Merge dev into master (#545)

* Deserialize additionalInfo in ARM error * Allow a new authorizer to be created from a configuration file by specifying a resource instead of a base url. This enables resource like KeyVault and Container Registry to use an authorizer configured from a configuration file. * [WIP] Using the Context from the timeout if provided (#315) * Using the timeout from the context if available - Makes PollingDuration optional * Renaming the registration start time * Making PollingDuration not a pointer * fixing a broken reference * Add NewAuthorizerFromCli method which uses Azure CLI to obtain a token for the currently logged in user, for local development scenarios. (#316) * Adding User assigned identity support for the MSIConfig authorizor (#332) * Adding ByteSlicePtr (#399) * Adding a new `WithXML` method (#402) * Add HTTP status code response helpers (#403) Added IsHTTPStatus() and HasHTTPStatus() methods to autorest.Response * adding a new preparer for `MERGE` used in the Storage API's (#406) * New Preparer/Responder for `Unmarshalling Bytes` (#407) * New Preparer: WithBytes * New Responder: `ByUnmarshallingBytes` * Reusing the bytes, rather than copying them * Fixing the broken test / switching to read the bytes directly * Support HTTP-Date in Retry-After header (#410) RFC specifies Retry-After header can be integer value expressing seconds or an HTTP-Date indicating when to try again. Removed superfluous check for HTTP status code. * Add support for multi-tenant authentication (#412) * Add support for multi-tenant authentication Support for multi-tenant via x-ms-authorization-auxiliary header has been added for client credentials with secret scenario; this basically bundles multiple OAuthConfig and ServicePrincipalToken types into corresponding MultiTenant* types along with a new authorizer that adds the primary and auxiliary token headers to the reqest. The authenticaion helpers have been updated to support this scenario; if environment var AZURE_AUXILIARY_TENANT_IDS is set with a semicolon delimited list of tenants the multi-tenant codepath will kick in to create the appropriate authorizer. * feedback * rename Options to OAuthOptions (#415) * Support custom SendDecorator chains via context (#417) * Support custom SendDecorator chains via context Added `autorest.WithSendDecorators` and `autorest.GetSendDecorators` for adding and retrieving a custom chain of SendDecorators to the provided context. Added `autorest.DoRetryForStatusCodesWithCap` and `autorest.DelayForBackoffWithCap` to enforce an upper bound on the duration between retries. Fixed up some code comments. * small refactor based on PR feedback * remove some changes for dev branch * merge master into dev (#427) * v12.3.0 (#418) * Deserialize additionalInfo in ARM error * Allow a new authorizer to be created from a configuration file by specifying a resource instead of a base url. This enables resource like KeyVault and Container Registry to use an authorizer configured from a configuration file. * [WIP] Using the Context from the timeout if provided (#315) * Using the timeout from the context if available - Makes PollingDuration optional * Renaming the registration start time * Making PollingDuration not a pointer * fixing a broken reference * Add NewAuthorizerFromCli method which uses Azure CLI to obtain a token for the currently logged in user, for local development scenarios. (#316) * Adding User assigned identity support for the MSIConfig authorizor (#332) * Adding ByteSlicePtr (#399) * Adding a new `WithXML` method (#402) * Add HTTP status code response helpers (#403) Added IsHTTPStatus() and HasHTTPStatus() methods to autorest.Response * adding a new preparer for `MERGE` used in the Storage API's (#406) * New Preparer/Responder for `Unmarshalling Bytes` (#407) * New Preparer: WithBytes * New Responder: `ByUnmarshallingBytes` * Reusing the bytes, rather than copying them * Fixing the broken test / switching to read the bytes directly * Support HTTP-Date in Retry-After header (#410) RFC specifies Retry-After header can be integer value expressing seconds or an HTTP-Date indicating when to try again. Removed superfluous check for HTTP status code. * Add support for multi-tenant authentication (#412) * Add support for multi-tenant authentication Support for multi-tenant via x-ms-authorization-auxiliary header has been added for client credentials with secret scenario; this basically bundles multiple OAuthConfig and ServicePrincipalToken types into corresponding MultiTenant* types along with a new authorizer that adds the primary and auxiliary token headers to the reqest. The authenticaion helpers have been updated to support this scenario; if environment var AZURE_AUXILIARY_TENANT_IDS is set with a semicolon delimited list of tenants the multi-tenant codepath will kick in to create the appropriate authorizer. * feedback * rename Options to OAuthOptions (#415) * Support custom SendDecorator chains via context (#417) * Support custom SendDecorator chains via context Added `autorest.WithSendDecorators` and `autorest.GetSendDecorators` for adding and retrieving a custom chain of SendDecorators to the provided context. Added `autorest.DoRetryForStatusCodesWithCap` and `autorest.DelayForBackoffWithCap` to enforce an upper bound on the duration between retries. Fixed up some code comments. * small refactor based on PR feedback * remove some changes for dev branch * v12.3.0 * add yaml file for azure devops CI (#419) * add status badge for azure devops CI (#420) * enable build and test on linux (#421) * enable build and test on linux * fail on first error and use portable std* * update test to run on devops * Refactor azure devops pipeline (#422) Break monolithic script into separate scripts with useful names. Moved formatting checks to the end with succeededOrFailed conditions. * remove travis artifacts (#423) * remove unnecessary trigger section from devops (#424) * Use accessTokens.json from AZURE_CONFIG_DIR if AZURE_ACCESS_TOKEN_FILE is not set before falling back on ~/.azure/ (#471) * support for parsing error messages from xml responses (#465) * support for parsing error messages from xml responses * fixing the linting * removed some duplicate code * fix bug introduced in refactoring * added XML test and fixed bug it uncovered * fix godoc comment for methods that are safe for concurrent use (#475) * New Authorizers for Azure Storage (#416) * Authorizers for Blob, File, Queue and Table Storage * Adding a SharedKey authorizer * refactor based on existing storage implementation * add missing storage emulator account name * replace hard-coded strings with constants * changed to by-ref * Adding a new Authorizer for SAS Token Authentication (#478) * Adding a new Authorizer for SAS Token Authentication This commit introduces a new Authorizer for authenticating with Blob Storage using a SAS Token ``` $ go test -v ./autorest/ -run="TestSas" === RUN TestSasNewSasAuthorizerEmptyToken --- PASS: TestSasNewSasAuthorizerEmptyToken (0.00s) === RUN TestSasNewSasAuthorizerEmptyTokenWithWhitespace --- PASS: TestSasNewSasAuthorizerEmptyTokenWithWhitespace (0.00s) === RUN TestSasNewSasAuthorizerValidToken --- PASS: TestSasNewSasAuthorizerValidToken (0.00s) === RUN TestSasAuthorizerRequest --- PASS: TestSasAuthorizerRequest (0.00s) authorization_sas_test.go:76: [DEBUG] Testing Case "empty querystring without a prefix".. authorization_sas_test.go:76: [DEBUG] Testing Case "empty querystring with a prefix".. authorization_sas_test.go:76: [DEBUG] Testing Case "existing querystring without a prefix".. authorization_sas_test.go:76: [DEBUG] Testing Case "existing querystring with a prefix".. PASS ok github.com/Azure/go-autorest/autorest 0.011s ``` * minor clean-up * token: support for a custom refresh func (#476) * token: support for a custom refresh func * pass closures by value * minor clean-up * Fix Dropped Errors (#480) * autorest: fix dropped errror * autorest/adal: fix dropped test error * Duration order consistency when multiplying number by time unit (#499) * Drain response bodies (#432) The retry helpers and a few other methods weren't reading and closing response bodies leading to connection leaks. * Enable exponential back-off when retrying on 429 (#503) * Enable exponential back-off when retrying on 429 * enforce a 2-minute cap on delays if there isn't one * updated comment * fix type-o * Expose OAuth token provider for use outside autorest (#520) * feat: extract token creation to public method for MSI auth * Add getter for token provider on BearerAuthorizer * Fix Go module ambiguous import errors (#528) * Fix Go module ambiguous import errors This is an extension of the mitigations introduced in #455. Unfortunately, the original mitigations didn't address the primary cause of ambiguous import errors: the github.com/Azure/go-autorest module. The issue stems from the fact that old versions of the root module (github.com/Azure/go-autorest) provide the same packages as the newer submodules. To correct this situation, the _root module_ needs to be upgraded to a version that no longer provides those packages (a version where the submodules are present). Fortunately, the submodules can be leveraged to provide the necessary version bump. See: #414 (comment) ---- Caveat: in order for this to work, an importable version of the root package needs to be referenceable. PR #527 makes the root package importable. The go.mod files assume that this importable version will be referenceable as v14.2.0. If the version where the importable package is available ends up being different, these files will need to be updated. See also: #395, #413, #414, #455, #481, #524 * Update go.sum files Co-authored-by: Joel Hendrix <jhendrix@microsoft.com> * Update resourceManagerVMDNSSuffix for AzureUSGovernmentCloud (#531) * This endpoint changed in AzureChinaCloud (#530) See from Azurre China portal - this is now cloudapp.chinacloudapi.cn * allow MSI login with "mi_res_id" (#544) * allow login with resourceID * test * tweaks * fix * tested with cmd * fix unittest * add new test, remove debug trace * fix unittest * fix with url encode Co-authored-by: Jin Soon Lim <jilim@microsoft.com> Co-authored-by: Nick Muller <muller_nicky@hotmail.com> Co-authored-by: Tom Harvey <tombuildsstuff@users.noreply.github.com> Co-authored-by: Sam Kreter <samkreter@gmail.com> Co-authored-by: Delyan Raychev <49918230+draychev@users.noreply.github.com> Co-authored-by: Patrick Decat <pdecat@gmail.com> Co-authored-by: Tony Abboud <tdabboud@hotmail.com> Co-authored-by: Lars Lehtonen <lars.lehtonen@gmail.com> Co-authored-by: Maxim Fominykh <vominyh@yandex.ru> Co-authored-by: alespour <42931850+alespour@users.noreply.github.com> Co-authored-by: Mark Severson <miquella@gmail.com> Co-authored-by: Panic Stevenson <panic.stevenson@gmail.com> Co-authored-by: Mauro Giusti <MaurGi@users.noreply.github.com> Co-authored-by: Haitao Chen <haitch@users.noreply.github.com>
Azure · Aug 7, 2020 · 8f84370 · 8f84370
1 parent 1de1c25
commit 8f84370
Show file tree

Hide file tree

Showing 3 changed files with 135 additions and 14 deletions.
diff --git a/autorest/adal/cmd/adal.go b/autorest/adal/cmd/adal.go
@@ -31,10 +31,13 @@ import (
 )
 
 const (
-	deviceMode       = "device"
-	clientSecretMode = "secret"
-	clientCertMode   = "cert"
-	refreshMode      = "refresh"
+	deviceMode        = "device"
+	clientSecretMode  = "secret"
+	clientCertMode    = "cert"
+	refreshMode       = "refresh"
+	msiDefaultMode    = "msiDefault"
+	msiClientIDMode   = "msiClientID"
+	msiResourceIDMode = "msiResourceID"
 
 	activeDirectoryEndpoint = "https://login.microsoftonline.com/"
 )
@@ -48,8 +51,9 @@ var (
 	mode     string
 	resource string
 
-	tenantID      string
-	applicationID string
+	tenantID           string
+	applicationID      string
+	identityResourceID string
 
 	applicationSecret string
 	certificatePath   string
@@ -82,10 +86,28 @@ func init() {
 	flag.StringVar(&applicationSecret, "secret", "", "application secret")
 	flag.StringVar(&certificatePath, "certificatePath", "", "path to pk12/PFC application certificate")
 	flag.StringVar(&tokenCachePath, "tokenCachePath", defaultTokenCachePath(), "location of oath token cache")
+	flag.StringVar(&identityResourceID, "identityResourceID", "", "managedIdentity azure resource id")
 
 	flag.Parse()
 
 	switch mode = strings.TrimSpace(mode); mode {
+	case msiDefaultMode:
+		checkMandatoryOptions(msiDefaultMode,
+			option{name: "resource", value: resource},
+			option{name: "tenantId", value: tenantID},
+		)
+	case msiClientIDMode:
+		checkMandatoryOptions(msiClientIDMode,
+			option{name: "resource", value: resource},
+			option{name: "tenantId", value: tenantID},
+			option{name: "applicationId", value: applicationID},
+		)
+	case msiResourceIDMode:
+		checkMandatoryOptions(msiResourceIDMode,
+			option{name: "resource", value: resource},
+			option{name: "tenantId", value: tenantID},
+			option{name: "identityResourceID", value: identityResourceID},
+		)
 	case clientSecretMode:
 		checkMandatoryOptions(clientSecretMode,
 			option{name: "resource", value: resource},
@@ -150,6 +172,42 @@ func decodePkcs12(pkcs []byte, password string) (*x509.Certificate, *rsa.Private
 	return certificate, rsaPrivateKey, nil
 }
 
+func acquireTokenMSIFlow(applicationID string,
+	identityResourceID string,
+	resource string,
+	callbacks ...adal.TokenRefreshCallback) (*adal.ServicePrincipalToken, error) {
+
+	// only one of them can be present:
+	if applicationID != "" && identityResourceID != "" {
+		return nil, fmt.Errorf("didn't expect applicationID and identityResourceID at same time")
+	}
+
+	msiEndpoint, _ := adal.GetMSIVMEndpoint()
+	var spt *adal.ServicePrincipalToken
+	var err error
+
+	// both can be empty, systemAssignedMSI scenario
+	if applicationID == "" && identityResourceID == "" {
+		spt, err = adal.NewServicePrincipalTokenFromMSI(msiEndpoint, resource, callbacks...)
+	}
+
+	// msi login with clientID
+	if applicationID != "" {
+		spt, err = adal.NewServicePrincipalTokenFromMSIWithUserAssignedID(msiEndpoint, resource, applicationID, callbacks...)
+	}
+
+	// msi login with resourceID
+	if identityResourceID != "" {
+		spt, err = adal.NewServicePrincipalTokenFromMSIWithIdentityResourceID(msiEndpoint, resource, identityResourceID, callbacks...)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return spt, spt.Refresh()
+}
+
 func acquireTokenClientCertFlow(oauthConfig adal.OAuthConfig,
 	applicationID string,
 	applicationCertPath string,
@@ -283,6 +341,20 @@ func main() {
 		if err == nil {
 			err = saveToken(spt.Token())
 		}
+	case msiResourceIDMode:
+		fallthrough
+	case msiClientIDMode:
+		fallthrough
+	case msiDefaultMode:
+		var spt *adal.ServicePrincipalToken
+		spt, err = acquireTokenMSIFlow(
+			applicationID,
+			identityResourceID,
+			resource,
+			callback)
+		if err == nil {
+			err = saveToken(spt.Token())
+		}
 	case refreshMode:
 		_, err = refreshToken(
 			*oauthConfig,

diff --git a/autorest/adal/token.go b/autorest/adal/token.go
@@ -678,16 +678,22 @@ func GetMSIEndpoint() (string, error) {
 // NewServicePrincipalTokenFromMSI creates a ServicePrincipalToken via the MSI VM Extension.
 // It will use the system assigned identity when creating the token.
 func NewServicePrincipalTokenFromMSI(msiEndpoint, resource string, callbacks ...TokenRefreshCallback) (*ServicePrincipalToken, error) {
-	return newServicePrincipalTokenFromMSI(msiEndpoint, resource, nil, callbacks...)
+	return newServicePrincipalTokenFromMSI(msiEndpoint, resource, nil, nil, callbacks...)
 }
 
 // NewServicePrincipalTokenFromMSIWithUserAssignedID creates a ServicePrincipalToken via the MSI VM Extension.
-// It will use the specified user assigned identity when creating the token.
+// It will use the clientID of specified user assigned identity when creating the token.
 func NewServicePrincipalTokenFromMSIWithUserAssignedID(msiEndpoint, resource string, userAssignedID string, callbacks ...TokenRefreshCallback) (*ServicePrincipalToken, error) {
-	return newServicePrincipalTokenFromMSI(msiEndpoint, resource, &userAssignedID, callbacks...)
+	return newServicePrincipalTokenFromMSI(msiEndpoint, resource, &userAssignedID, nil, callbacks...)
 }
 
-func newServicePrincipalTokenFromMSI(msiEndpoint, resource string, userAssignedID *string, callbacks ...TokenRefreshCallback) (*ServicePrincipalToken, error) {
+// NewServicePrincipalTokenFromMSIWithIdentityResourceID creates a ServicePrincipalToken via the MSI VM Extension.
+// It will use the azure resource id of user assigned identity when creating the token.
+func NewServicePrincipalTokenFromMSIWithIdentityResourceID(msiEndpoint, resource string, identityResourceID string, callbacks ...TokenRefreshCallback) (*ServicePrincipalToken, error) {
+	return newServicePrincipalTokenFromMSI(msiEndpoint, resource, nil, &identityResourceID, callbacks...)
+}
+
+func newServicePrincipalTokenFromMSI(msiEndpoint, resource string, userAssignedID *string, identityResourceID *string, callbacks ...TokenRefreshCallback) (*ServicePrincipalToken, error) {
 	if err := validateStringParam(msiEndpoint, "msiEndpoint"); err != nil {
 		return nil, err
 	}
@@ -699,6 +705,11 @@ func newServicePrincipalTokenFromMSI(msiEndpoint, resource string, userAssignedI
 			return nil, err
 		}
 	}
+	if identityResourceID != nil {
+		if err := validateStringParam(*identityResourceID, "identityResourceID"); err != nil {
+			return nil, err
+		}
+	}
 	// We set the oauth config token endpoint to be MSI's endpoint
 	msiEndpointURL, err := url.Parse(msiEndpoint)
 	if err != nil {
@@ -716,6 +727,9 @@ func newServicePrincipalTokenFromMSI(msiEndpoint, resource string, userAssignedI
 	if userAssignedID != nil {
 		v.Set("client_id", *userAssignedID)
 	}
+	if identityResourceID != nil {
+		v.Set("mi_res_id", *identityResourceID)
+	}
 	msiEndpointURL.RawQuery = v.Encode()
 
 	spt := &ServicePrincipalToken{

diff --git a/autorest/adal/token_test.go b/autorest/adal/token_test.go
@@ -694,7 +694,7 @@ func TestServicePrincipalTokenManualRefreshFailsWithoutRefresh(t *testing.T) {
 }
 
 func TestNewServicePrincipalTokenFromMSI(t *testing.T) {
-	resource := "https://resource"
+	const resource = "https://resource"
 	cb := func(token Token) error { return nil }
 
 	spt, err := NewServicePrincipalTokenFromMSI("http://msiendpoint/", resource, cb)
@@ -717,8 +717,10 @@ func TestNewServicePrincipalTokenFromMSI(t *testing.T) {
 }
 
 func TestNewServicePrincipalTokenFromMSIWithUserAssignedID(t *testing.T) {
-	resource := "https://resource"
-	userID := "abc123"
+	const (
+		resource = "https://resource"
+		userID   = "abc123"
+	)
 	cb := func(token Token) error { return nil }
 
 	spt, err := NewServicePrincipalTokenFromMSIWithUserAssignedID("http://msiendpoint/", resource, userID, cb)
@@ -744,6 +746,39 @@ func TestNewServicePrincipalTokenFromMSIWithUserAssignedID(t *testing.T) {
 	}
 }
 
+func TestNewServicePrincipalTokenFromMSIWithIdentityResourceID(t *testing.T) {
+	const (
+		resource           = "https://resource"
+		identityResourceID = "/subscriptions/testSub/resourceGroups/testGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/test-identity"
+	)
+	cb := func(token Token) error { return nil }
+
+	spt, err := NewServicePrincipalTokenFromMSIWithIdentityResourceID("http://msiendpoint/", resource, identityResourceID, cb)
+	if err != nil {
+		t.Fatalf("Failed to get MSI SPT: %v", err)
+	}
+
+	// check some of the SPT fields
+	if _, ok := spt.inner.Secret.(*ServicePrincipalMSISecret); !ok {
+		t.Fatal("SPT secret was not of MSI type")
+	}
+
+	if spt.inner.Resource != resource {
+		t.Fatal("SPT came back with incorrect resource")
+	}
+
+	if len(spt.refreshCallbacks) != 1 {
+		t.Fatal("SPT had incorrect refresh callbacks.")
+	}
+
+	urlPathParameter := url.Values{}
+	urlPathParameter.Set("mi_res_id", identityResourceID)
+
+	if !strings.Contains(spt.inner.OauthConfig.TokenEndpoint.RawQuery, urlPathParameter.Encode()) {
+		t.Fatal("SPT tokenEndpoint should contains mi_res_id")
+	}
+}
+
 func TestNewServicePrincipalTokenFromManualTokenSecret(t *testing.T) {
 	token := newToken()
 	secret := &ServicePrincipalAuthorizationCodeSecret{
@@ -895,7 +930,7 @@ func TestMarshalServicePrincipalCertificateSecret(t *testing.T) {
 }
 
 func TestMarshalServicePrincipalMSISecret(t *testing.T) {
-	spt, err := newServicePrincipalTokenFromMSI("http://msiendpoint/", "https://resource", nil)
+	spt, err := newServicePrincipalTokenFromMSI("http://msiendpoint/", "https://resource", nil, nil)
 	if err != nil {
 		t.Fatalf("failed to get MSI SPT: %+v", err)
 	}