MSAL and OIDC support #2320

thomas11 · 2023-03-22T19:27:20Z

About

This PR contains two related pieces:

Switch the provider from the deprecated ADAL authentication method to the current MSAL method. Due to an issue in our dependencies, one of the authentication paths, the az cli, doesn't work properly with MSAL. We detect the unsupported cli case dynamically and fall back to ADAL in that case.
Enable OIDC for authentication. The actual OIDC implementation is in our dependencies but enabling it was gated behind MSAL. This PR exposes the relevant configuration settings and adds a dedicated test.

What's MSAL?

The provider currently uses an authentication method called ADAL that’s out of support in Azure. ADAL, also called auth v1, is replaced by MSAL (auth v2).

OIDC only works on MSAL.

These protocols are implemented in our dependencies go-azure-helpers and hamilton so we don't need to care about the details, except for two things that surface in our code:

MSAL has a new concept of scopes for more targeted authentication scopes. You can't just get a token for everything in an Azure account or subscription, you can only get one for ResourceManager, or KeyVault, etc. Since Pulumi deals with infrastructure, we can get away with ResourceManager for most operations, but we do have some custom resources that touch the data plane and need a different scope.
The dependencies don't implement MSAL correctly when the az cli is used for authentication. This PR falls back to ADAL when that case is detected.

What's OIDC?

It stands for OpenID Connect and is an authentication protocol on top of OAuth. The idea is to allow trusted parties to verify a user's identity. For a practical example, let's look at how I set up OIDC authentication between Github Actions and Azure, which is used by the e2e test of this PR. We tell Azure that GitHub can be trusted:

On an Azure Active Directory (AD) App, add a new credential with issuer GitHub.
In GitHub, configure the Action with the id of the AD App.

Now, when the action runs, GitHub can use the Azure AD endpoint to exchange the GitHub token for an Azure token.

Note that there is no secret involved anywhere that would need to be safely stored, rotated, etc. This is one of the biggest advantages of OIDC.

Details for the interested here (GH) and here (Azure), but not required reading for reviewing this PR.

Testing

I picked an existing e2e test, keyvault. In general, any e2e test will do since we only want to see that authentication works. However, keyvault has more authentication test coverage than the other tests because it also creates a key vault secret, which is a data plane operation that requires a different token.

I used Go build tags to make this test as oidc. This required moving it into its own file. In the OIDC test run, we run only this test, unsetting the ARM client secret to make sure we really test OIDC.

Reviewing this PR

I added comments with leading numbers like (1). I suggest following those in order. They show on the main page in the correct order, but without a link to the actual file, so that's kinda annoying.

Next steps

To fully release OIDC support we need to document it in our user-facing documentation.

I should also document the particular OIDC integration used in testing in our wiki (AD principal, roles, permissions etc.).

Unblock Azure auth by using long-lived context.

… OIDC

Clarify oidc-test comment

This not only limits the security blast radius, but also unblocks schema-tools from adding PR comments. Previously, it had the write permission by default, but adding the id-token permission setting globally reset all others: "If you specify the access for any of these scopes, all of those that are not specified are set to none."

github-actions · 2023-03-22T23:59:45Z

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.

thomas11 · 2023-03-24T02:33:18Z

provider/pkg/provider/auth.go

@@ -0,0 +1,293 @@
+// Copyright 2016-2022, Pulumi Corporation.


(1) Since the authentication code grew to about 300 lines, I moved it to its own file. Much of it is unchanged.

thomas11 · 2023-03-24T02:34:03Z

provider/pkg/provider/auth.go

+		envName = "public"
+	}
+
+	useMsi := k.getConfig("useMsi", "ARM_USE_MSI") == "true"


(2) Read the OIDC config from the environment. Lines 47-65, 80-85 are new. It's standard configuration handling, except that there are two environment variables that we check for token and URL. The ones starting with ARM_ are ours for the user to set, the ones with ACTIONS_ are pre-set when running in GHA, so we check them directly instead of making users get the values and put them into the ARM_ variables.

thomas11 · 2023-03-24T02:34:50Z

provider/pkg/provider/auth.go

+		SupportsAuxiliaryTenants:       len(auxTenants) > 0,
+	}
+
+	needCli := needAzCli(builder)


(3) Check whether we'll use the az cli for authentication. That isn't new but I extracted it into the needAzCli function and added the OIDC case. Both OIDC and MSI auth are not supported via cli.

thomas11 · 2023-03-24T02:35:17Z

provider/pkg/provider/auth.go

+		builder.ClientCertPath == ""
+}
+
+func getAzVersion() (*goversion.Version, error) {


(4) The following code is all about cli versions and is just moved over from provider.go. It gets interesting again in line 190.

thomas11 · 2023-03-24T02:35:33Z

provider/pkg/provider/auth.go

+	return nil
+}
+
+type AuthorizerFactory func(api environments.Api) (autorest.Authorizer, error)


(5) Autorest, the library we use to talk to the Azure REST API, takes an autorest.Authorizer interface to get auth tokens from. With ADAL, we could just make an Authorizer and use it everywhere. With MSAL, due to the added scopes, we need a factory to create Authorizers on demand for different scopes. Note how the token factory is a func(api environments.Api) but in the ADAL case, the api parameter is unused.

thomas11 · 2023-03-24T02:36:17Z

provider/pkg/provider/auth.go

+
+	endpoint := k.environment.TokenAudience
+
+	if authConfig.useCli {


(6) As mentioned above, due to this issue we fall back to ADAL if we're using the cli.

The rest of auth.go is largely unchanged.

thomas11 · 2023-03-24T02:36:47Z

provider/pkg/provider/provider.go

+	// need the authorizers to function across requests.
+	authCtx := context.Background()
+
+	tokenAuth, bearerAuth, err := k.makeAuthorizerFactories(authCtx, authConfig)


(7) In the provider's Configure, we use the new authorizer factories to make authorizers for ResourceManager and for KeyVault. The RM one is our standard authorizer because we generally only do resource management: k.client.Authorizer = resourceManagerAuth. The Key Vault one is passed to the custom resources builder so we can handle secrets there.

The rest of provider.go is just code moved to auth.go.

examples/examples_nodejs_keyvault_test.go

.github/workflows/build-test.yml

thomas11 · 2023-03-24T02:38:55Z

.github/workflows/build-test.yml

+        if: ${{ matrix.language == 'nodejs' }}
+        env:
+          ARM_USE_OIDC: true
+          ARM_CLIENT_SECRET: ""


(10) We unset ARM_CLIENT_SECRET that the other tests use for authentication to disable that path so we know we're testing what we think we're testing.

.github/workflows/build-test.yml

danielrbradley

This looks loads better - much happier it's not complicating the build process!

Good to go as-is but have added a comment for moving where the hard-coded value sits.

examples/examples_nodejs_test.go

examples/examples_nodejs_keyvault_test.go

thomas11 and others added 17 commits March 22, 2023 11:58

Upgrade auth stack to latest versions.

2274458

Unblock Azure auth by using long-lived context.

Factor details of auth better, extra nil check for safety

24d6b38

Switch from ADAL to MSAL authentication

ba949bc

Move auth code into its own file

46a1e4b

Use correct audience for MSAL Key Vault token #1566

c256cfc

Add OIDC config to auth builder creation

d59384e

Temporarily use oidc-test client id and comment client secret to test…

d8e21e2

… OIDC

Need UseMicrosoftGraph and write permissions for JWT token

03eb5c8

Rework build tags, CI work

6bd99d2

Name short test runs accordingly

c6892b3

Fix oidc-only test build

327914a

Don't need the cli for OICD

b1c72c3

Fall back to ADAL when the CLI is used for auth

fff69df

Different test for az cli, remove q.Q

771f231

Clarify oidc-test comment

Run nodejs-only OIDC tests

de9cd54

Sync with latest api specs from master

af9d8f7

Reset schema to the one in master, no schema changes expected here

3c24756

danielrbradley mentioned this pull request Mar 22, 2023

MSAL and OIDC support #2308

Closed

thomas11 requested review from danielrbradley, mikhailshilkov and kpitzen March 22, 2023 23:39

thomas11 commented Mar 24, 2023

View reviewed changes

examples/examples_nodejs_keyvault_test.go Outdated Show resolved Hide resolved

thomas11 commented Mar 24, 2023

View reviewed changes

.github/workflows/build-test.yml Outdated Show resolved Hide resolved

thomas11 commented Mar 24, 2023

View reviewed changes

.github/workflows/build-test.yml Outdated Show resolved Hide resolved

thomas11 commented Mar 24, 2023

View reviewed changes

.github/workflows/build-test.yml Outdated Show resolved Hide resolved

Simplify OIDC test runs in CI

58066d1

danielrbradley approved these changes Mar 27, 2023

View reviewed changes

examples/examples_nodejs_test.go Show resolved Hide resolved

examples/examples_nodejs_keyvault_test.go Outdated Show resolved Hide resolved

Review follow-up: use OIDC_ARM_CLIENT_ID

f1a44f8

kpitzen approved these changes Mar 27, 2023

View reviewed changes

thomas11 added the impact/no-changelog-required This issue doesn't require a CHANGELOG update label Mar 28, 2023

thomas11 merged commit db073ee into master Mar 28, 2023

thomas11 deleted the tkappler/msal-oidc branch March 28, 2023 02:31

This was referenced Mar 31, 2023

[provider] Fix OIDC support #2086

Closed

Upgrade our authentication library to support MSAL #1942

Closed

Obtain auth tokens via the new azidentity/MSAL method #1926

Closed

danielrbradley mentioned this pull request Nov 13, 2023

Creating Key in Vault - ForbiddenByRbac #890

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

MSAL and OIDC support #2320

MSAL and OIDC support #2320

thomas11 commented Mar 22, 2023 •

edited

Loading

github-actions bot commented Mar 22, 2023

thomas11 Mar 24, 2023 •

edited

Loading

thomas11 Mar 24, 2023 •

edited

Loading

thomas11 Mar 24, 2023 •

edited

Loading

thomas11 Mar 24, 2023 •

edited

Loading

thomas11 Mar 24, 2023 •

edited

Loading

thomas11 Mar 24, 2023 •

edited

Loading

thomas11 Mar 24, 2023 •

edited

Loading

thomas11 Mar 24, 2023 •

edited

Loading

danielrbradley left a comment

		@@ -0,0 +1,293 @@
		// Copyright 2016-2022, Pulumi Corporation.


		endpoint := k.environment.TokenAudience

		if authConfig.useCli {

MSAL and OIDC support #2320

MSAL and OIDC support #2320

Conversation

thomas11 commented Mar 22, 2023 • edited Loading

About

What's MSAL?

What's OIDC?

Testing

Reviewing this PR

Next steps

github-actions bot commented Mar 22, 2023

Does the PR have any schema changes?

thomas11 Mar 24, 2023 • edited Loading

Choose a reason for hiding this comment

thomas11 Mar 24, 2023 • edited Loading

Choose a reason for hiding this comment

thomas11 Mar 24, 2023 • edited Loading

Choose a reason for hiding this comment

thomas11 Mar 24, 2023 • edited Loading

Choose a reason for hiding this comment

thomas11 Mar 24, 2023 • edited Loading

Choose a reason for hiding this comment

thomas11 Mar 24, 2023 • edited Loading

Choose a reason for hiding this comment

thomas11 Mar 24, 2023 • edited Loading

Choose a reason for hiding this comment

thomas11 Mar 24, 2023 • edited Loading

Choose a reason for hiding this comment

danielrbradley left a comment

Choose a reason for hiding this comment

thomas11 commented Mar 22, 2023 •

edited

Loading

thomas11 Mar 24, 2023 •

edited

Loading

thomas11 Mar 24, 2023 •

edited

Loading

thomas11 Mar 24, 2023 •

edited

Loading

thomas11 Mar 24, 2023 •

edited

Loading

thomas11 Mar 24, 2023 •

edited

Loading

thomas11 Mar 24, 2023 •

edited

Loading

thomas11 Mar 24, 2023 •

edited

Loading

thomas11 Mar 24, 2023 •

edited

Loading