Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

MSAL and OIDC support #2320

Merged
merged 20 commits into from
Mar 28, 2023
Merged

MSAL and OIDC support #2320

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
2274458
Upgrade auth stack to latest versions.
thomas11 Aug 26, 2022
24d6b38
Factor details of auth better, extra nil check for safety
thomas11 Oct 3, 2022
ba949bc
Switch from ADAL to MSAL authentication
thomas11 Oct 5, 2022
46a1e4b
Move auth code into its own file
thomas11 Oct 5, 2022
c256cfc
Use correct audience for MSAL Key Vault token #1566
thomas11 Oct 7, 2022
d59384e
Add OIDC config to auth builder creation
thomas11 Feb 7, 2023
d8e21e2
Temporarily use oidc-test client id and comment client secret to test…
thomas11 Feb 7, 2023
03eb5c8
Need UseMicrosoftGraph and write permissions for JWT token
thomas11 Feb 7, 2023
6bd99d2
Rework build tags, CI work
thomas11 Feb 9, 2023
c6892b3
Name short test runs accordingly
thomas11 Feb 9, 2023
327914a
Fix oidc-only test build
thomas11 Feb 9, 2023
b1c72c3
Don't need the cli for OICD
thomas11 Mar 15, 2023
fff69df
Fall back to ADAL when the CLI is used for auth
thomas11 Mar 15, 2023
771f231
Different test for az cli, remove q.Q
thomas11 Mar 16, 2023
de9cd54
Run nodejs-only OIDC tests
thomas11 Mar 16, 2023
af9d8f7
Sync with latest api specs from master
thomas11 Mar 18, 2023
3c24756
Reset schema to the one in master, no schema changes expected here
thomas11 Mar 22, 2023
a21dec5
Move id-token permission to where it's needed
thomas11 Mar 22, 2023
58066d1
Simplify OIDC test runs in CI
thomas11 Mar 27, 2023
f1a44f8
Review follow-up: use OIDC_ARM_CLIENT_ID
thomas11 Mar 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion .github/workflows/build-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,8 @@ jobs:
- go
- java
name: Build & Test SDKs
permissions:
id-token: write # required for OIDC auth
steps:
- name: Checkout Repo
uses: actions/checkout@v3
Expand Down Expand Up @@ -135,11 +137,14 @@ jobs:

- name: Run tests
if: "!inputs.short_test"
env:
# specifying this id will cause the OIDC test(s) to run against this AD application
OIDC_ARM_CLIENT_ID: "89380e12-5be6-486a-89ef-eea107af2f47" # AD app 'oidc-test'
run: |
set -euo pipefail
cd examples && go test -v -json -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 . 2>&1 | tee /tmp/gotest.log | gotestfmt

- name: Run tests
- name: Run short tests
if: inputs.short_test
run: |
set -euo pipefail
Expand Down
42 changes: 42 additions & 0 deletions examples/examples_nodejs_keyvault_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
// Copyright 2016-2020, Pulumi Corporation. All rights reserved.
//go:build nodejs || all

package examples

import (
"github.com/pulumi/pulumi/pkg/v3/testing/integration"
"os"
"path/filepath"
"testing"
)

func TestAccKeyVaultTs(t *testing.T) {
skipIfShort(t)
test := getJSBaseOptions(t).
With(integration.ProgramTestOptions{
Dir: filepath.Join(getCwd(t), "keyvault"),
})

integration.ProgramTest(t, &test)
}

func TestAccKeyVaultTs_OICD(t *testing.T) {
skipIfShort(t)

oidcClientId := os.Getenv("OIDC_ARM_CLIENT_ID")
if oidcClientId == "" {
t.Skip("Skipping OIDC test without OIDC_ARM_CLIENT_ID")
}
test := getJSBaseOptions(t).
With(integration.ProgramTestOptions{
Dir: filepath.Join(getCwd(t), "keyvault"),
Env: []string{
"ARM_USE_OIDC=true",
"ARM_CLIENT_ID=" + oidcClientId,
// not strictly necessary but making sure we test the OIDC path
"ARM_CLIENT_SECRET=",
},
})

integration.ProgramTest(t, &test)
}
11 changes: 0 additions & 11 deletions examples/examples_nodejs_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
// Copyright 2016-2020, Pulumi Corporation. All rights reserved.
//go:build nodejs || all
// +build nodejs all

package examples

Expand Down Expand Up @@ -43,16 +42,6 @@ func TestAccCosmosDBTs(t *testing.T) {
integration.ProgramTest(t, &test)
}

func TestAccKeyVaultTs(t *testing.T) {
skipIfShort(t)
test := getJSBaseOptions(t).
With(integration.ProgramTestOptions{
Dir: filepath.Join(getCwd(t), "keyvault"),
})

integration.ProgramTest(t, &test)
}

danielrbradley marked this conversation as resolved.
Show resolved Hide resolved
func TestAccSimpleTs(t *testing.T) {
skipIfShort(t)
test := getJSBaseOptions(t).
Expand Down
25 changes: 12 additions & 13 deletions provider/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,16 +3,21 @@ module github.com/pulumi/pulumi-azure-native/provider
go 1.18

require (
github.com/Azure/azure-sdk-for-go v66.0.0+incompatible
github.com/Azure/azure-sdk-for-go v68.0.0+incompatible
github.com/Azure/go-autorest/autorest v0.11.28
github.com/blang/semver v3.5.1+incompatible
github.com/brianvoe/gofakeit/v6 v6.16.0
github.com/gedex/inflector v0.0.0-20170307190818-16278e9db813
github.com/go-openapi/jsonreference v0.19.6
github.com/go-openapi/spec v0.20.4
github.com/go-openapi/swag v0.21.1
github.com/golang/protobuf v1.5.2
github.com/google/uuid v1.3.0
github.com/hashicorp/go-azure-helpers v0.47.0
github.com/hashicorp/go-multierror v1.1.1
github.com/hashicorp/hcl/v2 v2.15.0
github.com/manicminer/hamilton v0.50.0
github.com/manicminer/hamilton-autorest v0.2.0
github.com/olekukonko/tablewriter v0.0.5
github.com/pkg/errors v0.9.1
github.com/pulumi/pulumi-java/pkg v0.7.1
Expand All @@ -25,18 +30,10 @@ require (
github.com/stretchr/testify v1.8.1
github.com/tombuildsstuff/giovanni v0.15.1
github.com/zclconf/go-cty v1.12.1
gopkg.in/yaml.v3 v3.0.1
modernc.org/sqlite v1.10.0
)

require github.com/Azure/go-autorest/autorest/adal v0.9.21

require (
github.com/golang/protobuf v1.5.2
github.com/google/uuid v1.3.0
github.com/hashicorp/go-azure-helpers v0.40.0
google.golang.org/grpc v1.51.0
google.golang.org/protobuf v1.28.1
gopkg.in/yaml.v3 v3.0.1
modernc.org/sqlite v1.10.0
)

require (
Expand All @@ -45,6 +42,7 @@ require (
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.0.0 // indirect
github.com/Azure/azure-sdk-for-go/sdk/internal v1.0.0 // indirect
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v0.4.1 // indirect
github.com/Azure/go-autorest/autorest/adal v0.9.21 // indirect
github.com/AzureAD/microsoft-authentication-library-for-go v0.4.0 // indirect
github.com/armon/go-metrics v0.4.0 // indirect
github.com/armon/go-radix v1.0.0 // indirect
Expand Down Expand Up @@ -158,8 +156,6 @@ require (
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
github.com/kevinburke/ssh_config v1.1.0 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/manicminer/hamilton v0.44.0 // indirect
github.com/manicminer/hamilton-autorest v0.2.0 // indirect
github.com/mattn/go-colorable v0.1.12 // indirect
github.com/mattn/go-isatty v0.0.14 // indirect
github.com/mattn/go-runewidth v0.0.13 // indirect
Expand Down Expand Up @@ -229,3 +225,6 @@ require (
modernc.org/token v1.0.0 // indirect
sourcegraph.com/sourcegraph/appdash v0.0.0-20211028080628-e2786a622600 // indirect
)

// replace github.com/hashicorp/go-azure-helpers => /Users/tkappler/pulumi/go-azure-helpers
// replace github.com/manicminer/hamilton => /Users/tkappler/pulumi/hamilton
11 changes: 6 additions & 5 deletions provider/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,8 +93,9 @@ github.com/Azure/azure-sdk-for-go v45.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9mo
github.com/Azure/azure-sdk-for-go v47.1.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
github.com/Azure/azure-sdk-for-go v63.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
github.com/Azure/azure-sdk-for-go v65.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
github.com/Azure/azure-sdk-for-go v66.0.0+incompatible h1:bmmC38SlE8/E81nNADlgmVGurPWMHDX2YNXVQMrBpEE=
github.com/Azure/azure-sdk-for-go v66.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
github.com/Azure/azure-sdk-for-go v68.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
github.com/Azure/azure-sdk-for-go/sdk/azcore v0.19.0/go.mod h1:h6H6c8enJmmocHUbLiiGY6sx7f9i+X3m1CHdd5c6Rdw=
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.0.0/go.mod h1:uGG2W01BaETf0Ozp+QxxKJdMBNRWPdstHG0Fmdwn1/U=
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.1.1 h1:tz19qLF65vuu2ibfTqGVJxG/zZAI27NEIIbvAOQwYbw=
Expand Down Expand Up @@ -915,8 +916,8 @@ github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brv
github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
github.com/hashicorp/go-azure-helpers v0.12.0/go.mod h1:Zc3v4DNeX6PDdy7NljlYpnrdac1++qNW0I4U+ofGwpg=
github.com/hashicorp/go-azure-helpers v0.40.0 h1:NjiyF+jN+0mRdFBU894yzZSxu1SNrbvj8l4rEDpCB0A=
github.com/hashicorp/go-azure-helpers v0.40.0/go.mod h1:gcutZ/Hf/O7YN9M3UIvyZ9l0Rxv7Yrc9x5sSfM9cuSw=
github.com/hashicorp/go-azure-helpers v0.47.0 h1:E90ZN2hqMtzI+tfGWCnNtyLZYG4csoKSs+hWZZ8ywSM=
github.com/hashicorp/go-azure-helpers v0.47.0/go.mod h1:WiJNl0fD6PoM/MYuGTZ8yuzIaXQR3m2H2g6+EJ8nSwc=
github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
Expand Down Expand Up @@ -1167,8 +1168,8 @@ github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJ
github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
github.com/manicminer/hamilton v0.43.0/go.mod h1:lbVyngC+/nCWuDp8UhC6Bw+bh7jcP/E+YwqzHTmzemk=
github.com/manicminer/hamilton v0.44.0 h1:mLb4Vxbt2dsAvOpaB7xd/5D8LaTTX6ACwVP4TmW8qwE=
github.com/manicminer/hamilton v0.44.0/go.mod h1:lbVyngC+/nCWuDp8UhC6Bw+bh7jcP/E+YwqzHTmzemk=
github.com/manicminer/hamilton v0.50.0 h1:EPne7iH6zbXUPPjP/XZvqXzmqkt1WyF5X1A21uosPM4=
github.com/manicminer/hamilton v0.50.0/go.mod h1:lbVyngC+/nCWuDp8UhC6Bw+bh7jcP/E+YwqzHTmzemk=
github.com/manicminer/hamilton-autorest v0.2.0 h1:dDL+t2DrQza0EfNYINYCvXISeNwVqzgVAQh+CH/19ZU=
github.com/manicminer/hamilton-autorest v0.2.0/go.mod h1:NselDpNTImEmOc/fa41kPg6YhDt/6S95ejWbTGZ6tlg=
github.com/markbates/oncer v0.0.0-20181203154359-bf2de49a0be2/go.mod h1:Ld9puTsIW75CHf65OeIOkyKbteujpZVXDpWK6YGZbxE=
Expand Down
Loading