request timed out.|<ul><li>Ensure the VM is configured for managed identity as described in [managed identity documentation](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm).</li><li>Verify the IMDS endpoint is reachable on the VM. See [below](#verify-imds-is-available-on-the-vm) for instructions.</li></ul>|
|
||||
|Multiple attempts failed to obtain a token from the managed identity endpoint.|The credential has exhausted its retries for a token request.|<ul><li>Refer to the error message for more details on specific failures.<li>Ensure the VM is configured for managed identity as described in [managed identity documentation](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm).</li><li>Verify the IMDS endpoint is reachable on the VM. See [below](#verify-imds-is-available-on-the-vm) for instructions.</li></ul>|
|
||||
|
||||
#### Verify IMDS is available on the VM
|
||||
|
||||
If you have access to the VM, you can use `curl` to verify the managed identity endpoint is available.
|
||||
|
||||
```sh
|
||||
curl 'http://169.254.169.254/metadata/identity/oauth2/token?resource=https://management.core.windows.net&api-version=2018-02-01' -H "Metadata: true"
|
||||
```
|
||||
|
||||
> This command's output will contain an access token and SHOULD NOT BE SHARED, to avoid compromising account security.
|
||||
|
||||
### Azure App Service and Azure Functions managed identity
|
||||
|
||||
| Error Message |Description| Mitigation |
|
||||
|---|---|---|
|
||||
|Get "`http://169.254.169.254/...`" i/o timeout|The App Service host hasn't set environment variables for managed identity configuration.|<ul><li>Ensure the App Service is configured for managed identity as described in [App Service documentation](https://docs.microsoft.com/azure/app-service/overview-managed-identity).</li><li>Verify the App Service environment is properly configured and the managed identity endpoint is available. See [below](#verify-the-app-service-managed-identity-endpoint-is-available) for instructions.</li></ul>|
|
||||
|
||||
#### Verify the App Service managed identity endpoint is available
|
||||
|
||||
If you can SSH into the App Service, you can verify managed identity is available in the environment. First ensure the environment variables `IDENTITY_ENDPOINT` and `IDENTITY_SECRET` are set. Then you can verify the managed identity endpoint is available using `curl`.
|
||||
|
||||
```sh
|
||||
curl "$IDENTITY_ENDPOINT?resource=https://management.core.windows.net&api-version=2019-08-01" -H "X-IDENTITY-HEADER: $IDENTITY_HEADER"
|
||||
```
|
||||
|
||||
> This command's output will contain an access token and SHOULD NOT BE SHARED, to avoid compromising account security.
|
||||
|
||||
### Azure Kubernetes Service managed identity
|
||||
|
||||
#### Pod Identity
|
||||
|
||||
| Error Message |Description| Mitigation |
|
||||
|---|---|---|
|
||||
|"no azure identity found for request clientID"|The application attempted to authenticate before an identity was assigned to its pod|Verify the pod is labeled correctly. This also occurs when a correctly labeled pod authenticates before the identity is ready. To prevent initialization races, configure NMI to set the Retry-After header in its responses as described in [Pod Identity documentation](https://azure.github.io/aad-pod-identity/docs/configure/feature_flags/#set-retry-after-header-in-nmi-response).
|
||||
|
||||
<a id="azure-cli"></a>
|
||||
## Troubleshoot AzureCliCredential authentication issues
|
||||
|
||||
| Error Message |Description| Mitigation |
|
||||
|---|---|---|
|
||||
|Azure CLI not found on path|The Azure CLI isn’t installed or isn't on the application's path.|<ul><li>Ensure the Azure CLI is installed as described in [Azure CLI documentation](https://docs.microsoft.com/cli/azure/install-azure-cli).</li><li>Validate the installation location is in the application's `PATH` environment variable.</li></ul>|
|
||||
|Please run 'az login' to set up account|No account is currently logged into the Azure CLI, or the login has expired.|<ul><li>Run `az login` to log into the Azure CLI. More information about Azure CLI authentication is available in the [Azure CLI documentation](https://docs.microsoft.com/cli/azure/authenticate-azure-cli).</li><li>Verify that the Azure CLI can obtain tokens. See [below](#verify-the-azure-cli-can-obtain-tokens) for instructions.</li></ul>|
|
||||
|
||||
#### Verify the Azure CLI can obtain tokens
|
||||
|
||||
You can manually verify that the Azure CLI can authenticate and obtain tokens. First, use the `account` command to verify the logged in account.
|
||||
|
||||
```azurecli
|
||||
az account show
|
||||
```
|
||||
|
||||
Once you've verified the Azure CLI is using the correct account, you can validate that it's able to obtain tokens for that account.
|
||||
|
||||
```azurecli
|
||||
az account get-access-token --output json --resource https://management.core.windows.net
|
||||
```
|
||||
|
||||
> This command's output will contain an access token and SHOULD NOT BE SHARED, to avoid compromising account security.
|
||||
|
||||
## Get additional help
|
||||
|
||||
Additional information on ways to reach out for support can be found in [SUPPORT.md](https://github.com/Azure/azure-sdk-for-go/blob/main/SUPPORT.md).
|
||||
165
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azidentity.go
generated
vendored
Normal file
165
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azidentity.go
generated
vendored
Normal file
@@ -0,0 +1,165 @@
|
||||
//go:build go1.18
|
||||
// +build go1.18
|
||||
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
package azidentity
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"errors"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"os"
|
||||
"regexp"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/cloud"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/streaming"
|
||||
"github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential"
|
||||
"github.com/AzureAD/microsoft-authentication-library-for-go/apps/public"
|
||||
)
|
||||
|
||||
const (
|
||||
azureAuthorityHost = "AZURE_AUTHORITY_HOST"
|
||||
azureClientCertificatePassword = "AZURE_CLIENT_CERTIFICATE_PASSWORD"
|
||||
azureClientCertificatePath = "AZURE_CLIENT_CERTIFICATE_PATH"
|
||||
azureClientID = "AZURE_CLIENT_ID"
|
||||
azureClientSecret = "AZURE_CLIENT_SECRET"
|
||||
azurePassword = "AZURE_PASSWORD"
|
||||
azureRegionalAuthorityName = "AZURE_REGIONAL_AUTHORITY_NAME"
|
||||
azureTenantID = "AZURE_TENANT_ID"
|
||||
azureUsername = "AZURE_USERNAME"
|
||||
|
||||
organizationsTenantID = "organizations"
|
||||
developerSignOnClientID = "04b07795-8ddb-461a-bbee-02f9e1bf7b46"
|
||||
defaultSuffix = "/.default"
|
||||
tenantIDValidationErr = "invalid tenantID. You can locate your tenantID by following the instructions listed here: https://docs.microsoft.com/partner-center/find-ids-and-domain-names"
|
||||
)
|
||||
|
||||
func getConfidentialClient(clientID, tenantID string, cred confidential.Credential, co *azcore.ClientOptions, additionalOpts ...confidential.Option) (confidential.Client, error) {
|
||||
if !validTenantID(tenantID) {
|
||||
return confidential.Client{}, errors.New(tenantIDValidationErr)
|
||||
}
|
||||
authorityHost, err := setAuthorityHost(co.Cloud)
|
||||
if err != nil {
|
||||
return confidential.Client{}, err
|
||||
}
|
||||
o := []confidential.Option{
|
||||
confidential.WithAuthority(runtime.JoinPaths(authorityHost, tenantID)),
|
||||
confidential.WithAzureRegion(os.Getenv(azureRegionalAuthorityName)),
|
||||
confidential.WithHTTPClient(newPipelineAdapter(co)),
|
||||
}
|
||||
o = append(o, additionalOpts...)
|
||||
return confidential.New(clientID, cred, o...)
|
||||
}
|
||||
|
||||
func getPublicClient(clientID, tenantID string, co *azcore.ClientOptions) (public.Client, error) {
|
||||
if !validTenantID(tenantID) {
|
||||
return public.Client{}, errors.New(tenantIDValidationErr)
|
||||
}
|
||||
authorityHost, err := setAuthorityHost(co.Cloud)
|
||||
if err != nil {
|
||||
return public.Client{}, err
|
||||
}
|
||||
return public.New(clientID,
|
||||
public.WithAuthority(runtime.JoinPaths(authorityHost, tenantID)),
|
||||
public.WithHTTPClient(newPipelineAdapter(co)),
|
||||
)
|
||||
}
|
||||
|
||||
// setAuthorityHost initializes the authority host for credentials. Precedence is:
|
||||
// 1. cloud.Configuration.ActiveDirectoryAuthorityHost value set by user
|
||||
// 2. value of AZURE_AUTHORITY_HOST
|
||||
// 3. default: Azure Public Cloud
|
||||
func setAuthorityHost(cc cloud.Configuration) (string, error) {
|
||||
host := cc.ActiveDirectoryAuthorityHost
|
||||
if host == "" {
|
||||
if len(cc.Services) > 0 {
|
||||
return "", errors.New("missing ActiveDirectoryAuthorityHost for specified cloud")
|
||||
}
|
||||
host = cloud.AzurePublic.ActiveDirectoryAuthorityHost
|
||||
if envAuthorityHost := os.Getenv(azureAuthorityHost); envAuthorityHost != "" {
|
||||
host = envAuthorityHost
|
||||
}
|
||||
}
|
||||
u, err := url.Parse(host)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if u.Scheme != "https" {
|
||||
return "", errors.New("cannot use an authority host without https")
|
||||
}
|
||||
return host, nil
|
||||
}
|
||||
|
||||
// validTenantID return true is it receives a valid tenantID, returns false otherwise
|
||||
func validTenantID(tenantID string) bool {
|
||||
match, err := regexp.MatchString("^[0-9a-zA-Z-.]+$", tenantID)
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
return match
|
||||
}
|
||||
|
||||
func newPipelineAdapter(opts *azcore.ClientOptions) pipelineAdapter {
|
||||
pl := runtime.NewPipeline(component, version, runtime.PipelineOptions{}, opts)
|
||||
return pipelineAdapter{pl: pl}
|
||||
}
|
||||
|
||||
type pipelineAdapter struct {
|
||||
pl runtime.Pipeline
|
||||
}
|
||||
|
||||
func (p pipelineAdapter) CloseIdleConnections() {
|
||||
// do nothing
|
||||
}
|
||||
|
||||
func (p pipelineAdapter) Do(r *http.Request) (*http.Response, error) {
|
||||
req, err := runtime.NewRequest(r.Context(), r.Method, r.URL.String())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if r.Body != nil && r.Body != http.NoBody {
|
||||
// create a rewindable body from the existing body as required
|
||||
var body io.ReadSeekCloser
|
||||
if rsc, ok := r.Body.(io.ReadSeekCloser); ok {
|
||||
body = rsc
|
||||
} else {
|
||||
b, err := io.ReadAll(r.Body)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
body = streaming.NopCloser(bytes.NewReader(b))
|
||||
}
|
||||
err = req.SetBody(body, r.Header.Get("Content-Type"))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
resp, err := p.pl.Do(req)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return resp, err
|
||||
}
|
||||
|
||||
// enables fakes for test scenarios
|
||||
type confidentialClient interface {
|
||||
AcquireTokenSilent(ctx context.Context, scopes []string, options ...confidential.AcquireSilentOption) (confidential.AuthResult, error)
|
||||
AcquireTokenByAuthCode(ctx context.Context, code string, redirectURI string, scopes []string, options ...confidential.AcquireByAuthCodeOption) (confidential.AuthResult, error)
|
||||
AcquireTokenByCredential(ctx context.Context, scopes []string, options ...confidential.AcquireByCredentialOption) (confidential.AuthResult, error)
|
||||
}
|
||||
|
||||
// enables fakes for test scenarios
|
||||
type publicClient interface {
|
||||
AcquireTokenSilent(ctx context.Context, scopes []string, options ...public.AcquireSilentOption) (public.AuthResult, error)
|
||||
AcquireTokenByUsernamePassword(ctx context.Context, scopes []string, username string, password string, options ...public.AcquireByUsernamePasswordOption) (public.AuthResult, error)
|
||||
AcquireTokenByDeviceCode(ctx context.Context, scopes []string, options ...public.AcquireByDeviceCodeOption) (public.DeviceCode, error)
|
||||
AcquireTokenByAuthCode(ctx context.Context, code string, redirectURI string, scopes []string, options ...public.AcquireByAuthCodeOption) (public.AuthResult, error)
|
||||
AcquireTokenInteractive(ctx context.Context, scopes []string, options ...public.AcquireInteractiveOption) (public.AuthResult, error)
|
||||
}
|
||||
189
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azure_cli_credential.go
generated
vendored
Normal file
189
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/azure_cli_credential.go
generated
vendored
Normal file
@@ -0,0 +1,189 @@
|
||||
//go:build go1.18
|
||||
// +build go1.18
|
||||
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
package azidentity
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
"regexp"
|
||||
"runtime"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
|
||||
)
|
||||
|
||||
const credNameAzureCLI = "AzureCLICredential"
|
||||
|
||||
// used by tests to fake invoking the CLI
|
||||
type azureCLITokenProvider func(ctx context.Context, resource string, tenantID string) ([]byte, error)
|
||||
|
||||
// AzureCLICredentialOptions contains optional parameters for AzureCLICredential.
|
||||
type AzureCLICredentialOptions struct {
|
||||
// TenantID identifies the tenant the credential should authenticate in.
|
||||
// Defaults to the CLI's default tenant, which is typically the home tenant of the logged in user.
|
||||
TenantID string
|
||||
|
||||
tokenProvider azureCLITokenProvider
|
||||
}
|
||||
|
||||
// init returns an instance of AzureCLICredentialOptions initialized with default values.
|
||||
func (o *AzureCLICredentialOptions) init() {
|
||||
if o.tokenProvider == nil {
|
||||
o.tokenProvider = defaultTokenProvider()
|
||||
}
|
||||
}
|
||||
|
||||
// AzureCLICredential authenticates as the identity logged in to the Azure CLI.
|
||||
type AzureCLICredential struct {
|
||||
tokenProvider azureCLITokenProvider
|
||||
tenantID string
|
||||
}
|
||||
|
||||
// NewAzureCLICredential constructs an AzureCLICredential. Pass nil to accept default options.
|
||||
func NewAzureCLICredential(options *AzureCLICredentialOptions) (*AzureCLICredential, error) {
|
||||
cp := AzureCLICredentialOptions{}
|
||||
if options != nil {
|
||||
cp = *options
|
||||
}
|
||||
cp.init()
|
||||
return &AzureCLICredential{
|
||||
tokenProvider: cp.tokenProvider,
|
||||
tenantID: cp.TenantID,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// GetToken requests a token from the Azure CLI. This credential doesn't cache tokens, so every call invokes the CLI.
|
||||
// This method is called automatically by Azure SDK clients.
|
||||
func (c *AzureCLICredential) GetToken(ctx context.Context, opts policy.TokenRequestOptions) (azcore.AccessToken, error) {
|
||||
if len(opts.Scopes) != 1 {
|
||||
return azcore.AccessToken{}, errors.New(credNameAzureCLI + ": GetToken() requires exactly one scope")
|
||||
}
|
||||
// CLI expects an AAD v1 resource, not a v2 scope
|
||||
scope := strings.TrimSuffix(opts.Scopes[0], defaultSuffix)
|
||||
at, err := c.authenticate(ctx, scope)
|
||||
if err != nil {
|
||||
return azcore.AccessToken{}, err
|
||||
}
|
||||
logGetTokenSuccess(c, opts)
|
||||
return at, nil
|
||||
}
|
||||
|
||||
const timeoutCLIRequest = 10 * time.Second
|
||||
|
||||
func (c *AzureCLICredential) authenticate(ctx context.Context, resource string) (azcore.AccessToken, error) {
|
||||
output, err := c.tokenProvider(ctx, resource, c.tenantID)
|
||||
if err != nil {
|
||||
return azcore.AccessToken{}, err
|
||||
}
|
||||
|
||||
return c.createAccessToken(output)
|
||||
}
|
||||
|
||||
func defaultTokenProvider() func(ctx context.Context, resource string, tenantID string) ([]byte, error) {
|
||||
return func(ctx context.Context, resource string, tenantID string) ([]byte, error) {
|
||||
match, err := regexp.MatchString("^[0-9a-zA-Z-.:/]+$", resource)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if !match {
|
||||
return nil, fmt.Errorf(`%s: unexpected scope "%s". Only alphanumeric characters and ".", ";", "-", and "/" are allowed`, credNameAzureCLI, resource)
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithTimeout(ctx, timeoutCLIRequest)
|
||||
defer cancel()
|
||||
|
||||
commandLine := "az account get-access-token -o json --resource " + resource
|
||||
if tenantID != "" {
|
||||
commandLine += " --tenant " + tenantID
|
||||
}
|
||||
var cliCmd *exec.Cmd
|
||||
if runtime.GOOS == "windows" {
|
||||
dir := os.Getenv("SYSTEMROOT")
|
||||
if dir == "" {
|
||||
return nil, newCredentialUnavailableError(credNameAzureCLI, "environment variable 'SYSTEMROOT' has no value")
|
||||
}
|
||||
cliCmd = exec.CommandContext(ctx, "cmd.exe", "/c", commandLine)
|
||||
cliCmd.Dir = dir
|
||||
} else {
|
||||
cliCmd = exec.CommandContext(ctx, "/bin/sh", "-c", commandLine)
|
||||
cliCmd.Dir = "/bin"
|
||||
}
|
||||
cliCmd.Env = os.Environ()
|
||||
var stderr bytes.Buffer
|
||||
cliCmd.Stderr = &stderr
|
||||
|
||||
output, err := cliCmd.Output()
|
||||
if err != nil {
|
||||
msg := stderr.String()
|
||||
var exErr *exec.ExitError
|
||||
if errors.As(err, &exErr) && exErr.ExitCode() == 127 || strings.HasPrefix(msg, "'az' is not recognized") {
|
||||
msg = "Azure CLI not found on path"
|
||||
}
|
||||
if msg == "" {
|
||||
msg = err.Error()
|
||||
}
|
||||
return nil, newCredentialUnavailableError(credNameAzureCLI, msg)
|
||||
}
|
||||
|
||||
return output, nil
|
||||
}
|
||||
}
|
||||
|
||||
func (c *AzureCLICredential) createAccessToken(tk []byte) (azcore.AccessToken, error) {
|
||||
t := struct {
|
||||
AccessToken string `json:"accessToken"`
|
||||
Authority string `json:"_authority"`
|
||||
ClientID string `json:"_clientId"`
|
||||
ExpiresOn string `json:"expiresOn"`
|
||||
IdentityProvider string `json:"identityProvider"`
|
||||
IsMRRT bool `json:"isMRRT"`
|
||||
RefreshToken string `json:"refreshToken"`
|
||||
Resource string `json:"resource"`
|
||||
TokenType string `json:"tokenType"`
|
||||
UserID string `json:"userId"`
|
||||
}{}
|
||||
err := json.Unmarshal(tk, &t)
|
||||
if err != nil {
|
||||
return azcore.AccessToken{}, err
|
||||
}
|
||||
|
||||
tokenExpirationDate, err := parseExpirationDate(t.ExpiresOn)
|
||||
if err != nil {
|
||||
return azcore.AccessToken{}, fmt.Errorf("Error parsing Token Expiration Date %q: %+v", t.ExpiresOn, err)
|
||||
}
|
||||
|
||||
converted := azcore.AccessToken{
|
||||
Token: t.AccessToken,
|
||||
ExpiresOn: *tokenExpirationDate,
|
||||
}
|
||||
return converted, nil
|
||||
}
|
||||
|
||||
// parseExpirationDate parses either a Azure CLI or CloudShell date into a time object
|
||||
func parseExpirationDate(input string) (*time.Time, error) {
|
||||
// CloudShell (and potentially the Azure CLI in future)
|
||||
expirationDate, cloudShellErr := time.Parse(time.RFC3339, input)
|
||||
if cloudShellErr != nil {
|
||||
// Azure CLI (Python) e.g. 2017-08-31 19:48:57.998857 (plus the local timezone)
|
||||
const cliFormat = "2006-01-02 15:04:05.999999"
|
||||
expirationDate, cliErr := time.ParseInLocation(cliFormat, input, time.Local)
|
||||
if cliErr != nil {
|
||||
return nil, fmt.Errorf("Error parsing expiration date %q.\n\nCloudShell Error: \n%+v\n\nCLI Error:\n%+v", input, cloudShellErr, cliErr)
|
||||
}
|
||||
return &expirationDate, nil
|
||||
}
|
||||
return &expirationDate, nil
|
||||
}
|
||||
|
||||
var _ azcore.TokenCredential = (*AzureCLICredential)(nil)
|
||||
133
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/chained_token_credential.go
generated
vendored
Normal file
133
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/chained_token_credential.go
generated
vendored
Normal file
@@ -0,0 +1,133 @@
|
||||
//go:build go1.18
|
||||
// +build go1.18
|
||||
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
package azidentity
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"strings"
|
||||
"sync"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/internal/log"
|
||||
)
|
||||
|
||||
// ChainedTokenCredentialOptions contains optional parameters for ChainedTokenCredential.
|
||||
type ChainedTokenCredentialOptions struct {
|
||||
// RetrySources configures how the credential uses its sources. When true, the credential always attempts to
|
||||
// authenticate through each source in turn, stopping when one succeeds. When false, the credential authenticates
|
||||
// only through this first successful source--it never again tries the sources which failed.
|
||||
RetrySources bool
|
||||
}
|
||||
|
||||
// ChainedTokenCredential links together multiple credentials and tries them sequentially when authenticating. By default,
|
||||
// it tries all the credentials until one authenticates, after which it always uses that credential.
|
||||
type ChainedTokenCredential struct {
|
||||
cond *sync.Cond
|
||||
iterating bool
|
||||
name string
|
||||
retrySources bool
|
||||
sources []azcore.TokenCredential
|
||||
successfulCredential azcore.TokenCredential
|
||||
}
|
||||
|
||||
// NewChainedTokenCredential creates a ChainedTokenCredential. Pass nil for options to accept defaults.
|
||||
func NewChainedTokenCredential(sources []azcore.TokenCredential, options *ChainedTokenCredentialOptions) (*ChainedTokenCredential, error) {
|
||||
if len(sources) == 0 {
|
||||
return nil, errors.New("sources must contain at least one TokenCredential")
|
||||
}
|
||||
for _, source := range sources {
|
||||
if source == nil { // cannot have a nil credential in the chain or else the application will panic when GetToken() is called on nil
|
||||
return nil, errors.New("sources cannot contain nil")
|
||||
}
|
||||
}
|
||||
cp := make([]azcore.TokenCredential, len(sources))
|
||||
copy(cp, sources)
|
||||
if options == nil {
|
||||
options = &ChainedTokenCredentialOptions{}
|
||||
}
|
||||
return &ChainedTokenCredential{
|
||||
cond: sync.NewCond(&sync.Mutex{}),
|
||||
name: "ChainedTokenCredential",
|
||||
retrySources: options.RetrySources,
|
||||
sources: cp,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// GetToken calls GetToken on the chained credentials in turn, stopping when one returns a token.
|
||||
// This method is called automatically by Azure SDK clients.
|
||||
func (c *ChainedTokenCredential) GetToken(ctx context.Context, opts policy.TokenRequestOptions) (azcore.AccessToken, error) {
|
||||
if !c.retrySources {
|
||||
// ensure only one goroutine at a time iterates the sources and perhaps sets c.successfulCredential
|
||||
c.cond.L.Lock()
|
||||
for {
|
||||
if c.successfulCredential != nil {
|
||||
c.cond.L.Unlock()
|
||||
return c.successfulCredential.GetToken(ctx, opts)
|
||||
}
|
||||
if !c.iterating {
|
||||
c.iterating = true
|
||||
// allow other goroutines to wait while this one iterates
|
||||
c.cond.L.Unlock()
|
||||
break
|
||||
}
|
||||
c.cond.Wait()
|
||||
}
|
||||
}
|
||||
|
||||
var err error
|
||||
var errs []error
|
||||
var token azcore.AccessToken
|
||||
var successfulCredential azcore.TokenCredential
|
||||
for _, cred := range c.sources {
|
||||
token, err = cred.GetToken(ctx, opts)
|
||||
if err == nil {
|
||||
log.Writef(EventAuthentication, "%s authenticated with %s", c.name, extractCredentialName(cred))
|
||||
successfulCredential = cred
|
||||
break
|
||||
}
|
||||
errs = append(errs, err)
|
||||
if _, ok := err.(*credentialUnavailableError); !ok {
|
||||
break
|
||||
}
|
||||
}
|
||||
if c.iterating {
|
||||
c.cond.L.Lock()
|
||||
c.successfulCredential = successfulCredential
|
||||
c.iterating = false
|
||||
c.cond.L.Unlock()
|
||||
c.cond.Broadcast()
|
||||
}
|
||||
// err is the error returned by the last GetToken call. It will be nil when that call succeeds
|
||||
if err != nil {
|
||||
// return credentialUnavailableError iff all sources did so; return AuthenticationFailedError otherwise
|
||||
msg := createChainedErrorMessage(errs)
|
||||
if _, ok := err.(*credentialUnavailableError); ok {
|
||||
err = newCredentialUnavailableError(c.name, msg)
|
||||
} else {
|
||||
res := getResponseFromError(err)
|
||||
err = newAuthenticationFailedError(c.name, msg, res)
|
||||
}
|
||||
}
|
||||
return token, err
|
||||
}
|
||||
|
||||
func createChainedErrorMessage(errs []error) string {
|
||||
msg := "failed to acquire a token.\nAttempted credentials:"
|
||||
for _, err := range errs {
|
||||
msg += fmt.Sprintf("\n\t%s", err.Error())
|
||||
}
|
||||
return msg
|
||||
}
|
||||
|
||||
func extractCredentialName(credential azcore.TokenCredential) string {
|
||||
return strings.TrimPrefix(fmt.Sprintf("%T", credential), "*azidentity.")
|
||||
}
|
||||
|
||||
var _ azcore.TokenCredential = (*ChainedTokenCredential)(nil)
|
||||
47
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/ci.yml
generated
vendored
Normal file
47
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/ci.yml
generated
vendored
Normal file
@@ -0,0 +1,47 @@
|
||||
# NOTE: Please refer to https://aka.ms/azsdk/engsys/ci-yaml before editing this file.
|
||||
trigger:
|
||||
branches:
|
||||
include:
|
||||
- main
|
||||
- feature/*
|
||||
- hotfix/*
|
||||
- release/*
|
||||
paths:
|
||||
include:
|
||||
- sdk/azidentity/
|
||||
|
||||
pr:
|
||||
branches:
|
||||
include:
|
||||
- main
|
||||
- feature/*
|
||||
- hotfix/*
|
||||
- release/*
|
||||
paths:
|
||||
include:
|
||||
- sdk/azidentity/
|
||||
|
||||
stages:
|
||||
- template: /eng/pipelines/templates/jobs/archetype-sdk-client.yml
|
||||
parameters:
|
||||
RunLiveTests: true
|
||||
ServiceDirectory: 'azidentity'
|
||||
PreSteps:
|
||||
- pwsh: |
|
||||
[System.Convert]::FromBase64String($env:PFX_CONTENTS) | Set-Content -Path $(Agent.TempDirectory)/test.pfx -AsByteStream
|
||||
Set-Content -Path $(Agent.TempDirectory)/test.pem -Value $env:PEM_CONTENTS
|
||||
[System.Convert]::FromBase64String($env:SNI_CONTENTS) | Set-Content -Path $(Agent.TempDirectory)/testsni.pfx -AsByteStream
|
||||
env:
|
||||
PFX_CONTENTS: $(net-identity-spcert-pfx)
|
||||
PEM_CONTENTS: $(net-identity-spcert-pem)
|
||||
SNI_CONTENTS: $(net-identity-spcert-sni)
|
||||
EnvVars:
|
||||
AZURE_IDENTITY_TEST_TENANTID: $(net-identity-tenantid)
|
||||
AZURE_IDENTITY_TEST_USERNAME: $(net-identity-username)
|
||||
AZURE_IDENTITY_TEST_PASSWORD: $(net-identity-password)
|
||||
IDENTITY_SP_TENANT_ID: $(net-identity-sp-tenantid)
|
||||
IDENTITY_SP_CLIENT_ID: $(net-identity-sp-clientid)
|
||||
IDENTITY_SP_CLIENT_SECRET: $(net-identity-sp-clientsecret)
|
||||
IDENTITY_SP_CERT_PEM: $(Agent.TempDirectory)/test.pem
|
||||
IDENTITY_SP_CERT_PFX: $(Agent.TempDirectory)/test.pfx
|
||||
IDENTITY_SP_CERT_SNI: $(Agent.TempDirectory)/testsni.pfx
|
||||
74
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_assertion_credential.go
generated
vendored
Normal file
74
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_assertion_credential.go
generated
vendored
Normal file
@@ -0,0 +1,74 @@
|
||||
//go:build go1.18
|
||||
// +build go1.18
|
||||
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
package azidentity
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
|
||||
"github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential"
|
||||
)
|
||||
|
||||
const credNameAssertion = "ClientAssertionCredential"
|
||||
|
||||
// ClientAssertionCredential authenticates an application with assertions provided by a callback function.
|
||||
// This credential is for advanced scenarios. ClientCertificateCredential has a more convenient API for
|
||||
// the most common assertion scenario, authenticating a service principal with a certificate. See
|
||||
// [Azure AD documentation] for details of the assertion format.
|
||||
//
|
||||
// [Azure AD documentation]: https://docs.microsoft.com/azure/active-directory/develop/active-directory-certificate-credentials#assertion-format
|
||||
type ClientAssertionCredential struct {
|
||||
client confidentialClient
|
||||
}
|
||||
|
||||
// ClientAssertionCredentialOptions contains optional parameters for ClientAssertionCredential.
|
||||
type ClientAssertionCredentialOptions struct {
|
||||
azcore.ClientOptions
|
||||
}
|
||||
|
||||
// NewClientAssertionCredential constructs a ClientAssertionCredential. The getAssertion function must be thread safe. Pass nil for options to accept defaults.
|
||||
func NewClientAssertionCredential(tenantID, clientID string, getAssertion func(context.Context) (string, error), options *ClientAssertionCredentialOptions) (*ClientAssertionCredential, error) {
|
||||
if getAssertion == nil {
|
||||
return nil, errors.New("getAssertion must be a function that returns assertions")
|
||||
}
|
||||
if options == nil {
|
||||
options = &ClientAssertionCredentialOptions{}
|
||||
}
|
||||
cred := confidential.NewCredFromAssertionCallback(
|
||||
func(ctx context.Context, _ confidential.AssertionRequestOptions) (string, error) {
|
||||
return getAssertion(ctx)
|
||||
},
|
||||
)
|
||||
c, err := getConfidentialClient(clientID, tenantID, cred, &options.ClientOptions)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &ClientAssertionCredential{client: c}, nil
|
||||
}
|
||||
|
||||
// GetToken requests an access token from Azure Active Directory. This method is called automatically by Azure SDK clients.
|
||||
func (c *ClientAssertionCredential) GetToken(ctx context.Context, opts policy.TokenRequestOptions) (azcore.AccessToken, error) {
|
||||
if len(opts.Scopes) == 0 {
|
||||
return azcore.AccessToken{}, errors.New(credNameAssertion + ": GetToken() requires at least one scope")
|
||||
}
|
||||
ar, err := c.client.AcquireTokenSilent(ctx, opts.Scopes)
|
||||
if err == nil {
|
||||
logGetTokenSuccess(c, opts)
|
||||
return azcore.AccessToken{Token: ar.AccessToken, ExpiresOn: ar.ExpiresOn.UTC()}, err
|
||||
}
|
||||
|
||||
ar, err = c.client.AcquireTokenByCredential(ctx, opts.Scopes)
|
||||
if err != nil {
|
||||
return azcore.AccessToken{}, newAuthenticationFailedErrorFromMSALError(credNameAssertion, err)
|
||||
}
|
||||
logGetTokenSuccess(c, opts)
|
||||
return azcore.AccessToken{Token: ar.AccessToken, ExpiresOn: ar.ExpiresOn.UTC()}, err
|
||||
}
|
||||
|
||||
var _ azcore.TokenCredential = (*ClientAssertionCredential)(nil)
|
||||
163
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_certificate_credential.go
generated
vendored
Normal file
163
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_certificate_credential.go
generated
vendored
Normal file
@@ -0,0 +1,163 @@
|
||||
//go:build go1.18
|
||||
// +build go1.18
|
||||
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
package azidentity
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto"
|
||||
"crypto/x509"
|
||||
"encoding/pem"
|
||||
"errors"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
|
||||
"github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential"
|
||||
"golang.org/x/crypto/pkcs12"
|
||||
)
|
||||
|
||||
const credNameCert = "ClientCertificateCredential"
|
||||
|
||||
// ClientCertificateCredentialOptions contains optional parameters for ClientCertificateCredential.
|
||||
type ClientCertificateCredentialOptions struct {
|
||||
azcore.ClientOptions
|
||||
|
||||
// SendCertificateChain controls whether the credential sends the public certificate chain in the x5c
|
||||
// header of each token request's JWT. This is required for Subject Name/Issuer (SNI) authentication.
|
||||
// Defaults to False.
|
||||
SendCertificateChain bool
|
||||
}
|
||||
|
||||
// ClientCertificateCredential authenticates a service principal with a certificate.
|
||||
type ClientCertificateCredential struct {
|
||||
client confidentialClient
|
||||
}
|
||||
|
||||
// NewClientCertificateCredential constructs a ClientCertificateCredential. Pass nil for options to accept defaults.
|
||||
func NewClientCertificateCredential(tenantID string, clientID string, certs []*x509.Certificate, key crypto.PrivateKey, options *ClientCertificateCredentialOptions) (*ClientCertificateCredential, error) {
|
||||
if len(certs) == 0 {
|
||||
return nil, errors.New("at least one certificate is required")
|
||||
}
|
||||
if options == nil {
|
||||
options = &ClientCertificateCredentialOptions{}
|
||||
}
|
||||
cred, err := confidential.NewCredFromCertChain(certs, key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
var o []confidential.Option
|
||||
if options.SendCertificateChain {
|
||||
o = append(o, confidential.WithX5C())
|
||||
}
|
||||
c, err := getConfidentialClient(clientID, tenantID, cred, &options.ClientOptions, o...)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &ClientCertificateCredential{client: c}, nil
|
||||
}
|
||||
|
||||
// GetToken requests an access token from Azure Active Directory. This method is called automatically by Azure SDK clients.
|
||||
func (c *ClientCertificateCredential) GetToken(ctx context.Context, opts policy.TokenRequestOptions) (azcore.AccessToken, error) {
|
||||
if len(opts.Scopes) == 0 {
|
||||
return azcore.AccessToken{}, errors.New(credNameCert + ": GetToken() requires at least one scope")
|
||||
}
|
||||
ar, err := c.client.AcquireTokenSilent(ctx, opts.Scopes)
|
||||
if err == nil {
|
||||
logGetTokenSuccess(c, opts)
|
||||
return azcore.AccessToken{Token: ar.AccessToken, ExpiresOn: ar.ExpiresOn.UTC()}, err
|
||||
}
|
||||
|
||||
ar, err = c.client.AcquireTokenByCredential(ctx, opts.Scopes)
|
||||
if err != nil {
|
||||
return azcore.AccessToken{}, newAuthenticationFailedErrorFromMSALError(credNameCert, err)
|
||||
}
|
||||
logGetTokenSuccess(c, opts)
|
||||
return azcore.AccessToken{Token: ar.AccessToken, ExpiresOn: ar.ExpiresOn.UTC()}, err
|
||||
}
|
||||
|
||||
// ParseCertificates loads certificates and a private key, in PEM or PKCS12 format, for use with NewClientCertificateCredential.
|
||||
// Pass nil for password if the private key isn't encrypted. This function can't decrypt keys in PEM format.
|
||||
func ParseCertificates(certData []byte, password []byte) ([]*x509.Certificate, crypto.PrivateKey, error) {
|
||||
var blocks []*pem.Block
|
||||
var err error
|
||||
if len(password) == 0 {
|
||||
blocks, err = loadPEMCert(certData)
|
||||
}
|
||||
if len(blocks) == 0 || err != nil {
|
||||
blocks, err = loadPKCS12Cert(certData, string(password))
|
||||
}
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
var certs []*x509.Certificate
|
||||
var pk crypto.PrivateKey
|
||||
for _, block := range blocks {
|
||||
switch block.Type {
|
||||
case "CERTIFICATE":
|
||||
c, err := x509.ParseCertificate(block.Bytes)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
certs = append(certs, c)
|
||||
case "PRIVATE KEY":
|
||||
if pk != nil {
|
||||
return nil, nil, errors.New("certData contains multiple private keys")
|
||||
}
|
||||
pk, err = x509.ParsePKCS8PrivateKey(block.Bytes)
|
||||
if err != nil {
|
||||
pk, err = x509.ParsePKCS1PrivateKey(block.Bytes)
|
||||
}
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
case "RSA PRIVATE KEY":
|
||||
if pk != nil {
|
||||
return nil, nil, errors.New("certData contains multiple private keys")
|
||||
}
|
||||
pk, err = x509.ParsePKCS1PrivateKey(block.Bytes)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
}
|
||||
}
|
||||
if len(certs) == 0 {
|
||||
return nil, nil, errors.New("found no certificate")
|
||||
}
|
||||
if pk == nil {
|
||||
return nil, nil, errors.New("found no private key")
|
||||
}
|
||||
return certs, pk, nil
|
||||
}
|
||||
|
||||
func loadPEMCert(certData []byte) ([]*pem.Block, error) {
|
||||
blocks := []*pem.Block{}
|
||||
for {
|
||||
var block *pem.Block
|
||||
block, certData = pem.Decode(certData)
|
||||
if block == nil {
|
||||
break
|
||||
}
|
||||
blocks = append(blocks, block)
|
||||
}
|
||||
if len(blocks) == 0 {
|
||||
return nil, errors.New("didn't find any PEM blocks")
|
||||
}
|
||||
return blocks, nil
|
||||
}
|
||||
|
||||
func loadPKCS12Cert(certData []byte, password string) ([]*pem.Block, error) {
|
||||
blocks, err := pkcs12.ToPEM(certData, password)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if len(blocks) == 0 {
|
||||
// not mentioning PKCS12 in this message because we end up here when certData is garbage
|
||||
return nil, errors.New("didn't find any certificate content")
|
||||
}
|
||||
return blocks, err
|
||||
}
|
||||
|
||||
var _ azcore.TokenCredential = (*ClientCertificateCredential)(nil)
|
||||
65
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_secret_credential.go
generated
vendored
Normal file
65
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/client_secret_credential.go
generated
vendored
Normal file
@@ -0,0 +1,65 @@
|
||||
//go:build go1.18
|
||||
// +build go1.18
|
||||
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
package azidentity
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
|
||||
"github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential"
|
||||
)
|
||||
|
||||
const credNameSecret = "ClientSecretCredential"
|
||||
|
||||
// ClientSecretCredentialOptions contains optional parameters for ClientSecretCredential.
|
||||
type ClientSecretCredentialOptions struct {
|
||||
azcore.ClientOptions
|
||||
}
|
||||
|
||||
// ClientSecretCredential authenticates an application with a client secret.
|
||||
type ClientSecretCredential struct {
|
||||
client confidentialClient
|
||||
}
|
||||
|
||||
// NewClientSecretCredential constructs a ClientSecretCredential. Pass nil for options to accept defaults.
|
||||
func NewClientSecretCredential(tenantID string, clientID string, clientSecret string, options *ClientSecretCredentialOptions) (*ClientSecretCredential, error) {
|
||||
if options == nil {
|
||||
options = &ClientSecretCredentialOptions{}
|
||||
}
|
||||
cred, err := confidential.NewCredFromSecret(clientSecret)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
c, err := getConfidentialClient(clientID, tenantID, cred, &options.ClientOptions)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &ClientSecretCredential{client: c}, nil
|
||||
}
|
||||
|
||||
// GetToken requests an access token from Azure Active Directory. This method is called automatically by Azure SDK clients.
|
||||
func (c *ClientSecretCredential) GetToken(ctx context.Context, opts policy.TokenRequestOptions) (azcore.AccessToken, error) {
|
||||
if len(opts.Scopes) == 0 {
|
||||
return azcore.AccessToken{}, errors.New(credNameSecret + ": GetToken() requires at least one scope")
|
||||
}
|
||||
ar, err := c.client.AcquireTokenSilent(ctx, opts.Scopes)
|
||||
if err == nil {
|
||||
logGetTokenSuccess(c, opts)
|
||||
return azcore.AccessToken{Token: ar.AccessToken, ExpiresOn: ar.ExpiresOn.UTC()}, err
|
||||
}
|
||||
|
||||
ar, err = c.client.AcquireTokenByCredential(ctx, opts.Scopes)
|
||||
if err != nil {
|
||||
return azcore.AccessToken{}, newAuthenticationFailedErrorFromMSALError(credNameSecret, err)
|
||||
}
|
||||
logGetTokenSuccess(c, opts)
|
||||
return azcore.AccessToken{Token: ar.AccessToken, ExpiresOn: ar.ExpiresOn.UTC()}, err
|
||||
}
|
||||
|
||||
var _ azcore.TokenCredential = (*ClientSecretCredential)(nil)
|
||||
134
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/default_azure_credential.go
generated
vendored
Normal file
134
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/default_azure_credential.go
generated
vendored
Normal file
@@ -0,0 +1,134 @@
|
||||
//go:build go1.18
|
||||
// +build go1.18
|
||||
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
package azidentity
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"os"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/internal/log"
|
||||
)
|
||||
|
||||
// DefaultAzureCredentialOptions contains optional parameters for DefaultAzureCredential.
|
||||
// These options may not apply to all credentials in the chain.
|
||||
type DefaultAzureCredentialOptions struct {
|
||||
azcore.ClientOptions
|
||||
|
||||
// TenantID identifies the tenant the Azure CLI should authenticate in.
|
||||
// Defaults to the CLI's default tenant, which is typically the home tenant of the user logged in to the CLI.
|
||||
TenantID string
|
||||
}
|
||||
|
||||
// DefaultAzureCredential is a default credential chain for applications that will deploy to Azure.
|
||||
// It combines credentials suitable for deployment with credentials suitable for local development.
|
||||
// It attempts to authenticate with each of these credential types, in the following order, stopping when one provides a token:
|
||||
//
|
||||
// EnvironmentCredential
|
||||
// ManagedIdentityCredential
|
||||
// AzureCLICredential
|
||||
//
|
||||
// Consult the documentation for these credential types for more information on how they authenticate.
|
||||
// Once a credential has successfully authenticated, DefaultAzureCredential will use that credential for
|
||||
// every subsequent authentication.
|
||||
type DefaultAzureCredential struct {
|
||||
chain *ChainedTokenCredential
|
||||
}
|
||||
|
||||
// NewDefaultAzureCredential creates a DefaultAzureCredential. Pass nil for options to accept defaults.
|
||||
func NewDefaultAzureCredential(options *DefaultAzureCredentialOptions) (*DefaultAzureCredential, error) {
|
||||
var creds []azcore.TokenCredential
|
||||
var errorMessages []string
|
||||
|
||||
if options == nil {
|
||||
options = &DefaultAzureCredentialOptions{}
|
||||
}
|
||||
|
||||
envCred, err := NewEnvironmentCredential(&EnvironmentCredentialOptions{ClientOptions: options.ClientOptions})
|
||||
if err == nil {
|
||||
creds = append(creds, envCred)
|
||||
} else {
|
||||
errorMessages = append(errorMessages, "EnvironmentCredential: "+err.Error())
|
||||
creds = append(creds, &defaultCredentialErrorReporter{credType: "EnvironmentCredential", err: err})
|
||||
}
|
||||
|
||||
o := &ManagedIdentityCredentialOptions{ClientOptions: options.ClientOptions}
|
||||
if ID, ok := os.LookupEnv(azureClientID); ok {
|
||||
o.ID = ClientID(ID)
|
||||
}
|
||||
msiCred, err := NewManagedIdentityCredential(o)
|
||||
if err == nil {
|
||||
creds = append(creds, msiCred)
|
||||
msiCred.mic.imdsTimeout = time.Second
|
||||
} else {
|
||||
errorMessages = append(errorMessages, credNameManagedIdentity+": "+err.Error())
|
||||
creds = append(creds, &defaultCredentialErrorReporter{credType: credNameManagedIdentity, err: err})
|
||||
}
|
||||
|
||||
cliCred, err := NewAzureCLICredential(&AzureCLICredentialOptions{TenantID: options.TenantID})
|
||||
if err == nil {
|
||||
creds = append(creds, cliCred)
|
||||
} else {
|
||||
errorMessages = append(errorMessages, credNameAzureCLI+": "+err.Error())
|
||||
creds = append(creds, &defaultCredentialErrorReporter{credType: credNameAzureCLI, err: err})
|
||||
}
|
||||
|
||||
err = defaultAzureCredentialConstructorErrorHandler(len(creds), errorMessages)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
chain, err := NewChainedTokenCredential(creds, nil)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
chain.name = "DefaultAzureCredential"
|
||||
return &DefaultAzureCredential{chain: chain}, nil
|
||||
}
|
||||
|
||||
// GetToken requests an access token from Azure Active Directory. This method is called automatically by Azure SDK clients.
|
||||
func (c *DefaultAzureCredential) GetToken(ctx context.Context, opts policy.TokenRequestOptions) (azcore.AccessToken, error) {
|
||||
return c.chain.GetToken(ctx, opts)
|
||||
}
|
||||
|
||||
var _ azcore.TokenCredential = (*DefaultAzureCredential)(nil)
|
||||
|
||||
func defaultAzureCredentialConstructorErrorHandler(numberOfSuccessfulCredentials int, errorMessages []string) (err error) {
|
||||
errorMessage := strings.Join(errorMessages, "\n\t")
|
||||
|
||||
if numberOfSuccessfulCredentials == 0 {
|
||||
return errors.New(errorMessage)
|
||||
}
|
||||
|
||||
if len(errorMessages) != 0 {
|
||||
log.Writef(EventAuthentication, "NewDefaultAzureCredential failed to initialize some credentials:\n\t%s", errorMessage)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// defaultCredentialErrorReporter is a substitute for credentials that couldn't be constructed.
|
||||
// Its GetToken method always returns a credentialUnavailableError having the same message as
|
||||
// the error that prevented constructing the credential. This ensures the message is present
|
||||
// in the error returned by ChainedTokenCredential.GetToken()
|
||||
type defaultCredentialErrorReporter struct {
|
||||
credType string
|
||||
err error
|
||||
}
|
||||
|
||||
func (d *defaultCredentialErrorReporter) GetToken(ctx context.Context, opts policy.TokenRequestOptions) (azcore.AccessToken, error) {
|
||||
if _, ok := d.err.(*credentialUnavailableError); ok {
|
||||
return azcore.AccessToken{}, d.err
|
||||
}
|
||||
return azcore.AccessToken{}, newCredentialUnavailableError(d.credType, d.err.Error())
|
||||
}
|
||||
|
||||
var _ azcore.TokenCredential = (*defaultCredentialErrorReporter)(nil)
|
||||
119
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/device_code_credential.go
generated
vendored
Normal file
119
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/device_code_credential.go
generated
vendored
Normal file
@@ -0,0 +1,119 @@
|
||||
//go:build go1.18
|
||||
// +build go1.18
|
||||
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
package azidentity
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
|
||||
"github.com/AzureAD/microsoft-authentication-library-for-go/apps/public"
|
||||
)
|
||||
|
||||
const credNameDeviceCode = "DeviceCodeCredential"
|
||||
|
||||
// DeviceCodeCredentialOptions contains optional parameters for DeviceCodeCredential.
|
||||
type DeviceCodeCredentialOptions struct {
|
||||
azcore.ClientOptions
|
||||
|
||||
// TenantID is the Azure Active Directory tenant the credential authenticates in. Defaults to the
|
||||
// "organizations" tenant, which can authenticate work and school accounts. Required for single-tenant
|
||||
// applications.
|
||||
TenantID string
|
||||
// ClientID is the ID of the application users will authenticate to.
|
||||
// Defaults to the ID of an Azure development application.
|
||||
ClientID string
|
||||
// UserPrompt controls how the credential presents authentication instructions. The credential calls
|
||||
// this function with authentication details when it receives a device code. By default, the credential
|
||||
// prints these details to stdout.
|
||||
UserPrompt func(context.Context, DeviceCodeMessage) error
|
||||
}
|
||||
|
||||
func (o *DeviceCodeCredentialOptions) init() {
|
||||
if o.TenantID == "" {
|
||||
o.TenantID = organizationsTenantID
|
||||
}
|
||||
if o.ClientID == "" {
|
||||
o.ClientID = developerSignOnClientID
|
||||
}
|
||||
if o.UserPrompt == nil {
|
||||
o.UserPrompt = func(ctx context.Context, dc DeviceCodeMessage) error {
|
||||
fmt.Println(dc.Message)
|
||||
return nil
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// DeviceCodeMessage contains the information a user needs to complete authentication.
|
||||
type DeviceCodeMessage struct {
|
||||
// UserCode is the user code returned by the service.
|
||||
UserCode string `json:"user_code"`
|
||||
// VerificationURL is the URL at which the user must authenticate.
|
||||
VerificationURL string `json:"verification_uri"`
|
||||
// Message is user instruction from Azure Active Directory.
|
||||
Message string `json:"message"`
|
||||
}
|
||||
|
||||
// DeviceCodeCredential acquires tokens for a user via the device code flow, which has the
|
||||
// user browse to an Azure Active Directory URL, enter a code, and authenticate. It's useful
|
||||
// for authenticating a user in an environment without a web browser, such as an SSH session.
|
||||
// If a web browser is available, InteractiveBrowserCredential is more convenient because it
|
||||
// automatically opens a browser to the login page.
|
||||
type DeviceCodeCredential struct {
|
||||
client publicClient
|
||||
userPrompt func(context.Context, DeviceCodeMessage) error
|
||||
account public.Account
|
||||
}
|
||||
|
||||
// NewDeviceCodeCredential creates a DeviceCodeCredential. Pass nil to accept default options.
|
||||
func NewDeviceCodeCredential(options *DeviceCodeCredentialOptions) (*DeviceCodeCredential, error) {
|
||||
cp := DeviceCodeCredentialOptions{}
|
||||
if options != nil {
|
||||
cp = *options
|
||||
}
|
||||
cp.init()
|
||||
c, err := getPublicClient(cp.ClientID, cp.TenantID, &cp.ClientOptions)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &DeviceCodeCredential{userPrompt: cp.UserPrompt, client: c}, nil
|
||||
}
|
||||
|
||||
// GetToken requests an access token from Azure Active Directory. It will begin the device code flow and poll until the user completes authentication.
|
||||
// This method is called automatically by Azure SDK clients.
|
||||
func (c *DeviceCodeCredential) GetToken(ctx context.Context, opts policy.TokenRequestOptions) (azcore.AccessToken, error) {
|
||||
if len(opts.Scopes) == 0 {
|
||||
return azcore.AccessToken{}, errors.New(credNameDeviceCode + ": GetToken() requires at least one scope")
|
||||
}
|
||||
ar, err := c.client.AcquireTokenSilent(ctx, opts.Scopes, public.WithSilentAccount(c.account))
|
||||
if err == nil {
|
||||
return azcore.AccessToken{Token: ar.AccessToken, ExpiresOn: ar.ExpiresOn.UTC()}, err
|
||||
}
|
||||
dc, err := c.client.AcquireTokenByDeviceCode(ctx, opts.Scopes)
|
||||
if err != nil {
|
||||
return azcore.AccessToken{}, newAuthenticationFailedErrorFromMSALError(credNameDeviceCode, err)
|
||||
}
|
||||
err = c.userPrompt(ctx, DeviceCodeMessage{
|
||||
UserCode: dc.Result.UserCode,
|
||||
VerificationURL: dc.Result.VerificationURL,
|
||||
Message: dc.Result.Message,
|
||||
})
|
||||
if err != nil {
|
||||
return azcore.AccessToken{}, err
|
||||
}
|
||||
ar, err = dc.AuthenticationResult(ctx)
|
||||
if err != nil {
|
||||
return azcore.AccessToken{}, newAuthenticationFailedErrorFromMSALError(credNameDeviceCode, err)
|
||||
}
|
||||
c.account = ar.Account
|
||||
logGetTokenSuccess(c, opts)
|
||||
return azcore.AccessToken{Token: ar.AccessToken, ExpiresOn: ar.ExpiresOn.UTC()}, err
|
||||
}
|
||||
|
||||
var _ azcore.TokenCredential = (*DeviceCodeCredential)(nil)
|
||||
128
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/environment_credential.go
generated
vendored
Normal file
128
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/environment_credential.go
generated
vendored
Normal file
@@ -0,0 +1,128 @@
|
||||
//go:build go1.18
|
||||
// +build go1.18
|
||||
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
package azidentity
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/internal/log"
|
||||
)
|
||||
|
||||
const envVarSendCertChain = "AZURE_CLIENT_SEND_CERTIFICATE_CHAIN"
|
||||
|
||||
// EnvironmentCredentialOptions contains optional parameters for EnvironmentCredential
|
||||
type EnvironmentCredentialOptions struct {
|
||||
azcore.ClientOptions
|
||||
}
|
||||
|
||||
// EnvironmentCredential authenticates a service principal with a secret or certificate, or a user with a password, depending
|
||||
// on environment variable configuration. It reads configuration from these variables, in the following order:
|
||||
//
|
||||
// # Service principal with client secret
|
||||
//
|
||||
// AZURE_TENANT_ID: ID of the service principal's tenant. Also called its "directory" ID.
|
||||
//
|
||||
// AZURE_CLIENT_ID: the service principal's client ID
|
||||
//
|
||||
// AZURE_CLIENT_SECRET: one of the service principal's client secrets
|
||||
//
|
||||
// # Service principal with certificate
|
||||
//
|
||||
// AZURE_TENANT_ID: ID of the service principal's tenant. Also called its "directory" ID.
|
||||
//
|
||||
// AZURE_CLIENT_ID: the service principal's client ID
|
||||
//
|
||||
// AZURE_CLIENT_CERTIFICATE_PATH: path to a PEM or PKCS12 certificate file including the private key.
|
||||
//
|
||||
// AZURE_CLIENT_CERTIFICATE_PASSWORD: (optional) password for the certificate file.
|
||||
//
|
||||
// # User with username and password
|
||||
//
|
||||
// AZURE_TENANT_ID: (optional) tenant to authenticate in. Defaults to "organizations".
|
||||
//
|
||||
// AZURE_CLIENT_ID: client ID of the application the user will authenticate to
|
||||
//
|
||||
// AZURE_USERNAME: a username (usually an email address)
|
||||
//
|
||||
// AZURE_PASSWORD: the user's password
|
||||
type EnvironmentCredential struct {
|
||||
cred azcore.TokenCredential
|
||||
}
|
||||
|
||||
// NewEnvironmentCredential creates an EnvironmentCredential. Pass nil to accept default options.
|
||||
func NewEnvironmentCredential(options *EnvironmentCredentialOptions) (*EnvironmentCredential, error) {
|
||||
if options == nil {
|
||||
options = &EnvironmentCredentialOptions{}
|
||||
}
|
||||
tenantID := os.Getenv(azureTenantID)
|
||||
if tenantID == "" {
|
||||
return nil, errors.New("missing environment variable AZURE_TENANT_ID")
|
||||
}
|
||||
clientID := os.Getenv(azureClientID)
|
||||
if clientID == "" {
|
||||
return nil, errors.New("missing environment variable " + azureClientID)
|
||||
}
|
||||
if clientSecret := os.Getenv(azureClientSecret); clientSecret != "" {
|
||||
log.Write(EventAuthentication, "EnvironmentCredential will authenticate with ClientSecretCredential")
|
||||
o := &ClientSecretCredentialOptions{ClientOptions: options.ClientOptions}
|
||||
cred, err := NewClientSecretCredential(tenantID, clientID, clientSecret, o)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &EnvironmentCredential{cred: cred}, nil
|
||||
}
|
||||
if certPath := os.Getenv(azureClientCertificatePath); certPath != "" {
|
||||
log.Write(EventAuthentication, "EnvironmentCredential will authenticate with ClientCertificateCredential")
|
||||
certData, err := os.ReadFile(certPath)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf(`failed to read certificate file "%s": %v`, certPath, err)
|
||||
}
|
||||
var password []byte
|
||||
if v := os.Getenv(azureClientCertificatePassword); v != "" {
|
||||
password = []byte(v)
|
||||
}
|
||||
certs, key, err := ParseCertificates(certData, password)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf(`failed to load certificate from "%s": %v`, certPath, err)
|
||||
}
|
||||
o := &ClientCertificateCredentialOptions{ClientOptions: options.ClientOptions}
|
||||
if v, ok := os.LookupEnv(envVarSendCertChain); ok {
|
||||
o.SendCertificateChain = v == "1" || strings.ToLower(v) == "true"
|
||||
}
|
||||
cred, err := NewClientCertificateCredential(tenantID, clientID, certs, key, o)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &EnvironmentCredential{cred: cred}, nil
|
||||
}
|
||||
if username := os.Getenv(azureUsername); username != "" {
|
||||
if password := os.Getenv(azurePassword); password != "" {
|
||||
log.Write(EventAuthentication, "EnvironmentCredential will authenticate with UsernamePasswordCredential")
|
||||
o := &UsernamePasswordCredentialOptions{ClientOptions: options.ClientOptions}
|
||||
cred, err := NewUsernamePasswordCredential(tenantID, clientID, username, password, o)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &EnvironmentCredential{cred: cred}, nil
|
||||
}
|
||||
return nil, errors.New("no value for AZURE_PASSWORD")
|
||||
}
|
||||
return nil, errors.New("incomplete environment variable configuration. Only AZURE_TENANT_ID and AZURE_CLIENT_ID are set")
|
||||
}
|
||||
|
||||
// GetToken requests an access token from Azure Active Directory. This method is called automatically by Azure SDK clients.
|
||||
func (c *EnvironmentCredential) GetToken(ctx context.Context, opts policy.TokenRequestOptions) (azcore.AccessToken, error) {
|
||||
return c.cred.GetToken(ctx, opts)
|
||||
}
|
||||
|
||||
var _ azcore.TokenCredential = (*EnvironmentCredential)(nil)
|
||||
124
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/errors.go
generated
vendored
Normal file
124
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/errors.go
generated
vendored
Normal file
@@ -0,0 +1,124 @@
|
||||
//go:build go1.18
|
||||
// +build go1.18
|
||||
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
package azidentity
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/internal/errorinfo"
|
||||
msal "github.com/AzureAD/microsoft-authentication-library-for-go/apps/errors"
|
||||
)
|
||||
|
||||
// getResponseFromError retrieves the response carried by
|
||||
// an AuthenticationFailedError or MSAL CallErr, if any
|
||||
func getResponseFromError(err error) *http.Response {
|
||||
var a *AuthenticationFailedError
|
||||
var c msal.CallErr
|
||||
var res *http.Response
|
||||
if errors.As(err, &c) {
|
||||
res = c.Resp
|
||||
} else if errors.As(err, &a) {
|
||||
res = a.RawResponse
|
||||
}
|
||||
return res
|
||||
}
|
||||
|
||||
// AuthenticationFailedError indicates an authentication request has failed.
|
||||
type AuthenticationFailedError struct {
|
||||
// RawResponse is the HTTP response motivating the error, if available.
|
||||
RawResponse *http.Response
|
||||
|
||||
credType string
|
||||
message string
|
||||
}
|
||||
|
||||
func newAuthenticationFailedError(credType string, message string, resp *http.Response) error {
|
||||
return &AuthenticationFailedError{credType: credType, message: message, RawResponse: resp}
|
||||
}
|
||||
|
||||
func newAuthenticationFailedErrorFromMSALError(credType string, err error) error {
|
||||
res := getResponseFromError(err)
|
||||
return newAuthenticationFailedError(credType, err.Error(), res)
|
||||
}
|
||||
|
||||
// Error implements the error interface. Note that the message contents are not contractual and can change over time.
|
||||
func (e *AuthenticationFailedError) Error() string {
|
||||
if e.RawResponse == nil {
|
||||
return e.credType + ": " + e.message
|
||||
}
|
||||
msg := &bytes.Buffer{}
|
||||
fmt.Fprintf(msg, e.credType+" authentication failed\n")
|
||||
fmt.Fprintf(msg, "%s %s://%s%s\n", e.RawResponse.Request.Method, e.RawResponse.Request.URL.Scheme, e.RawResponse.Request.URL.Host, e.RawResponse.Request.URL.Path)
|
||||
fmt.Fprintln(msg, "--------------------------------------------------------------------------------")
|
||||
fmt.Fprintf(msg, "RESPONSE %s\n", e.RawResponse.Status)
|
||||
fmt.Fprintln(msg, "--------------------------------------------------------------------------------")
|
||||
body, err := io.ReadAll(e.RawResponse.Body)
|
||||
e.RawResponse.Body.Close()
|
||||
if err != nil {
|
||||
fmt.Fprintf(msg, "Error reading response body: %v", err)
|
||||
} else if len(body) > 0 {
|
||||
e.RawResponse.Body = io.NopCloser(bytes.NewReader(body))
|
||||
if err := json.Indent(msg, body, "", " "); err != nil {
|
||||
// failed to pretty-print so just dump it verbatim
|
||||
fmt.Fprint(msg, string(body))
|
||||
}
|
||||
} else {
|
||||
fmt.Fprint(msg, "Response contained no body")
|
||||
}
|
||||
fmt.Fprintln(msg, "\n--------------------------------------------------------------------------------")
|
||||
var anchor string
|
||||
switch e.credType {
|
||||
case credNameAzureCLI:
|
||||
anchor = "azure-cli"
|
||||
case credNameCert:
|
||||
anchor = "client-cert"
|
||||
case credNameSecret:
|
||||
anchor = "client-secret"
|
||||
case credNameManagedIdentity:
|
||||
anchor = "managed-id"
|
||||
case credNameUserPassword:
|
||||
anchor = "username-password"
|
||||
}
|
||||
if anchor != "" {
|
||||
fmt.Fprintf(msg, "To troubleshoot, visit https://aka.ms/azsdk/go/identity/troubleshoot#%s", anchor)
|
||||
}
|
||||
return msg.String()
|
||||
}
|
||||
|
||||
// NonRetriable indicates the request which provoked this error shouldn't be retried.
|
||||
func (*AuthenticationFailedError) NonRetriable() {
|
||||
// marker method
|
||||
}
|
||||
|
||||
var _ errorinfo.NonRetriable = (*AuthenticationFailedError)(nil)
|
||||
|
||||
// credentialUnavailableError indicates a credential can't attempt
|
||||
// authentication because it lacks required data or state.
|
||||
type credentialUnavailableError struct {
|
||||
credType string
|
||||
message string
|
||||
}
|
||||
|
||||
func newCredentialUnavailableError(credType, message string) error {
|
||||
return &credentialUnavailableError{credType: credType, message: message}
|
||||
}
|
||||
|
||||
func (e *credentialUnavailableError) Error() string {
|
||||
return e.credType + ": " + e.message
|
||||
}
|
||||
|
||||
// NonRetriable indicates that this error should not be retried.
|
||||
func (e *credentialUnavailableError) NonRetriable() {
|
||||
// marker method
|
||||
}
|
||||
|
||||
var _ errorinfo.NonRetriable = (*credentialUnavailableError)(nil)
|
||||
85
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/interactive_browser_credential.go
generated
vendored
Normal file
85
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/interactive_browser_credential.go
generated
vendored
Normal file
@@ -0,0 +1,85 @@
|
||||
//go:build go1.18
|
||||
// +build go1.18
|
||||
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
package azidentity
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
|
||||
"github.com/AzureAD/microsoft-authentication-library-for-go/apps/public"
|
||||
)
|
||||
|
||||
const credNameBrowser = "InteractiveBrowserCredentiall"
|
||||
|
||||
// InteractiveBrowserCredentialOptions contains optional parameters for InteractiveBrowserCredential.
|
||||
type InteractiveBrowserCredentialOptions struct {
|
||||
azcore.ClientOptions
|
||||
|
||||
// TenantID is the Azure Active Directory tenant the credential authenticates in. Defaults to the
|
||||
// "organizations" tenant, which can authenticate work and school accounts.
|
||||
TenantID string
|
||||
// ClientID is the ID of the application users will authenticate to.
|
||||
// Defaults to the ID of an Azure development application.
|
||||
ClientID string
|
||||
// RedirectURL will be supported in a future version but presently doesn't work: https://github.com/Azure/azure-sdk-for-go/issues/15632.
|
||||
// Applications which have "http://localhost" registered as a redirect URL need not set this option.
|
||||
RedirectURL string
|
||||
}
|
||||
|
||||
func (o *InteractiveBrowserCredentialOptions) init() {
|
||||
if o.TenantID == "" {
|
||||
o.TenantID = organizationsTenantID
|
||||
}
|
||||
if o.ClientID == "" {
|
||||
o.ClientID = developerSignOnClientID
|
||||
}
|
||||
}
|
||||
|
||||
// InteractiveBrowserCredential opens a browser to interactively authenticate a user.
|
||||
type InteractiveBrowserCredential struct {
|
||||
client publicClient
|
||||
options InteractiveBrowserCredentialOptions
|
||||
account public.Account
|
||||
}
|
||||
|
||||
// NewInteractiveBrowserCredential constructs a new InteractiveBrowserCredential. Pass nil to accept default options.
|
||||
func NewInteractiveBrowserCredential(options *InteractiveBrowserCredentialOptions) (*InteractiveBrowserCredential, error) {
|
||||
cp := InteractiveBrowserCredentialOptions{}
|
||||
if options != nil {
|
||||
cp = *options
|
||||
}
|
||||
cp.init()
|
||||
c, err := getPublicClient(cp.ClientID, cp.TenantID, &cp.ClientOptions)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &InteractiveBrowserCredential{options: cp, client: c}, nil
|
||||
}
|
||||
|
||||
// GetToken requests an access token from Azure Active Directory. This method is called automatically by Azure SDK clients.
|
||||
func (c *InteractiveBrowserCredential) GetToken(ctx context.Context, opts policy.TokenRequestOptions) (azcore.AccessToken, error) {
|
||||
if len(opts.Scopes) == 0 {
|
||||
return azcore.AccessToken{}, errors.New(credNameBrowser + ": GetToken() requires at least one scope")
|
||||
}
|
||||
ar, err := c.client.AcquireTokenSilent(ctx, opts.Scopes, public.WithSilentAccount(c.account))
|
||||
if err == nil {
|
||||
logGetTokenSuccess(c, opts)
|
||||
return azcore.AccessToken{Token: ar.AccessToken, ExpiresOn: ar.ExpiresOn.UTC()}, err
|
||||
}
|
||||
|
||||
ar, err = c.client.AcquireTokenInteractive(ctx, opts.Scopes, public.WithRedirectURI(c.options.RedirectURL))
|
||||
if err != nil {
|
||||
return azcore.AccessToken{}, newAuthenticationFailedErrorFromMSALError(credNameBrowser, err)
|
||||
}
|
||||
c.account = ar.Account
|
||||
logGetTokenSuccess(c, opts)
|
||||
return azcore.AccessToken{Token: ar.AccessToken, ExpiresOn: ar.ExpiresOn.UTC()}, err
|
||||
}
|
||||
|
||||
var _ azcore.TokenCredential = (*InteractiveBrowserCredential)(nil)
|
||||
30
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/logging.go
generated
vendored
Normal file
30
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/logging.go
generated
vendored
Normal file
@@ -0,0 +1,30 @@
|
||||
//go:build go1.18
|
||||
// +build go1.18
|
||||
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
package azidentity
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/internal/log"
|
||||
)
|
||||
|
||||
// EventAuthentication entries contain information about authentication.
|
||||
// This includes information like the names of environment variables
|
||||
// used when obtaining credentials and the type of credential used.
|
||||
const EventAuthentication log.Event = "Authentication"
|
||||
|
||||
func logGetTokenSuccess(cred azcore.TokenCredential, opts policy.TokenRequestOptions) {
|
||||
if !log.Should(EventAuthentication) {
|
||||
return
|
||||
}
|
||||
scope := strings.Join(opts.Scopes, ", ")
|
||||
msg := fmt.Sprintf("%T.GetToken() acquired a token for scope %s\n", cred, scope)
|
||||
log.Write(EventAuthentication, msg)
|
||||
}
|
||||
401
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_client.go
generated
vendored
Normal file
401
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_client.go
generated
vendored
Normal file
@@ -0,0 +1,401 @@
|
||||
//go:build go1.18
|
||||
// +build go1.18
|
||||
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
package azidentity
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"os"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/streaming"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/internal/log"
|
||||
"github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential"
|
||||
)
|
||||
|
||||
const (
|
||||
arcIMDSEndpoint = "IMDS_ENDPOINT"
|
||||
identityEndpoint = "IDENTITY_ENDPOINT"
|
||||
identityHeader = "IDENTITY_HEADER"
|
||||
identityServerThumbprint = "IDENTITY_SERVER_THUMBPRINT"
|
||||
headerMetadata = "Metadata"
|
||||
imdsEndpoint = "http://169.254.169.254/metadata/identity/oauth2/token"
|
||||
msiEndpoint = "MSI_ENDPOINT"
|
||||
imdsAPIVersion = "2018-02-01"
|
||||
azureArcAPIVersion = "2019-08-15"
|
||||
serviceFabricAPIVersion = "2019-07-01-preview"
|
||||
|
||||
qpClientID = "client_id"
|
||||
qpResID = "mi_res_id"
|
||||
)
|
||||
|
||||
type msiType int
|
||||
|
||||
const (
|
||||
msiTypeAppService msiType = iota
|
||||
msiTypeAzureArc
|
||||
msiTypeCloudShell
|
||||
msiTypeIMDS
|
||||
msiTypeServiceFabric
|
||||
)
|
||||
|
||||
// managedIdentityClient provides the base for authenticating in managed identity environments
|
||||
// This type includes an runtime.Pipeline and TokenCredentialOptions.
|
||||
type managedIdentityClient struct {
|
||||
pipeline runtime.Pipeline
|
||||
msiType msiType
|
||||
endpoint string
|
||||
id ManagedIDKind
|
||||
imdsTimeout time.Duration
|
||||
}
|
||||
|
||||
type wrappedNumber json.Number
|
||||
|
||||
func (n *wrappedNumber) UnmarshalJSON(b []byte) error {
|
||||
c := string(b)
|
||||
if c == "\"\"" {
|
||||
return nil
|
||||
}
|
||||
return json.Unmarshal(b, (*json.Number)(n))
|
||||
}
|
||||
|
||||
// setIMDSRetryOptionDefaults sets zero-valued fields to default values appropriate for IMDS
|
||||
func setIMDSRetryOptionDefaults(o *policy.RetryOptions) {
|
||||
if o.MaxRetries == 0 {
|
||||
o.MaxRetries = 5
|
||||
}
|
||||
if o.MaxRetryDelay == 0 {
|
||||
o.MaxRetryDelay = 1 * time.Minute
|
||||
}
|
||||
if o.RetryDelay == 0 {
|
||||
o.RetryDelay = 2 * time.Second
|
||||
}
|
||||
if o.StatusCodes == nil {
|
||||
o.StatusCodes = []int{
|
||||
// IMDS docs recommend retrying 404, 429 and all 5xx
|
||||
// https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token#error-handling
|
||||
http.StatusNotFound, // 404
|
||||
http.StatusTooManyRequests, // 429
|
||||
http.StatusInternalServerError, // 500
|
||||
http.StatusNotImplemented, // 501
|
||||
http.StatusBadGateway, // 502
|
||||
http.StatusGatewayTimeout, // 504
|
||||
http.StatusHTTPVersionNotSupported, // 505
|
||||
http.StatusVariantAlsoNegotiates, // 506
|
||||
http.StatusInsufficientStorage, // 507
|
||||
http.StatusLoopDetected, // 508
|
||||
http.StatusNotExtended, // 510
|
||||
http.StatusNetworkAuthenticationRequired, // 511
|
||||
}
|
||||
}
|
||||
if o.TryTimeout == 0 {
|
||||
o.TryTimeout = 1 * time.Minute
|
||||
}
|
||||
}
|
||||
|
||||
// newManagedIdentityClient creates a new instance of the ManagedIdentityClient with the ManagedIdentityCredentialOptions
|
||||
// that are passed into it along with a default pipeline.
|
||||
// options: ManagedIdentityCredentialOptions configure policies for the pipeline and the authority host that
|
||||
// will be used to retrieve tokens and authenticate
|
||||
func newManagedIdentityClient(options *ManagedIdentityCredentialOptions) (*managedIdentityClient, error) {
|
||||
if options == nil {
|
||||
options = &ManagedIdentityCredentialOptions{}
|
||||
}
|
||||
cp := options.ClientOptions
|
||||
c := managedIdentityClient{id: options.ID, endpoint: imdsEndpoint, msiType: msiTypeIMDS}
|
||||
env := "IMDS"
|
||||
if endpoint, ok := os.LookupEnv(identityEndpoint); ok {
|
||||
if _, ok := os.LookupEnv(identityHeader); ok {
|
||||
if _, ok := os.LookupEnv(identityServerThumbprint); ok {
|
||||
env = "Service Fabric"
|
||||
c.endpoint = endpoint
|
||||
c.msiType = msiTypeServiceFabric
|
||||
} else {
|
||||
env = "App Service"
|
||||
c.endpoint = endpoint
|
||||
c.msiType = msiTypeAppService
|
||||
}
|
||||
} else if _, ok := os.LookupEnv(arcIMDSEndpoint); ok {
|
||||
env = "Azure Arc"
|
||||
c.endpoint = endpoint
|
||||
c.msiType = msiTypeAzureArc
|
||||
}
|
||||
} else if endpoint, ok := os.LookupEnv(msiEndpoint); ok {
|
||||
env = "Cloud Shell"
|
||||
c.endpoint = endpoint
|
||||
c.msiType = msiTypeCloudShell
|
||||
} else {
|
||||
setIMDSRetryOptionDefaults(&cp.Retry)
|
||||
}
|
||||
c.pipeline = runtime.NewPipeline(component, version, runtime.PipelineOptions{}, &cp)
|
||||
|
||||
if log.Should(EventAuthentication) {
|
||||
log.Writef(EventAuthentication, "Managed Identity Credential will use %s managed identity", env)
|
||||
}
|
||||
|
||||
return &c, nil
|
||||
}
|
||||
|
||||
// provideToken acquires a token for MSAL's confidential.Client, which caches the token
|
||||
func (c *managedIdentityClient) provideToken(ctx context.Context, params confidential.TokenProviderParameters) (confidential.TokenProviderResult, error) {
|
||||
result := confidential.TokenProviderResult{}
|
||||
tk, err := c.authenticate(ctx, c.id, params.Scopes)
|
||||
if err == nil {
|
||||
result.AccessToken = tk.Token
|
||||
result.ExpiresInSeconds = int(time.Until(tk.ExpiresOn).Seconds())
|
||||
}
|
||||
return result, err
|
||||
}
|
||||
|
||||
// authenticate acquires an access token
|
||||
func (c *managedIdentityClient) authenticate(ctx context.Context, id ManagedIDKind, scopes []string) (azcore.AccessToken, error) {
|
||||
var cancel context.CancelFunc
|
||||
if c.imdsTimeout > 0 && c.msiType == msiTypeIMDS {
|
||||
ctx, cancel = context.WithTimeout(ctx, c.imdsTimeout)
|
||||
defer cancel()
|
||||
}
|
||||
|
||||
msg, err := c.createAuthRequest(ctx, id, scopes)
|
||||
if err != nil {
|
||||
return azcore.AccessToken{}, err
|
||||
}
|
||||
|
||||
resp, err := c.pipeline.Do(msg)
|
||||
if err != nil {
|
||||
if cancel != nil && errors.Is(err, context.DeadlineExceeded) {
|
||||
return azcore.AccessToken{}, newCredentialUnavailableError(credNameManagedIdentity, "IMDS token request timed out")
|
||||
}
|
||||
return azcore.AccessToken{}, newAuthenticationFailedError(credNameManagedIdentity, err.Error(), nil)
|
||||
}
|
||||
|
||||
// got a response, remove the IMDS timeout so future requests use the transport's configuration
|
||||
c.imdsTimeout = 0
|
||||
|
||||
if runtime.HasStatusCode(resp, http.StatusOK, http.StatusCreated) {
|
||||
return c.createAccessToken(resp)
|
||||
}
|
||||
|
||||
if c.msiType == msiTypeIMDS && resp.StatusCode == 400 {
|
||||
if id != nil {
|
||||
return azcore.AccessToken{}, newAuthenticationFailedError(credNameManagedIdentity, "the requested identity isn't assigned to this resource", resp)
|
||||
}
|
||||
return azcore.AccessToken{}, newCredentialUnavailableError(credNameManagedIdentity, "no default identity is assigned to this resource")
|
||||
}
|
||||
|
||||
return azcore.AccessToken{}, newAuthenticationFailedError(credNameManagedIdentity, "authentication failed", resp)
|
||||
}
|
||||
|
||||
func (c *managedIdentityClient) createAccessToken(res *http.Response) (azcore.AccessToken, error) {
|
||||
value := struct {
|
||||
// these are the only fields that we use
|
||||
Token string `json:"access_token,omitempty"`
|
||||
RefreshToken string `json:"refresh_token,omitempty"`
|
||||
ExpiresIn wrappedNumber `json:"expires_in,omitempty"` // this field should always return the number of seconds for which a token is valid
|
||||
ExpiresOn interface{} `json:"expires_on,omitempty"` // the value returned in this field varies between a number and a date string
|
||||
}{}
|
||||
if err := runtime.UnmarshalAsJSON(res, &value); err != nil {
|
||||
return azcore.AccessToken{}, fmt.Errorf("internal AccessToken: %v", err)
|
||||
}
|
||||
if value.ExpiresIn != "" {
|
||||
expiresIn, err := json.Number(value.ExpiresIn).Int64()
|
||||
if err != nil {
|
||||
return azcore.AccessToken{}, err
|
||||
}
|
||||
return azcore.AccessToken{Token: value.Token, ExpiresOn: time.Now().Add(time.Second * time.Duration(expiresIn)).UTC()}, nil
|
||||
}
|
||||
switch v := value.ExpiresOn.(type) {
|
||||
case float64:
|
||||
return azcore.AccessToken{Token: value.Token, ExpiresOn: time.Unix(int64(v), 0).UTC()}, nil
|
||||
case string:
|
||||
if expiresOn, err := strconv.Atoi(v); err == nil {
|
||||
return azcore.AccessToken{Token: value.Token, ExpiresOn: time.Unix(int64(expiresOn), 0).UTC()}, nil
|
||||
}
|
||||
return azcore.AccessToken{}, newAuthenticationFailedError(credNameManagedIdentity, "unexpected expires_on value: "+v, res)
|
||||
default:
|
||||
msg := fmt.Sprintf("unsupported type received in expires_on: %T, %v", v, v)
|
||||
return azcore.AccessToken{}, newAuthenticationFailedError(credNameManagedIdentity, msg, res)
|
||||
}
|
||||
}
|
||||
|
||||
func (c *managedIdentityClient) createAuthRequest(ctx context.Context, id ManagedIDKind, scopes []string) (*policy.Request, error) {
|
||||
switch c.msiType {
|
||||
case msiTypeIMDS:
|
||||
return c.createIMDSAuthRequest(ctx, id, scopes)
|
||||
case msiTypeAppService:
|
||||
return c.createAppServiceAuthRequest(ctx, id, scopes)
|
||||
case msiTypeAzureArc:
|
||||
// need to perform preliminary request to retreive the secret key challenge provided by the HIMDS service
|
||||
key, err := c.getAzureArcSecretKey(ctx, scopes)
|
||||
if err != nil {
|
||||
msg := fmt.Sprintf("failed to retreive secret key from the identity endpoint: %v", err)
|
||||
return nil, newAuthenticationFailedError(credNameManagedIdentity, msg, nil)
|
||||
}
|
||||
return c.createAzureArcAuthRequest(ctx, id, scopes, key)
|
||||
case msiTypeServiceFabric:
|
||||
return c.createServiceFabricAuthRequest(ctx, id, scopes)
|
||||
case msiTypeCloudShell:
|
||||
return c.createCloudShellAuthRequest(ctx, id, scopes)
|
||||
default:
|
||||
return nil, newCredentialUnavailableError(credNameManagedIdentity, "managed identity isn't supported in this environment")
|
||||
}
|
||||
}
|
||||
|
||||
func (c *managedIdentityClient) createIMDSAuthRequest(ctx context.Context, id ManagedIDKind, scopes []string) (*policy.Request, error) {
|
||||
request, err := runtime.NewRequest(ctx, http.MethodGet, c.endpoint)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
request.Raw().Header.Set(headerMetadata, "true")
|
||||
q := request.Raw().URL.Query()
|
||||
q.Add("api-version", imdsAPIVersion)
|
||||
q.Add("resource", strings.Join(scopes, " "))
|
||||
if id != nil {
|
||||
if id.idKind() == miResourceID {
|
||||
q.Add(qpResID, id.String())
|
||||
} else {
|
||||
q.Add(qpClientID, id.String())
|
||||
}
|
||||
}
|
||||
request.Raw().URL.RawQuery = q.Encode()
|
||||
return request, nil
|
||||
}
|
||||
|
||||
func (c *managedIdentityClient) createAppServiceAuthRequest(ctx context.Context, id ManagedIDKind, scopes []string) (*policy.Request, error) {
|
||||
request, err := runtime.NewRequest(ctx, http.MethodGet, c.endpoint)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
request.Raw().Header.Set("X-IDENTITY-HEADER", os.Getenv(identityHeader))
|
||||
q := request.Raw().URL.Query()
|
||||
q.Add("api-version", "2019-08-01")
|
||||
q.Add("resource", scopes[0])
|
||||
if id != nil {
|
||||
if id.idKind() == miResourceID {
|
||||
q.Add(qpResID, id.String())
|
||||
} else {
|
||||
q.Add(qpClientID, id.String())
|
||||
}
|
||||
}
|
||||
request.Raw().URL.RawQuery = q.Encode()
|
||||
return request, nil
|
||||
}
|
||||
|
||||
func (c *managedIdentityClient) createServiceFabricAuthRequest(ctx context.Context, id ManagedIDKind, scopes []string) (*policy.Request, error) {
|
||||
request, err := runtime.NewRequest(ctx, http.MethodGet, c.endpoint)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
q := request.Raw().URL.Query()
|
||||
request.Raw().Header.Set("Accept", "application/json")
|
||||
request.Raw().Header.Set("Secret", os.Getenv(identityHeader))
|
||||
q.Add("api-version", serviceFabricAPIVersion)
|
||||
q.Add("resource", strings.Join(scopes, " "))
|
||||
if id != nil {
|
||||
log.Write(EventAuthentication, "WARNING: Service Fabric doesn't support selecting a user-assigned identity at runtime")
|
||||
if id.idKind() == miResourceID {
|
||||
q.Add(qpResID, id.String())
|
||||
} else {
|
||||
q.Add(qpClientID, id.String())
|
||||
}
|
||||
}
|
||||
request.Raw().URL.RawQuery = q.Encode()
|
||||
return request, nil
|
||||
}
|
||||
|
||||
func (c *managedIdentityClient) getAzureArcSecretKey(ctx context.Context, resources []string) (string, error) {
|
||||
// create the request to retreive the secret key challenge provided by the HIMDS service
|
||||
request, err := runtime.NewRequest(ctx, http.MethodGet, c.endpoint)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
request.Raw().Header.Set(headerMetadata, "true")
|
||||
q := request.Raw().URL.Query()
|
||||
q.Add("api-version", azureArcAPIVersion)
|
||||
q.Add("resource", strings.Join(resources, " "))
|
||||
request.Raw().URL.RawQuery = q.Encode()
|
||||
// send the initial request to get the short-lived secret key
|
||||
response, err := c.pipeline.Do(request)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
// the endpoint is expected to return a 401 with the WWW-Authenticate header set to the location
|
||||
// of the secret key file. Any other status code indicates an error in the request.
|
||||
if response.StatusCode != 401 {
|
||||
msg := fmt.Sprintf("expected a 401 response, received %d", response.StatusCode)
|
||||
return "", newAuthenticationFailedError(credNameManagedIdentity, msg, response)
|
||||
}
|
||||
header := response.Header.Get("WWW-Authenticate")
|
||||
if len(header) == 0 {
|
||||
return "", errors.New("did not receive a value from WWW-Authenticate header")
|
||||
}
|
||||
// the WWW-Authenticate header is expected in the following format: Basic realm=/some/file/path.key
|
||||
pos := strings.LastIndex(header, "=")
|
||||
if pos == -1 {
|
||||
return "", fmt.Errorf("did not receive a correct value from WWW-Authenticate header: %s", header)
|
||||
}
|
||||
key, err := os.ReadFile(header[pos+1:])
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("could not read file (%s) contents: %v", header[pos+1:], err)
|
||||
}
|
||||
return string(key), nil
|
||||
}
|
||||
|
||||
func (c *managedIdentityClient) createAzureArcAuthRequest(ctx context.Context, id ManagedIDKind, resources []string, key string) (*policy.Request, error) {
|
||||
request, err := runtime.NewRequest(ctx, http.MethodGet, c.endpoint)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
request.Raw().Header.Set(headerMetadata, "true")
|
||||
request.Raw().Header.Set("Authorization", fmt.Sprintf("Basic %s", key))
|
||||
q := request.Raw().URL.Query()
|
||||
q.Add("api-version", azureArcAPIVersion)
|
||||
q.Add("resource", strings.Join(resources, " "))
|
||||
if id != nil {
|
||||
log.Write(EventAuthentication, "WARNING: Azure Arc doesn't support user-assigned managed identities")
|
||||
if id.idKind() == miResourceID {
|
||||
q.Add(qpResID, id.String())
|
||||
} else {
|
||||
q.Add(qpClientID, id.String())
|
||||
}
|
||||
}
|
||||
request.Raw().URL.RawQuery = q.Encode()
|
||||
return request, nil
|
||||
}
|
||||
|
||||
func (c *managedIdentityClient) createCloudShellAuthRequest(ctx context.Context, id ManagedIDKind, scopes []string) (*policy.Request, error) {
|
||||
request, err := runtime.NewRequest(ctx, http.MethodPost, c.endpoint)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
request.Raw().Header.Set(headerMetadata, "true")
|
||||
data := url.Values{}
|
||||
data.Set("resource", strings.Join(scopes, " "))
|
||||
dataEncoded := data.Encode()
|
||||
body := streaming.NopCloser(strings.NewReader(dataEncoded))
|
||||
if err := request.SetBody(body, "application/x-www-form-urlencoded"); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if id != nil {
|
||||
log.Write(EventAuthentication, "WARNING: Cloud Shell doesn't support user-assigned managed identities")
|
||||
q := request.Raw().URL.Query()
|
||||
if id.idKind() == miResourceID {
|
||||
q.Add(qpResID, id.String())
|
||||
} else {
|
||||
q.Add(qpClientID, id.String())
|
||||
}
|
||||
}
|
||||
return request, nil
|
||||
}
|
||||
125
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_credential.go
generated
vendored
Normal file
125
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_credential.go
generated
vendored
Normal file
@@ -0,0 +1,125 @@
|
||||
//go:build go1.18
|
||||
// +build go1.18
|
||||
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
package azidentity
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
|
||||
"github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential"
|
||||
)
|
||||
|
||||
const credNameManagedIdentity = "ManagedIdentityCredential"
|
||||
|
||||
type managedIdentityIDKind int
|
||||
|
||||
const (
|
||||
miClientID managedIdentityIDKind = 0
|
||||
miResourceID managedIdentityIDKind = 1
|
||||
)
|
||||
|
||||
// ManagedIDKind identifies the ID of a managed identity as either a client or resource ID
|
||||
type ManagedIDKind interface {
|
||||
fmt.Stringer
|
||||
idKind() managedIdentityIDKind
|
||||
}
|
||||
|
||||
// ClientID is the client ID of a user-assigned managed identity.
|
||||
type ClientID string
|
||||
|
||||
func (ClientID) idKind() managedIdentityIDKind {
|
||||
return miClientID
|
||||
}
|
||||
|
||||
// String returns the string value of the ID.
|
||||
func (c ClientID) String() string {
|
||||
return string(c)
|
||||
}
|
||||
|
||||
// ResourceID is the resource ID of a user-assigned managed identity.
|
||||
type ResourceID string
|
||||
|
||||
func (ResourceID) idKind() managedIdentityIDKind {
|
||||
return miResourceID
|
||||
}
|
||||
|
||||
// String returns the string value of the ID.
|
||||
func (r ResourceID) String() string {
|
||||
return string(r)
|
||||
}
|
||||
|
||||
// ManagedIdentityCredentialOptions contains optional parameters for ManagedIdentityCredential.
|
||||
type ManagedIdentityCredentialOptions struct {
|
||||
azcore.ClientOptions
|
||||
|
||||
// ID is the ID of a managed identity the credential should authenticate. Set this field to use a specific identity
|
||||
// instead of the hosting environment's default. The value may be the identity's client ID or resource ID, but note that
|
||||
// some platforms don't accept resource IDs.
|
||||
ID ManagedIDKind
|
||||
}
|
||||
|
||||
// ManagedIdentityCredential authenticates an Azure managed identity in any hosting environment supporting managed identities.
|
||||
// This credential authenticates a system-assigned identity by default. Use ManagedIdentityCredentialOptions.ID to specify a
|
||||
// user-assigned identity. See Azure Active Directory documentation for more information about managed identities:
|
||||
// https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview
|
||||
type ManagedIdentityCredential struct {
|
||||
client confidentialClient
|
||||
mic *managedIdentityClient
|
||||
}
|
||||
|
||||
// NewManagedIdentityCredential creates a ManagedIdentityCredential. Pass nil to accept default options.
|
||||
func NewManagedIdentityCredential(options *ManagedIdentityCredentialOptions) (*ManagedIdentityCredential, error) {
|
||||
if options == nil {
|
||||
options = &ManagedIdentityCredentialOptions{}
|
||||
}
|
||||
mic, err := newManagedIdentityClient(options)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
cred := confidential.NewCredFromTokenProvider(mic.provideToken)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// It's okay to give MSAL an invalid client ID because MSAL will use it only as part of a cache key.
|
||||
// ManagedIdentityClient handles all the details of authentication and won't receive this value from MSAL.
|
||||
clientID := "SYSTEM-ASSIGNED-MANAGED-IDENTITY"
|
||||
if options.ID != nil {
|
||||
clientID = options.ID.String()
|
||||
}
|
||||
c, err := confidential.New(clientID, cred)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &ManagedIdentityCredential{client: c, mic: mic}, nil
|
||||
}
|
||||
|
||||
// GetToken requests an access token from the hosting environment. This method is called automatically by Azure SDK clients.
|
||||
func (c *ManagedIdentityCredential) GetToken(ctx context.Context, opts policy.TokenRequestOptions) (azcore.AccessToken, error) {
|
||||
if len(opts.Scopes) != 1 {
|
||||
err := errors.New(credNameManagedIdentity + ": GetToken() requires exactly one scope")
|
||||
return azcore.AccessToken{}, err
|
||||
}
|
||||
// managed identity endpoints require an AADv1 resource (i.e. token audience), not a v2 scope, so we remove "/.default" here
|
||||
scopes := []string{strings.TrimSuffix(opts.Scopes[0], defaultSuffix)}
|
||||
ar, err := c.client.AcquireTokenSilent(ctx, scopes)
|
||||
if err == nil {
|
||||
logGetTokenSuccess(c, opts)
|
||||
return azcore.AccessToken{Token: ar.AccessToken, ExpiresOn: ar.ExpiresOn.UTC()}, nil
|
||||
}
|
||||
ar, err = c.client.AcquireTokenByCredential(ctx, scopes)
|
||||
if err != nil {
|
||||
return azcore.AccessToken{}, err
|
||||
}
|
||||
logGetTokenSuccess(c, opts)
|
||||
return azcore.AccessToken{Token: ar.AccessToken, ExpiresOn: ar.ExpiresOn.UTC()}, err
|
||||
}
|
||||
|
||||
var _ azcore.TokenCredential = (*ManagedIdentityCredential)(nil)
|
||||
68
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/username_password_credential.go
generated
vendored
Normal file
68
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/username_password_credential.go
generated
vendored
Normal file
@@ -0,0 +1,68 @@
|
||||
//go:build go1.18
|
||||
// +build go1.18
|
||||
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
package azidentity
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
|
||||
"github.com/AzureAD/microsoft-authentication-library-for-go/apps/public"
|
||||
)
|
||||
|
||||
const credNameUserPassword = "UsernamePasswordCredential"
|
||||
|
||||
// UsernamePasswordCredentialOptions contains optional parameters for UsernamePasswordCredential.
|
||||
type UsernamePasswordCredentialOptions struct {
|
||||
azcore.ClientOptions
|
||||
}
|
||||
|
||||
// UsernamePasswordCredential authenticates a user with a password. Microsoft doesn't recommend this kind of authentication,
|
||||
// because it's less secure than other authentication flows. This credential is not interactive, so it isn't compatible
|
||||
// with any form of multi-factor authentication, and the application must already have user or admin consent.
|
||||
// This credential can only authenticate work and school accounts; it can't authenticate Microsoft accounts.
|
||||
type UsernamePasswordCredential struct {
|
||||
client publicClient
|
||||
username string
|
||||
password string
|
||||
account public.Account
|
||||
}
|
||||
|
||||
// NewUsernamePasswordCredential creates a UsernamePasswordCredential. clientID is the ID of the application the user
|
||||
// will authenticate to. Pass nil for options to accept defaults.
|
||||
func NewUsernamePasswordCredential(tenantID string, clientID string, username string, password string, options *UsernamePasswordCredentialOptions) (*UsernamePasswordCredential, error) {
|
||||
if options == nil {
|
||||
options = &UsernamePasswordCredentialOptions{}
|
||||
}
|
||||
c, err := getPublicClient(clientID, tenantID, &options.ClientOptions)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &UsernamePasswordCredential{username: username, password: password, client: c}, nil
|
||||
}
|
||||
|
||||
// GetToken requests an access token from Azure Active Directory. This method is called automatically by Azure SDK clients.
|
||||
func (c *UsernamePasswordCredential) GetToken(ctx context.Context, opts policy.TokenRequestOptions) (azcore.AccessToken, error) {
|
||||
if len(opts.Scopes) == 0 {
|
||||
return azcore.AccessToken{}, errors.New(credNameUserPassword + ": GetToken() requires at least one scope")
|
||||
}
|
||||
ar, err := c.client.AcquireTokenSilent(ctx, opts.Scopes, public.WithSilentAccount(c.account))
|
||||
if err == nil {
|
||||
logGetTokenSuccess(c, opts)
|
||||
return azcore.AccessToken{Token: ar.AccessToken, ExpiresOn: ar.ExpiresOn.UTC()}, err
|
||||
}
|
||||
ar, err = c.client.AcquireTokenByUsernamePassword(ctx, opts.Scopes, c.username, c.password)
|
||||
if err != nil {
|
||||
return azcore.AccessToken{}, newAuthenticationFailedErrorFromMSALError(credNameUserPassword, err)
|
||||
}
|
||||
c.account = ar.Account
|
||||
logGetTokenSuccess(c, opts)
|
||||
return azcore.AccessToken{Token: ar.AccessToken, ExpiresOn: ar.ExpiresOn.UTC()}, err
|
||||
}
|
||||
|
||||
var _ azcore.TokenCredential = (*UsernamePasswordCredential)(nil)
|
||||
15
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/version.go
generated
vendored
Normal file
15
vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/version.go
generated
vendored
Normal file
@@ -0,0 +1,15 @@
|
||||
//go:build go1.18
|
||||
// +build go1.18
|
||||
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
package azidentity
|
||||
|
||||
const (
|
||||
// UserAgent is the string to be used in the user agent string when making requests.
|
||||
component = "azidentity"
|
||||
|
||||
// Version is the semantic version (see http://semver.org) of this module.
|
||||
version = "v1.2.1"
|
||||
)
|
||||
Reference in New Issue
Block a user