auth: Support AzureDevOps Pipeline OIDC auth (similar to Github OIDC auth) (#1139)

* Support ADO pipeline OIDC

* Update

* remove audience query

* Add back audience

* Add up the missing test and doc

* NewAuthorizerFromCredentials: Move ADO OIDC before Github OIDC

This enables users who intend to use ADO OIDC while enbaled both won't end up using Github OIDC auth and fail.

This can work since ADO OIDC has one more condition (i.e. the service connection ID) than Github OIDC.

* Auth: set the service connection for ADO OIDC

Author: magodo

sdk/auth/README.md

@@ -130,8 +130,39 @@ func main() {
 	credentials := auth.Credentials{
 		Environment:                         environment,
 		EnableAuthenticationUsingGitHubOIDC: true,
-		GitHubOIDCTokenRequestURL:           os.Getenv("ACTIONS_ID_TOKEN_REQUEST_URL"),
-		GitHubOIDCTokenRequestToken:         os.Getenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN"),
+		OIDCTokenRequestURL:                 os.Getenv("ACTIONS_ID_TOKEN_REQUEST_URL"),
+		OIDCTokenRequestToken:               os.Getenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN"),
+	}
+	authorizer, err := auth.NewAuthorizerFromCredentials(context.TODO(), credentials, environment.MSGraph)
+	if err != nil {
+		log.Fatalf("building authorizer from credentials: %+v", err)
+	}
+	// ..
+}
+```
+
+## Example: Authenticating using ADO Pipeline OIDC
+
+```go
+package main
+
+import (
+	"context"
+	"log"
+	"os"
+
+	"github.com/hashicorp/go-azure-sdk/sdk/auth"
+	"github.com/hashicorp/go-azure-sdk/sdk/environments"
+)
+
+func main() {
+	environment := environments.Public
+	credentials := auth.Credentials{
+		Environment:                              environment,
+		EnableAuthenticationUsingADOPipelineOIDC: true,
+		OIDCTokenRequestURL:                      os.Getenv("SYSTEM_OIDCREQUESTURI"),
+		OIDCTokenRequestToken:                    os.Getenv("SYSTEM_ACCESSTOKEN"),
+		ADOPipelineServiceConnectionID:           "<Service Connection ID>",
 	}
 	authorizer, err := auth.NewAuthorizerFromCredentials(context.TODO(), credentials, environment.MSGraph)
 	if err != nil {
@@ -167,4 +198,4 @@ func main() {
 	}
 	// ..
 }
-```
+```

sdk/auth/ado_pipeline_oidc_authorizer.go

@@ -0,0 +1,212 @@
+// Copyright (c) HashiCorp Inc. All rights reserved.
+// Licensed under the MPL-2.0 License. See NOTICE.txt in the project root for license information.
+
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+
+	"github.com/hashicorp/go-azure-sdk/sdk/environments"
+	"golang.org/x/oauth2"
+)
+
+const (
+	adoPipelineOIDCAPIVersion = "7.1"
+)
+
+type ADOPipelineOIDCAuthorizerOptions struct {
+	// Api describes the Azure API being used
+	Api environments.Api
+
+	// ClientId is the client ID used when authenticating
+	ClientId string
+
+	// ServiceConnectionId is the ADO service connection ID used when authenticating
+	ServiceConnectionId string
+
+	// Environment is the Azure environment/cloud being targeted
+	Environment environments.Environment
+
+	// TenantId is the tenant to authenticate against
+	TenantId string
+
+	// AuxiliaryTenantIds lists additional tenants to authenticate against, currently only
+	// used for Resource Manager when auxiliary tenants are needed.
+	// e.g. https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/authenticate-multi-tenant
+	AuxiliaryTenantIds []string
+
+	// IdTokenRequestUrl is the URL for the OIDC provider from which to request an ID token.
+	// Usually exposed via the SYSTEM_OIDCREQUESTURI environment variable when running in ADO Pipelines
+	IdTokenRequestUrl string
+
+	// IdTokenRequestToken is the bearer token for the request to the OIDC provider.
+	// Usually exposed via the SYSTEM_ACCESSTOKEN environment variable when running in ADO Pipelines
+	IdTokenRequestToken string
+}
+
+// NewADOPipelineOIDCAuthorizer returns an authorizer which acquires a client assertion from a ADO endpoint, then uses client assertion authentication to obtain an access token.
+func NewADOPipelineOIDCAuthorizer(ctx context.Context, options ADOPipelineOIDCAuthorizerOptions) (Authorizer, error) {
+	scope, err := environments.Scope(options.Api)
+	if err != nil {
+		return nil, fmt.Errorf("determining scope for %q: %+v", options.Api.Name(), err)
+	}
+
+	conf := adoPipelineOIDCConfig{
+		Environment:         options.Environment,
+		TenantID:            options.TenantId,
+		AuxiliaryTenantIDs:  options.AuxiliaryTenantIds,
+		ClientID:            options.ClientId,
+		ServiceConnectionID: options.ServiceConnectionId,
+		IDTokenRequestURL:   options.IdTokenRequestUrl,
+		IDTokenRequestToken: options.IdTokenRequestToken,
+		Scopes: []string{
+			*scope,
+		},
+	}
+
+	return conf.TokenSource(ctx)
+}
+
+var _ Authorizer = &ADOPipelineOIDCAuthorizer{}
+
+type ADOPipelineOIDCAuthorizer struct {
+	conf *adoPipelineOIDCConfig
+}
+
+func (a *ADOPipelineOIDCAuthorizer) adoPipelineAssertion(ctx context.Context, _ *http.Request) (*string, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, a.conf.IDTokenRequestURL, http.NoBody)
+	if err != nil {
+		return nil, fmt.Errorf("adoPipelineAssertion: failed to build request: %+v", err)
+	}
+
+	query, err := url.ParseQuery(req.URL.RawQuery)
+	if err != nil {
+		return nil, fmt.Errorf("adoPipelineAssertion: cannot parse URL query")
+	}
+	if query.Get("api-version") == "" {
+		query.Add("api-version", adoPipelineOIDCAPIVersion)
+	}
+	if query.Get("serviceConnectionId") == "" {
+		query.Add("serviceConnectionId", a.conf.ServiceConnectionID)
+	}
+	if query.Get("audience") == "" {
+		query.Add("audience", "api://AzureADTokenExchange")
+	}
+	req.URL.RawQuery = query.Encode()
+
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", a.conf.IDTokenRequestToken))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := Client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("adoPipelineAssertion: cannot request token: %v", err)
+	}
+
+	defer resp.Body.Close()
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if err != nil {
+		return nil, fmt.Errorf("adoPipelineAssertion: cannot parse response: %v", err)
+	}
+
+	if c := resp.StatusCode; c < 200 || c > 299 {
+		return nil, fmt.Errorf("adoPipelineAssertion: received HTTP status %d with response: %s", resp.StatusCode, body)
+	}
+
+	var tokenRes struct {
+		Value *string `json:"oidcToken"`
+	}
+	if err := json.Unmarshal(body, &tokenRes); err != nil {
+		return nil, fmt.Errorf("adoPipelineAssertion: cannot unmarshal response: %v", err)
+	}
+
+	return tokenRes.Value, nil
+}
+
+func (a *ADOPipelineOIDCAuthorizer) tokenSource(ctx context.Context, req *http.Request) (Authorizer, error) {
+	assertion, err := a.adoPipelineAssertion(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+	if assertion == nil {
+		return nil, fmt.Errorf("ADOPipelineOIDCAuthorizer: nil JWT assertion received from ADOPipeline")
+	}
+
+	conf := clientCredentialsConfig{
+		Environment:        a.conf.Environment,
+		TenantID:           a.conf.TenantID,
+		AuxiliaryTenantIDs: a.conf.AuxiliaryTenantIDs,
+		ClientID:           a.conf.ClientID,
+		FederatedAssertion: *assertion,
+		Scopes:             a.conf.Scopes,
+		TokenURL:           a.conf.TokenURL,
+		Audience:           a.conf.Audience,
+	}
+
+	source, err := conf.TokenSource(ctx, clientCredentialsAssertionType)
+	if err != nil {
+		return nil, fmt.Errorf("ADOPipelineOIDCAuthorizer: building Authorizer: %+v", err)
+	}
+	return source, nil
+}
+
+func (a *ADOPipelineOIDCAuthorizer) Token(ctx context.Context, req *http.Request) (*oauth2.Token, error) {
+	source, err := a.tokenSource(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+	return source.Token(ctx, req)
+}
+
+func (a *ADOPipelineOIDCAuthorizer) AuxiliaryTokens(ctx context.Context, req *http.Request) ([]*oauth2.Token, error) {
+	source, err := a.tokenSource(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+	return source.AuxiliaryTokens(ctx, req)
+}
+
+type adoPipelineOIDCConfig struct {
+	// Environment is the national cloud environment to use
+	Environment environments.Environment
+
+	// TenantID is the required tenant ID for the primary token
+	TenantID string
+
+	// AuxiliaryTenantIDs is an optional list of tenant IDs for which to obtain additional tokens
+	AuxiliaryTenantIDs []string
+
+	// ClientID is the application's ID.
+	ClientID string
+
+	// ServiceConnectionID is the ADO service connection ID used when authenticating
+	ServiceConnectionID string
+
+	// IDTokenRequestURL is the URL for ADO Pipeline's OIDC provider.
+	IDTokenRequestURL string
+
+	// IDTokenRequestToken is the bearer token for the request to the OIDC provider.
+	IDTokenRequestToken string
+
+	// Scopes specifies a list of requested permission scopes (used for v2 tokens)
+	Scopes []string
+
+	// TokenURL is the clientCredentialsToken endpoint, which overrides the default endpoint constructed from a tenant ID
+	TokenURL string
+
+	// Audience optionally specifies the intended audience of the
+	// request.  If empty, the value of TokenURL is used as the
+	// intended audience.
+	Audience string
+}
+
+func (c *adoPipelineOIDCConfig) TokenSource(ctx context.Context) (Authorizer, error) {
+	return NewCachedAuthorizer(&ADOPipelineOIDCAuthorizer{
+		conf: c,
+	})
+}

sdk/auth/ado_pipeline_oidc_authorizer_test.go

@@ -0,0 +1,98 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package auth_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/go-azure-sdk/sdk/auth"
+	"github.com/hashicorp/go-azure-sdk/sdk/environments"
+	"github.com/hashicorp/go-azure-sdk/sdk/internal/test"
+)
+
+func TestADOPipelineOIDCAuthorizer(t *testing.T) {
+	ctx := context.Background()
+	env := environments.AzurePublic()
+
+	mockHost := "ado-oidc-issuer"
+	auth.Client = &oidcMockClient{
+		authorization: *env.Authorization,
+		platform:      OidcMockClientPlatformADOPipeline,
+		mockHost:      mockHost,
+	}
+
+	idTokenRequestUrl := fmt.Sprintf("https://%s/vend-id-token", mockHost)
+	idTokenRequestToken := test.DummyAccessToken
+
+	opts := auth.ADOPipelineOIDCAuthorizerOptions{
+		Api:                 env.MicrosoftGraph,
+		AuxiliaryTenantIds:  test.AuxiliaryTenantIds,
+		ClientId:            "11111111-0000-0000-0000-000000000000",
+		Environment:         *env,
+		IdTokenRequestToken: idTokenRequestToken,
+		IdTokenRequestUrl:   idTokenRequestUrl,
+		ServiceConnectionId: "test-service-connection",
+		TenantId:            "00000000-1111-0000-0000-000000000000",
+	}
+
+	authorizer, err := auth.NewADOPipelineOIDCAuthorizer(ctx, opts)
+	if err != nil {
+		t.Fatalf("NewADOPipelineOIDCAuthorizer(): %v", err)
+	}
+
+	if authorizer == nil {
+		t.Fatal("authorizer is nil, expected Authorizer")
+	}
+
+	if _, err = testObtainAccessToken(ctx, authorizer); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestAccADOPipelineOIDCAuthorizer(t *testing.T) {
+	test.AccTest(t)
+
+	if test.OIDCRequestToken == "" {
+		t.Skip("test.OIDCRequestToken was empty")
+	}
+	if test.OIDCRequestURL == "" {
+		t.Skip("test.OIDCRequestURL was empty")
+	}
+	if test.ADOServiceConnectionId == "" {
+		t.Skip("test.ADOServiceConnectionId was empty")
+	}
+
+	ctx := context.Background()
+
+	env, err := environments.FromName(test.Environment)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	opts := auth.ADOPipelineOIDCAuthorizerOptions{
+		Api:                 env.MicrosoftGraph,
+		AuxiliaryTenantIds:  test.AuxiliaryTenantIds,
+		ClientId:            test.ClientId,
+		Environment:         *env,
+		TenantId:            test.TenantId,
+		IdTokenRequestUrl:   test.OIDCRequestURL,
+		IdTokenRequestToken: test.OIDCRequestToken,
+		ServiceConnectionId: test.ADOServiceConnectionId,
+	}
+
+	authorizer, err := auth.NewADOPipelineOIDCAuthorizer(ctx, opts)
+	if err != nil {
+		t.Fatalf("NewADOPipelineOIDCAuthorizer(): %v", err)
+	}
+
+	if authorizer == nil {
+		t.Fatal("authorizer is nil, expected Authorizer")
+	}
+
+	if _, err = testObtainAccessToken(ctx, authorizer); err != nil {
+		t.Fatal(err)
+	}
+}