MSAL and OIDC support #2308
Closed
MSAL and OIDC support #2308
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Spike: upgrade hashicorp/go-azure-helpers to 0.40 Unblock Azure auth by using long-lived context Fix logic bug in getting object id. Upgrade some more minor dependencies minor dependency upgrades Switch back to ADAL but keep the upgrades. Fix nil pointer bug in getClientConfig
Regenerate versions
thomas11
requested review from
danielrbradley,
mikhailshilkov,
kpitzen and
a team
|
Replaced with #2320 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
About
This PR contains two related pieces:
Testing
I picked an existing e2e test,
keyvault. In general, any e2e test will do since we only want to see that authentication works. However,keyvaulthas more authentication test coverage than the other tests because it also creates a key vault secret, which is a data plane operation that requires a different token.I used Go build tags to make this test as
oidc. This required moving it into its own file.In the OIDC test run, we run only this test, unsetting the ARM client secret to make sure we really test OIDC.
Next steps
To fully release OIDC support we need to document it in our user-facing documentation.
I should also document the particular OIDC integration used in testing in our wiki (AD principal, roles, permissions etc.).