Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Migrate RP from Azure AD Graph to Microsoft Graph #1970

Merged
merged 12 commits into from
Jun 14, 2023
+1,326,042 −12,109
Merged

Migrate RP from Azure AD Graph to Microsoft Graph #1970

Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
5125f08
go.mod: Add github.com/microsoftgraph/msgraph-sdk-go
mbarnes Feb 9, 2023
8729401
azureclient: Add NewGraphServiceClient
mbarnes Mar 2, 2023
25fee28
pkg/util/graph: Add GetServicePrincipalIDByAppID
mbarnes Mar 2, 2023
e9765db
armhelper: Use MS Graph to obtain service principal ID
mbarnes Feb 10, 2023
96d3a73
armhelper: Remove unused authorizer parameter
mbarnes Mar 1, 2023
b9e878c
Use MS Graph endpoint to validate service principal
mbarnes Mar 2, 2023
6de830a
pkg/cluster: Use MS Graph to obtain service principal ID
mbarnes Feb 9, 2023
bcb2cb9
pkg/util/cluster: Use MS Graph to create and delete clusters
mbarnes Feb 14, 2023
7257d6c
Pretty-print OData errors from MS Graph
mbarnes Feb 21, 2023
5af68ff
azureclient: Remove ActiveDirectoryGraphScope
mbarnes Apr 4, 2023
dd4f4a6
Remove pkg/util/azureclient/graphrbac
mbarnes Feb 17, 2023
643ff9e
pipelines: Run CodeQL analysis for Go on 1ES Hosted Pool
mbarnes Mar 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 17 additions & 6 deletions pkg/env/armhelper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ package env

import (
"context"
"fmt"
"os"

"github.com/Azure/azure-sdk-for-go/sdk/azcore"
Expand All @@ -14,10 +15,11 @@ import (
"github.com/Azure/go-autorest/autorest/azure"
"github.com/Azure/go-autorest/autorest/to"
"github.com/jongio/azidext/go/azidext"
msgraph "github.com/microsoftgraph/msgraph-sdk-go"
"github.com/sirupsen/logrus"

"github.com/Azure/ARO-RP/pkg/util/azureclient/graphrbac"
"github.com/Azure/ARO-RP/pkg/util/azureclient/mgmt/authorization"
utilgraph "github.com/Azure/ARO-RP/pkg/util/graph"
"github.com/Azure/ARO-RP/pkg/util/rbac"
"github.com/Azure/ARO-RP/pkg/util/uuid"
)
Expand Down Expand Up @@ -63,8 +65,8 @@ type armHelper struct {
log *logrus.Entry
env Interface

fpGraphClient *msgraph.GraphServiceClient
roleassignments authorization.RoleAssignmentsClient
applications graphrbac.ApplicationsClient
}

func newARMHelper(ctx context.Context, log *logrus.Entry, env Interface) (ARMHelper, error) {
bennerv marked this conversation as resolved.
Show resolved Hide resolved
Expand Down Expand Up @@ -104,7 +106,13 @@ func newARMHelper(ctx context.Context, log *logrus.Entry, env Interface) (ARMHel
scopes := []string{env.Environment().ResourceManagerScope}
armAuthorizer := azidext.NewTokenCredentialAdapter(tokenCredential, scopes)

fpGraphAuthorizer, err := env.FPAuthorizer(env.TenantID(), env.Environment().ActiveDirectoryGraphScope)
// Graph service client uses the first party service principal.
mbarnes marked this conversation as resolved.
Show resolved Hide resolved
tokenCredential, err = env.FPNewClientCertificateCredential(env.TenantID())
mbarnes marked this conversation as resolved.
Show resolved Hide resolved
if err != nil {
return nil, err
}

fpGraphClient, err := env.Environment().NewGraphServiceClient(tokenCredential)
if err != nil {
return nil, err
}
Expand All @@ -113,23 +121,26 @@ func newARMHelper(ctx context.Context, log *logrus.Entry, env Interface) (ARMHel
log: log,
env: env,

fpGraphClient: fpGraphClient,
roleassignments: authorization.NewRoleAssignmentsClient(env.Environment(), env.SubscriptionID(), armAuthorizer),
applications: graphrbac.NewApplicationsClient(env.Environment(), env.TenantID(), fpGraphAuthorizer),
}, nil
}

func (ah *armHelper) EnsureARMResourceGroupRoleAssignment(ctx context.Context, fpAuthorizer autorest.Authorizer, resourceGroup string) error {
ah.log.Print("ensuring resource group role assignment")

res, err := ah.applications.GetServicePrincipalsIDByAppID(ctx, ah.env.FPClientID())
principalID, err := utilgraph.GetServicePrincipalIDByAppID(ctx, ah.fpGraphClient, ah.env.FPClientID())
if err != nil {
return err
}
if principalID == nil {
return fmt.Errorf("no service principal found for application ID '%s'", ah.env.FPClientID())
bennerv marked this conversation as resolved.
Show resolved Hide resolved
}

_, err = ah.roleassignments.Create(ctx, "/subscriptions/"+ah.env.SubscriptionID()+"/resourceGroups/"+resourceGroup, uuid.DefaultGenerator.Generate(), mgmtauthorization.RoleAssignmentCreateParameters{
RoleAssignmentProperties: &mgmtauthorization.RoleAssignmentProperties{
RoleDefinitionID: to.StringPtr("/subscriptions/" + ah.env.SubscriptionID() + "/providers/Microsoft.Authorization/roleDefinitions/" + rbac.RoleOwner),
PrincipalID: res.Value,
PrincipalID: principalID,
},
})
if detailedErr, ok := err.(autorest.DetailedError); ok {
Expand Down