Added OIDC support for login action #147

BALAGA-GAYATRI · 2021-10-06T16:09:50Z

No description provided.

vineetmimrot · 2021-10-06T17:11:28Z

src/main.ts

+        //Check for the credentials in individual parameters in the workflow.
+        var servicePrincipalId = core.getInput('client-id', { required: false });;
+        var servicePrincipalKey = null;
+        var tenantId = core.getInput('tenant-id', { required: false });
+        var subscriptionId = core.getInput('subscription-id', { required: false });
+        var resourceManagerEndpointUrl = "https://management.azure.com/";
+        var enableOIDC= true;
+        // If any of the individual credentials (clent_id, tenat_id, subscription_id) are  missing
+        if(!servicePrincipalId || !tenantId || !(subscriptionId || allowNoSubscriptionsLogin)){
+            //If all of the individual credentials (clent_id, tenat_id, subscription_id) are missing in workflow inputs, checking for creds object.
+            if(!servicePrincipalId && !tenantId && (!subscriptionId || !allowNoSubscriptionsLogin)){
+                console.log('checking line 55 condition..')
+                if(creds) {
+                    console.log('using creds JSON...')
+                    enableOIDC = false;
+                    servicePrincipalId = secrets.getSecret("$.clientId", true);
+                    servicePrincipalKey= secrets.getSecret("$.clientSecret", true);
+                    tenantId = secrets.getSecret("$.tenantId", true);
+                    subscriptionId = secrets.getSecret("$.subscriptionId", true);
+                    resourceManagerEndpointUrl = secrets.getSecret("$.resourceManagerEndpointUrl", false);
+                }
+                else{
+                    throw new Error("Credentials are not passed for Login action."); 
+                }           
+            }
+            //If any few of the individual credentials are missing
+            else
+                throw new Error("Few credentials are missing.ClientId,tenantId are mandatory. SubscriptionId is also mandatory if allow-no-subscriptions is not set."); 
+        }        


Put it into a factory pattern. Your code will be much cleaner with no if/else conditions you have used below for enableOIDC check.

src/main.ts

…idc-support

lib/main.js

kaverma · 2021-10-07T09:34:37Z

lib/main.js

-            if (!servicePrincipalId || !servicePrincipalKey || !tenantId) {
-                throw new Error("Not all values are present in the creds object. Ensure clientId, clientSecret and tenantId are supplied.");
+            //Check for the credentials in individual parameters in the workflow.
+            var servicePrincipalId = core.getInput('client-id', { required: false });


should we name this var as clientId only to be same as Input name

This is as per previous design only. clientID is treated as serviceprincipalId and clientSecret as serviceprincipalKey.

kaverma · 2021-10-07T09:34:56Z

lib/main.js

+            var servicePrincipalKey = null;
+            var tenantId = core.getInput('tenant-id', { required: false });
+            var subscriptionId = core.getInput('subscription-id', { required: false });
+            var resourceManagerEndpointUrl = "https://management.azure.com/";


is this fixed?

Yes. For other clouds it is different. For public cloud it is constant.

kaverma · 2021-10-07T09:35:37Z

lib/main.js

+            var subscriptionId = core.getInput('subscription-id', { required: false });
+            var resourceManagerEndpointUrl = "https://management.azure.com/";
+            var enableOIDC = true;
+            // If any of the individual credentials (clent_id, tenat_id, subscription_id) are  missing


nit: please add newlines for formatting, readability.

kaverma · 2021-10-07T09:41:06Z

lib/main.js

+            var servicePrincipalId = core.getInput('client-id', { required: false });
+            ;
+            var servicePrincipalKey = null;
+            var tenantId = core.getInput('tenant-id', { required: false });


Should these also be individual secrets like in creds object?

vineetmimrot · 2021-10-07T11:42:11Z

src/main.ts

    execOptions.silent = !!silent;
    try {
-        await exec.exec(`"${azPath}" ${command}`, args,  execOptions); 
+        core.debug(args);


You shouldn't put log here, it may expose credentials if it doesn't get masked by GitHub runner.

removed 👍🏻

vineetmimrot · 2021-10-07T11:45:19Z

src/main.ts

+            var args = [];
+            if (enableOIDC) {
+                args = [
+                    "--allow-no-subscriptions",


You can create a base args array that contains common keys and based on the specific parameter values you can append to it.
Like if allowNoSubscriptionsLogin is true -> append "--allow-no-subscriptions" to args, same for other keys.

vineetmimrot · 2021-10-07T11:51:23Z

src/main.ts

+                if (enableAzPSSession)
+                    throw new Error(`Powershell login is not supported with OIDC.`);
+            } else {
+                throw new Error("Could not get ID token for authentication.");


Does OIDC send some error message in case of failure. if it is we should also show that to users, so user can debug the error. Here user can be clueless, what has gone wrong and he can't debug.

vineetmimrot · 2021-10-07T12:01:26Z

src/main.ts

+        if (!servicePrincipalId || !tenantId || !(subscriptionId || allowNoSubscriptionsLogin)) {
+            //If all of the individual credentials (clent_id, tenat_id, subscription_id) are missing in workflow inputs, checking for creds object.
+            if (!servicePrincipalId && !tenantId && (!subscriptionId || !allowNoSubscriptionsLogin)) {
+                if (creds) {


What if the user has passed some parameters as inputs and some under creds object? As per your code, it will go for creds object which is ok. But Should we let users pass parameters to both?

vineetmimrot · 2021-10-11T05:36:32Z

lib/main.js

+            var commonArgs = ["--service-principal",
+                "-u", servicePrincipalId,
+                "--tenant", tenantId
+            ];
            if (allowNoSubscriptionsLogin) {


Suggested change

if (allowNoSubscriptionsLogin) {

if (allowNoSubscriptionsLogin) {

commonArgs = commonArgs.concat("--allow-no-subscriptions");

}

if (enableOIDC) {

commonArgs = commonArgs.concat("--federated-token", idToken);

}

else {

commonArgs = commonArgs.concat("-p", servicePrincipalKey);

}

yield executeAzCliCommand(`login`, true, {}, commonArgs);

How about this @BALAGA-GAYATRI

* Added OIDC support for login action (#147) * OIDC support for Powershell login (#156) * OIDC support ps (#155) ps login support * Update main.ts * formatting code * nit changes Co-authored-by: Balaga Gayatri <[email protected]>

BALAGA-GAYATRI added 30 commits September 28, 2021 11:57

added oidc support

18604fb

changes

ad1e1bc

changes

31413bf

added oidc support

66969bb

changes

6a8dff2

changes

7b59ab5

debug

c145ca6

changes

066acfd

chages

4dd34ea

changes

a897d9e

Update main.ts

c0f045f

..

45e70a2

changes

ade5ff8

end to end changes

e7b55e8

end to end changes

62804f4

end to end changes

e3b2d7a

end to end changes

0393c28

end to end changes

bf7afc0

end to end changes

a72df0a

end to end changes

fa4c64b

end to end changes

762d20c

end to end changes

5da3d81

changes

40fbf75

changes

c10c739

changes in login actiom

424bdd8

changes

dc8e4aa

changes

b329991

changes

5bb957b

changes

91541b5

changes

eb0e857

Update main.ts

f6ea870

vineetmimrot reviewed Oct 6, 2021

View reviewed changes

src/main.ts Outdated Show resolved Hide resolved

BALAGA-GAYATRI added 3 commits October 6, 2021 22:57

changes

8e289ca

Merge branch 'oidc-support' of github.com:BALAGA-GAYATRI/login into o…

b2a6a0d

…idc-support

changes

638cdd8

kaverma reviewed Oct 7, 2021

View reviewed changes

lib/main.js Outdated Show resolved Hide resolved

kaverma reviewed Oct 7, 2021

View reviewed changes

lib/main.js Show resolved Hide resolved

updating js

a114662

kaverma reviewed Oct 7, 2021

View reviewed changes

BALAGA-GAYATRI added 3 commits October 7, 2021 15:41

updating error messages

d75607c

updating error messages

00b5c81

nit changes

9fc877e

vineetmimrot reviewed Oct 7, 2021

View reviewed changes

kaverma requested a review from Josh-01 October 8, 2021 12:15

BALAGA-GAYATRI added 2 commits October 8, 2021 20:37

using common arguments

6a28cf1

using common arguments

e2ba17e

vineetmimrot reviewed Oct 11, 2021

View reviewed changes

BALAGA-GAYATRI added 3 commits October 11, 2021 12:49

refactoring code

21c0c36

refactoring code

f38bcfa

refactoring code

e0eb61a

BALAGA-GAYATRI merged commit a4b1865 into Azure:oidc-support Oct 11, 2021

jiasli mentioned this pull request Apr 8, 2024

Azure CLI task fails with AADSTS700024 after 60 minutes Azure/azure-cli#28708

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added OIDC support for login action #147

Added OIDC support for login action #147

BALAGA-GAYATRI commented Oct 6, 2021

vineetmimrot Oct 6, 2021

kaverma Oct 7, 2021

BALAGA-GAYATRI Oct 7, 2021

kaverma Oct 7, 2021

BALAGA-GAYATRI Oct 7, 2021

kaverma Oct 7, 2021

BALAGA-GAYATRI Oct 7, 2021

kaverma Oct 7, 2021

vineetmimrot Oct 7, 2021

BALAGA-GAYATRI Oct 8, 2021

vineetmimrot Oct 7, 2021

BALAGA-GAYATRI Oct 8, 2021

vineetmimrot Oct 7, 2021

vineetmimrot Oct 7, 2021

vineetmimrot Oct 11, 2021

vineetmimrot Oct 11, 2021

-            if (allowNoSubscriptionsLogin) {
+            if (allowNoSubscriptionsLogin) {
+                 commonArgs = commonArgs.concat("--allow-no-subscriptions");
+            }
+            if (enableOIDC) {
+               commonArgs = commonArgs.concat("--federated-token", idToken);
+            }
+            else {
+                commonArgs = commonArgs.concat("-p", servicePrincipalKey);
+            }
+            yield executeAzCliCommand(`login`, true, {}, commonArgs);

Added OIDC support for login action #147

Added OIDC support for login action #147

Conversation

BALAGA-GAYATRI commented Oct 6, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment