Added OIDC support for login action by BALAGA-GAYATRI · Pull Request #147 · Azure/login

Balaga Gayatri (BALAGA-GAYATRI) · 2021-10-06T16:09:50Z

No description provided.

Vineet (vineetmimrot) · 2021-10-06T17:11:28Z

+        //Check for the credentials in individual parameters in the workflow.
+        var servicePrincipalId = core.getInput('client-id', { required: false });;
+        var servicePrincipalKey = null;
+        var tenantId = core.getInput('tenant-id', { required: false });
+        var subscriptionId = core.getInput('subscription-id', { required: false });
+        var resourceManagerEndpointUrl = "https://management.azure.com/";
+        var enableOIDC= true;
+        // If any of the individual credentials (clent_id, tenat_id, subscription_id) are  missing
+        if(!servicePrincipalId || !tenantId || !(subscriptionId || allowNoSubscriptionsLogin)){
+            //If all of the individual credentials (clent_id, tenat_id, subscription_id) are missing in workflow inputs, checking for creds object.
+            if(!servicePrincipalId && !tenantId && (!subscriptionId || !allowNoSubscriptionsLogin)){
+                console.log('checking line 55 condition..')
+                if(creds) {
+                    console.log('using creds JSON...')
+                    enableOIDC = false;
+                    servicePrincipalId = secrets.getSecret("$.clientId", true);
+                    servicePrincipalKey= secrets.getSecret("$.clientSecret", true);
+                    tenantId = secrets.getSecret("$.tenantId", true);
+                    subscriptionId = secrets.getSecret("$.subscriptionId", true);
+                    resourceManagerEndpointUrl = secrets.getSecret("$.resourceManagerEndpointUrl", false);
+                }
+                else{
+                    throw new Error("Credentials are not passed for Login action."); 
+                }           
+            }
+            //If any few of the individual credentials are missing
+            else
+                throw new Error("Few credentials are missing.ClientId,tenantId are mandatory. SubscriptionId is also mandatory if allow-no-subscriptions is not set."); 
+        }        


Put it into a factory pattern. Your code will be much cleaner with no if/else conditions you have used below for enableOIDC check.

…idc-support

Kanchan Verma (kaverma) · 2021-10-07T09:34:37Z

-            if (!servicePrincipalId || !servicePrincipalKey || !tenantId) {
-                throw new Error("Not all values are present in the creds object. Ensure clientId, clientSecret and tenantId are supplied.");
+            //Check for the credentials in individual parameters in the workflow.
+            var servicePrincipalId = core.getInput('client-id', { required: false });


should we name this var as clientId only to be same as Input name

This is as per previous design only. clientID is treated as serviceprincipalId and clientSecret as serviceprincipalKey.

Kanchan Verma (kaverma) · 2021-10-07T09:34:56Z

+            var servicePrincipalKey = null;
+            var tenantId = core.getInput('tenant-id', { required: false });
+            var subscriptionId = core.getInput('subscription-id', { required: false });
+            var resourceManagerEndpointUrl = "https://management.azure.com/";


is this fixed?

Yes. For other clouds it is different. For public cloud it is constant.

Kanchan Verma (kaverma) · 2021-10-07T09:35:37Z

+            var subscriptionId = core.getInput('subscription-id', { required: false });
+            var resourceManagerEndpointUrl = "https://management.azure.com/";
+            var enableOIDC = true;
+            // If any of the individual credentials (clent_id, tenat_id, subscription_id) are  missing


nit: please add newlines for formatting, readability.

Kanchan Verma (kaverma) · 2021-10-07T09:41:06Z

+            var servicePrincipalId = core.getInput('client-id', { required: false });
+            ;
+            var servicePrincipalKey = null;
+            var tenantId = core.getInput('tenant-id', { required: false });


Should these also be individual secrets like in creds object?

Vineet (vineetmimrot) · 2021-10-07T11:42:11Z

    execOptions.silent = !!silent;
    try {
-        await exec.exec(`"${azPath}" ${command}`, args,  execOptions); 
+        core.debug(args);


You shouldn't put log here, it may expose credentials if it doesn't get masked by GitHub runner.

removed 👍🏻

Vineet (vineetmimrot) · 2021-10-07T11:45:19Z

+            var args = [];
+            if (enableOIDC) {
+                args = [
+                    "--allow-no-subscriptions",


You can create a base args array that contains common keys and based on the specific parameter values you can append to it.
Like if allowNoSubscriptionsLogin is true -> append "--allow-no-subscriptions" to args, same for other keys.

Vineet (vineetmimrot) · 2021-10-07T11:51:23Z

+                if (enableAzPSSession)
+                    throw new Error(`Powershell login is not supported with OIDC.`);
+            } else {
+                throw new Error("Could not get ID token for authentication.");


Does OIDC send some error message in case of failure. if it is we should also show that to users, so user can debug the error. Here user can be clueless, what has gone wrong and he can't debug.

Vineet (vineetmimrot) · 2021-10-07T12:01:26Z

+        if (!servicePrincipalId || !tenantId || !(subscriptionId || allowNoSubscriptionsLogin)) {
+            //If all of the individual credentials (clent_id, tenat_id, subscription_id) are missing in workflow inputs, checking for creds object.
+            if (!servicePrincipalId && !tenantId && (!subscriptionId || !allowNoSubscriptionsLogin)) {
+                if (creds) {


What if the user has passed some parameters as inputs and some under creds object? As per your code, it will go for creds object which is ok. But Should we let users pass parameters to both?

Vineet (vineetmimrot) · 2021-10-11T05:36:32Z

+                "-u", servicePrincipalId,
+                "--tenant", tenantId
+            ];
            if (allowNoSubscriptionsLogin) {


Suggested change

if (allowNoSubscriptionsLogin) {

if (allowNoSubscriptionsLogin) {

commonArgs = commonArgs.concat("--allow-no-subscriptions");

}

if (enableOIDC) {

commonArgs = commonArgs.concat("--federated-token", idToken);

}

else {

commonArgs = commonArgs.concat("-p", servicePrincipalKey);

}

yield executeAzCliCommand(`login`, true, {}, commonArgs);

How about this Balaga Gayatri (@BALAGA-GAYATRI)

* Added OIDC support for login action (#147) * OIDC support for Powershell login (#156) * OIDC support ps (#155) ps login support * Update main.ts * formatting code * nit changes Co-authored-by: Balaga Gayatri <balaga-gayatri@github.com>

Balaga Gayatri (BALAGA-GAYATRI) added 30 commits September 28, 2021 11:57

added oidc support

18604fb

changes

ad1e1bc

changes

31413bf

added oidc support

66969bb

changes

6a8dff2

changes

7b59ab5

debug

c145ca6

changes

066acfd

chages

4dd34ea

changes

a897d9e

Update main.ts

c0f045f

..

45e70a2

changes

ade5ff8

end to end changes

e7b55e8

end to end changes

62804f4

end to end changes

e3b2d7a

end to end changes

0393c28

end to end changes

bf7afc0

end to end changes

a72df0a

end to end changes

fa4c64b

end to end changes

762d20c

end to end changes

5da3d81

changes

40fbf75

changes

c10c739

changes in login actiom

424bdd8

changes

dc8e4aa

changes

b329991

changes

5bb957b

changes

91541b5

changes

eb0e857

Update main.ts

f6ea870

Vineet (vineetmimrot) reviewed Oct 6, 2021

View reviewed changes

Comment thread src/main.ts Outdated

Balaga Gayatri (BALAGA-GAYATRI) added 3 commits October 6, 2021 22:57

changes

8e289ca

Merge branch 'oidc-support' of github.com:BALAGA-GAYATRI/login into o…

b2a6a0d

…idc-support

changes

638cdd8

Kanchan Verma (kaverma) reviewed Oct 7, 2021

View reviewed changes

Comment thread lib/main.js Outdated

Kanchan Verma (kaverma) reviewed Oct 7, 2021

View reviewed changes

Comment thread lib/main.js

updating js

a114662

Kanchan Verma (kaverma) reviewed Oct 7, 2021

View reviewed changes

Balaga Gayatri (BALAGA-GAYATRI) added 3 commits October 7, 2021 15:41

updating error messages

d75607c

updating error messages

00b5c81

nit changes

9fc877e

Vineet (vineetmimrot) reviewed Oct 7, 2021

View reviewed changes

Kanchan Verma (kaverma) requested a review from Jyotsna (Josh-01) October 8, 2021 12:15

Balaga Gayatri (BALAGA-GAYATRI) added 2 commits October 8, 2021 20:37

using common arguments

6a28cf1

using common arguments

e2ba17e

Vineet (vineetmimrot) reviewed Oct 11, 2021

View reviewed changes

Balaga Gayatri (BALAGA-GAYATRI) added 3 commits October 11, 2021 12:49

refactoring code

21c0c36

refactoring code

f38bcfa

refactoring code

e0eb61a

Balaga Gayatri (BALAGA-GAYATRI) merged commit a4b1865 into Azure:oidc-support Oct 11, 2021

Jiashuo Li (jiasli) mentioned this pull request Apr 8, 2024

Azure CLI task fails: AADSTS700024: Client assertion is not within its valid time range Azure/azure-cli#28708

Open

-            if (allowNoSubscriptionsLogin) {
+            if (allowNoSubscriptionsLogin) {
+                 commonArgs = commonArgs.concat("--allow-no-subscriptions");
+            }
+            if (enableOIDC) {
+               commonArgs = commonArgs.concat("--federated-token", idToken);
+            }
+            else {
+                commonArgs = commonArgs.concat("-p", servicePrincipalKey);
+            }
+            yield executeAzCliCommand(`login`, true, {}, commonArgs);

Conversation

Balaga Gayatri (BALAGA-GAYATRI) commented Oct 6, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants