Upgrade our authentication library to support MSAL #1942

thomas11 · 2022-08-29T22:11:43Z

The latest version of hashicorp/go-azure-helpers/authentication supports the new MSAL authentication (#1566).

This PR also addresses #1565 by requiring the user to have a compatible version of the Azure CLI installed and printing an informative message if not. The corresponding documentation change is in pulumi/registry#1420.

Here's a test of the version handling, done by putting a shell script named az in my path that just prints some version.

➜  az version
{
  "azure-cli": "2.36.0"
}
➜  pulumi up
Previewing update (dev)
...
Diagnostics:
  azure-native:resources:ResourceGroup (resourceGroup):
    error: checking az version: found incompatible az version 2.36.0. Please make sure the Azure CLI 2.37 or greater, but less than 3.x, is installed.
 

➜  az version
{
  "azure-cli": "2.3.7"
}
➜  pulumi up 
Previewing update (dev)
...
Diagnostics:
  azure-native:resources:ResourceGroup (resourceGroup):
    error: checking az version: found incompatible az version 2.3.7. Please make sure the Azure CLI 2.37 or greater, but less than 3.x, is installed.
 

➜  pulumi up
Previewing update (dev)
...
Diagnostics:
  azure-native:resources:ResourceGroup (resourceGroup):
    error: checking az version: found incompatible az version 2.0.0. Please make sure the Azure CLI 2.37 or greater, but less than 3.x, is installed.
 

➜  pulumi up
Previewing update (dev)
...
Diagnostics:
  azure-native:resources:ResourceGroup (resourceGroup):
    error: checking az version: found incompatible az version 3.0.0. Please make sure the Azure CLI 2.37 or greater, but less than 3.x, is installed.
 

➜  mv ~/go/bin/az ~/go/bin/fake_az
➜  az version
{
  "azure-cli": "2.39.0",
  "azure-cli-core": "2.39.0",
  "azure-cli-telemetry": "1.0.6",
  "extensions": {}
}
➜  pulumi up                      
Previewing update (dev)
...
Resources:
    + 3 to create
Do you want to perform this update? no

➜  mv /opt/homebrew/bin/az /opt/homebrew/bin/aztemp
➜  az version
zsh: command not found: az
➜  pulumi up                                       
Previewing update (dev)
...
Diagnostics:
  azure-native:resources:ResourceGroup (resourceGroup):
    error: checking az version: could not find `az`. Please make sure the Azure CLI 2.37 or greater, but less than 3.x, is installed.

➜  mv /opt/homebrew/bin/aztemp /opt/homebrew/bin/az
➜  az version
{
  "azure-cli": "2.39.0",
  "azure-cli-core": "2.39.0",
  "azure-cli-telemetry": "1.0.6",
  "extensions": {}
}

github-actions · 2022-08-29T22:25:23Z

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.
Looking good! No API changes found.

lblackstone

Changes LGTM overall. Is this already tested as part of CI?

provider/pkg/provider/provider.go

github-actions · 2022-08-31T22:14:10Z

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.
Looking good! No API changes found.

github-actions · 2022-09-05T21:26:57Z

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.
Looking good! No API changes found.

provider/pkg/provider/provider.go

github-actions · 2022-09-07T02:39:25Z

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.
Looking good! No API changes found.

provider/pkg/provider/provider.go

guineveresaenger · 2022-09-07T23:31:47Z

I hooked this up to a local build for auth suggestions and it turns out my az CLI wasn't up to snuff, so the version verifier worked for me:

provider/pkg/provider/provider.go

github-actions · 2022-09-08T04:37:47Z

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.
Looking good! No API changes found.

mikhailshilkov · 2022-09-08T07:21:03Z

provider/pkg/provider/provider.go

+	}
+
+	if actual.LessThan(minAzVersion) || actual.GreaterThanOrEqual(nextMajorAzVersion) {
+		return fmt.Errorf("found incompatible az version %s. %s", actual, versionHint)


Will this break users on older CLI versions that currently work? Is this a breaking change that we can ship? Could we fall back to the old auth mechanism for older CLIs?

Don't know if there's a fallback option, but if the version is outside the expected range perhaps we could print a big warning but attempt to carry on?

CLI version 2.34 from March 1 2022 broke our users, like in #1565. Version 2.37 from May 24 2022 works again. The hashicorp/go-azure-helpers library only requires that the version is at least 2.0.81. So you're right @mikhailshilkov, we can actually allow versions between 2.0.81 and 2.33 and only exclude 2.34-2.36.

github-actions · 2022-09-08T19:41:40Z

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.
Looking good! No API changes found.

provider/pkg/provider/provider.go

danielrbradley

I think this is basically ready to merge. I've left a couple of suggestions around messages back to the user if something goes wrong:

Aim to point them to where to help themselves.
Include information so we could reason about exactly why failures happened based on their local system.

Having said that, these are all things that could be added later, so let's not delay too much as this will already be a huge step forward for many users!

github-actions · 2022-09-14T23:13:11Z

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.
Looking good! No API changes found.

github-actions · 2022-09-15T00:51:38Z

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.
Looking good! No API changes found.

github-actions · 2022-09-15T18:27:22Z

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.
Looking good! No API changes found.

github-actions · 2022-09-15T22:08:25Z

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.
Looking good! No API changes found.

github-actions · 2022-09-16T04:39:25Z

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.
Looking good! No API changes found.

github-actions · 2022-09-23T17:53:52Z

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.
Looking good! No API changes found.

thomas11 · 2023-03-31T20:51:08Z

Implemented by #2320

thomas11 requested review from stack72, danielrbradley, viveklak, lblackstone and jkisk August 29, 2022 22:11

lblackstone reviewed Aug 29, 2022

View reviewed changes

provider/pkg/provider/provider.go Outdated Show resolved Hide resolved

stack72 reviewed Aug 30, 2022

View reviewed changes

provider/pkg/provider/provider.go Outdated Show resolved Hide resolved

thomas11 force-pushed the tkappler/upgrade-azure-helpers branch from 4d08db8 to d101df4 Compare August 31, 2022 21:59

thomas11 force-pushed the tkappler/upgrade-azure-helpers branch from d101df4 to abd9328 Compare September 5, 2022 21:11

thomas11 force-pushed the tkappler/upgrade-azure-helpers branch from abd9328 to dc817a3 Compare September 6, 2022 21:48

thomas11 commented Sep 7, 2022

View reviewed changes

provider/pkg/provider/provider.go Show resolved Hide resolved

viveklak reviewed Sep 7, 2022

View reviewed changes

provider/pkg/provider/provider.go Outdated Show resolved Hide resolved

guineveresaenger reviewed Sep 7, 2022

View reviewed changes

provider/pkg/provider/provider.go Outdated Show resolved Hide resolved

viveklak reviewed Sep 7, 2022

View reviewed changes

thomas11 force-pushed the tkappler/upgrade-azure-helpers branch from dc817a3 to 755b29b Compare September 8, 2022 04:23

mikhailshilkov reviewed Sep 8, 2022

View reviewed changes

thomas11 force-pushed the tkappler/upgrade-azure-helpers branch from 755b29b to 08bbaa0 Compare September 8, 2022 19:25

danielrbradley reviewed Sep 9, 2022

View reviewed changes

provider/pkg/provider/provider.go Outdated Show resolved Hide resolved

danielrbradley reviewed Sep 9, 2022

View reviewed changes

provider/pkg/provider/provider.go Outdated Show resolved Hide resolved

danielrbradley reviewed Sep 9, 2022

View reviewed changes

danielrbradley approved these changes Sep 14, 2022

View reviewed changes

thomas11 force-pushed the tkappler/upgrade-azure-helpers branch from 08bbaa0 to 6bbbe87 Compare September 14, 2022 22:59

thomas11 force-pushed the tkappler/upgrade-azure-helpers branch from dbfce6a to b0bbaed Compare September 15, 2022 18:10

thomas11 force-pushed the tkappler/upgrade-azure-helpers branch from b0bbaed to 0d3d2db Compare September 15, 2022 21:53

thomas11 added 15 commits September 23, 2022 10:36

Spike: upgrade hashicorp/go-azure-helpers to 0.40

7bcc7d3

Remove some legacy ADAL code

6ef5d0f

Verify that a good version of az is installed. #1565

51b6a40

Fix logic bug in getting object id.

71d274d

Upgrade some more minor dependencies

50105e6

Unblock Azure auth by using long-lived context

619b8f0

Only check for valid az version when we need it #1565

f6be5f3

Fix nil pointer bug in getClientConfig

c806cdc

Add test for getClientConfig

d22b19d

Polish names and messages.

30d80e3

Make 'az' version message more helpful.

b061a41

Allow older az versions also

ba64c6a

Support new kind of token provider for SP and MSI auth

863ba7c

Bump p/p and p/random versions in nodejs integration tests

c1de70e

minor dependency upgrades

31115e0

thomas11 force-pushed the tkappler/upgrade-azure-helpers branch from 111c536 to 31115e0 Compare September 23, 2022 17:38

thomas11 mentioned this pull request Sep 23, 2022

Upgrade auth stack #1987

Merged

thomas11 marked this pull request as draft October 28, 2022 20:37

myhau mentioned this pull request Dec 15, 2022

Rewrite azure / azure-native e2e tests to use OIDC authentication once it's supported by Pulumi VirtuslabRnD/pulumi-kotlin#195

Open

thomas11 added the resolution/duplicate This issue is a duplicate of another issue label Mar 31, 2023

thomas11 closed this Mar 31, 2023

thomas11 deleted the tkappler/upgrade-azure-helpers branch February 13, 2024 06:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Upgrade our authentication library to support MSAL #1942

Upgrade our authentication library to support MSAL #1942

thomas11 commented Aug 29, 2022 •

edited

Loading

github-actions bot commented Aug 29, 2022

lblackstone left a comment

github-actions bot commented Aug 31, 2022

github-actions bot commented Sep 5, 2022

github-actions bot commented Sep 7, 2022

guineveresaenger commented Sep 7, 2022

github-actions bot commented Sep 8, 2022

mikhailshilkov Sep 8, 2022

danielrbradley Sep 9, 2022

thomas11 Sep 15, 2022

github-actions bot commented Sep 8, 2022

danielrbradley left a comment

github-actions bot commented Sep 14, 2022

github-actions bot commented Sep 15, 2022

github-actions bot commented Sep 15, 2022

github-actions bot commented Sep 15, 2022

github-actions bot commented Sep 16, 2022

github-actions bot commented Sep 23, 2022

thomas11 commented Mar 31, 2023

Upgrade our authentication library to support MSAL #1942

Upgrade our authentication library to support MSAL #1942

Conversation

thomas11 commented Aug 29, 2022 • edited Loading

github-actions bot commented Aug 29, 2022

Does the PR have any schema changes?

lblackstone left a comment

Choose a reason for hiding this comment

github-actions bot commented Aug 31, 2022

Does the PR have any schema changes?

github-actions bot commented Sep 5, 2022

Does the PR have any schema changes?

github-actions bot commented Sep 7, 2022

Does the PR have any schema changes?

guineveresaenger commented Sep 7, 2022

github-actions bot commented Sep 8, 2022

Does the PR have any schema changes?

mikhailshilkov Sep 8, 2022

Choose a reason for hiding this comment

danielrbradley Sep 9, 2022

Choose a reason for hiding this comment

thomas11 Sep 15, 2022

Choose a reason for hiding this comment

github-actions bot commented Sep 8, 2022

Does the PR have any schema changes?

danielrbradley left a comment

Choose a reason for hiding this comment

github-actions bot commented Sep 14, 2022

Does the PR have any schema changes?

github-actions bot commented Sep 15, 2022

Does the PR have any schema changes?

github-actions bot commented Sep 15, 2022

Does the PR have any schema changes?

github-actions bot commented Sep 15, 2022

Does the PR have any schema changes?

github-actions bot commented Sep 16, 2022

Does the PR have any schema changes?

github-actions bot commented Sep 23, 2022

Does the PR have any schema changes?

thomas11 commented Mar 31, 2023

thomas11 commented Aug 29, 2022 •

edited

Loading