Skip to content

Commit ec9d2d7

Browse files
chlowellchlowell
authored
Client secret and certificate credentials support ESTS-R (Azure#18308)
1 parent fd8d667 commit ec9d2d7

File tree

5 files changed

+149
-3
lines changed

5 files changed

+149
-3
lines changed

‎sdk/azidentity/azidentity.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,9 @@ import (
2626
)
2727

2828
const (
29-
azureAuthorityHost = "AZURE_AUTHORITY_HOST"
30-
azureClientID = "AZURE_CLIENT_ID"
29+
azureAuthorityHost = "AZURE_AUTHORITY_HOST"
30+
azureClientID = "AZURE_CLIENT_ID"
31+
azureRegionalAuthorityName = "AZURE_REGIONAL_AUTHORITY_NAME"
3132

3233
organizationsTenantID = "organizations"
3334
developerSignOnClientID = "04b07795-8ddb-461a-bbee-02f9e1bf7b46"

‎sdk/azidentity/client_certificate_credential.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,10 @@ import (
1212
"crypto/rsa"
1313
"crypto/sha1"
1414
"crypto/x509"
15-
1615
"encoding/base64"
1716
"encoding/pem"
1817
"errors"
18+
"os"
1919

2020
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
2121
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
@@ -71,6 +71,7 @@ func NewClientCertificateCredential(tenantID string, clientID string, certs []*x
7171
o := []confidential.Option{
7272
confidential.WithAuthority(runtime.JoinPaths(authorityHost, tenantID)),
7373
confidential.WithHTTPClient(newPipelineAdapter(&options.ClientOptions)),
74+
confidential.WithAzureRegion(os.Getenv(azureRegionalAuthorityName)),
7475
}
7576
if options.SendCertificateChain {
7677
o = append(o, confidential.WithX5C())

‎sdk/azidentity/client_certificate_credential_test.go‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -244,3 +244,25 @@ func TestClientCertificateCredential_InvalidCertLive(t *testing.T) {
244244
t.Fatal("expected a non-nil RawResponse")
245245
}
246246
}
247+
248+
func TestClientCertificateCredential_Regional(t *testing.T) {
249+
t.Setenv(azureRegionalAuthorityName, "westus2")
250+
opts, stop := initRecording(t)
251+
defer stop()
252+
253+
f, err := os.ReadFile(liveSP.sniPath)
254+
if err != nil {
255+
t.Fatal(err)
256+
}
257+
cert, key, err := ParseCertificates(f, nil)
258+
if err != nil {
259+
t.Fatal(err)
260+
}
261+
cred, err := NewClientCertificateCredential(
262+
liveSP.tenantID, liveSP.clientID, cert, key, &ClientCertificateCredentialOptions{SendCertificateChain: true, ClientOptions: opts},
263+
)
264+
if err != nil {
265+
t.Fatal(err)
266+
}
267+
testGetTokenSuccess(t, cred)
268+
}

‎sdk/azidentity/client_secret_credential.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ package azidentity
99
import (
1010
"context"
1111
"errors"
12+
"os"
1213

1314
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
1415
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
@@ -47,6 +48,7 @@ func NewClientSecretCredential(tenantID string, clientID string, clientSecret st
4748
c, err := confidential.New(clientID, cred,
4849
confidential.WithAuthority(runtime.JoinPaths(authorityHost, tenantID)),
4950
confidential.WithHTTPClient(newPipelineAdapter(&options.ClientOptions)),
51+
confidential.WithAzureRegion(os.Getenv(azureRegionalAuthorityName)),
5052
)
5153
if err != nil {
5254
return nil, err

‎sdk/azidentity/testdata/recordings/TestClientCertificateCredential_Regional.json‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
{
2+
"Entries": [
3+
{
4+
"RequestUri": "https://westus2.r.login.microsoftonline.com/fake-tenant/v2.0/.well-known/openid-configuration",
5+
"RequestMethod": "GET",
6+
"RequestHeaders": {
7+
":method": "GET",
8+
"Accept-Encoding": "gzip",
9+
"User-Agent": "azsdk-go-azidentity/v1.0.1 (go1.18.3; linux)"
10+
},
11+
"RequestBody": null,
12+
"StatusCode": 200,
13+
"ResponseHeaders": {
14+
"Cache-Control": "max-age=86400, private",
15+
"Content-Length": "1245",
16+
"Content-Type": "application/json; charset=utf-8",
17+
"Date": "Thu, 02 Jun 2022 16:27:23 GMT",
18+
"P3P": "CP=\u0022DSP CUR OTPi IND OTRi ONL FIN\u0022",
19+
"Set-Cookie": "fpc=Alg0CxoeRidMjWt5yaT51Z4; expires=Sat, 02-Jul-2022 16:27:24 GMT; path=/; secure; HttpOnly; SameSite=None",
20+
"X-Content-Type-Options": "nosniff",
21+
"x-ms-ests-server": "2.1.12794.7 - WUS2 ProdSlices",
22+
"x-ms-request-id": "19ce7346-9009-4435-9704-b567248f0802",
23+
"X-XSS-Protection": "0"
24+
},
25+
"ResponseBody": {
26+
"token_endpoint": "https://westus2.r.login.microsoftonline.com/fake-tenant/oauth2/v2.0/token",
27+
"token_endpoint_auth_methods_supported": [
28+
"client_secret_post",
29+
"private_key_jwt",
30+
"client_secret_basic"
31+
],
32+
"jwks_uri": "https://westus2.r.login.microsoftonline.com/fake-tenant/discovery/v2.0/keys",
33+
"response_modes_supported": [
34+
"query",
35+
"fragment",
36+
"form_post"
37+
],
38+
"subject_types_supported": [
39+
"pairwise"
40+
],
41+
"id_token_signing_alg_values_supported": [
42+
"RS256"
43+
],
44+
"response_types_supported": [
45+
"code",
46+
"id_token",
47+
"code id_token",
48+
"id_token token"
49+
],
50+
"scopes_supported": [
51+
"openid",
52+
"profile",
53+
"email",
54+
"offline_access"
55+
],
56+
"issuer": "https://login.microsoftonline.com/fake-tenant/v2.0",
57+
"request_uri_parameter_supported": false,
58+
"userinfo_endpoint": "https://graph.microsoft.com/oidc/userinfo",
59+
"authorization_endpoint": "unsupported",
60+
"claims_supported": [
61+
"sub",
62+
"iss",
63+
"cloud_instance_name",
64+
"cloud_instance_host_name",
65+
"cloud_graph_host_name",
66+
"msgraph_host",
67+
"aud",
68+
"exp",
69+
"iat",
70+
"auth_time",
71+
"acr",
72+
"nonce",
73+
"tid",
74+
"ver",
75+
"at_hash",
76+
"c_hash"
77+
],
78+
"tenant_region_scope": "NA",
79+
"cloud_instance_name": "microsoftonline.com",
80+
"cloud_graph_host_name": "graph.windows.net",
81+
"msgraph_host": "graph.microsoft.com",
82+
"rbac_url": "https://pas.windows.net"
83+
}
84+
},
85+
{
86+
"RequestUri": "https://westus2.r.login.microsoftonline.com/fake-tenant/oauth2/v2.0/token",
87+
"RequestMethod": "POST",
88+
"RequestHeaders": {
89+
":method": "POST",
90+
"Accept-Encoding": "gzip",
91+
"Content-Length": "2",
92+
"Content-Type": "application/x-www-form-urlencoded; charset=utf-8",
93+
"User-Agent": "azsdk-go-azidentity/v1.0.1 (go1.18.3; linux)"
94+
},
95+
"RequestBody": {},
96+
"StatusCode": 200,
97+
"ResponseHeaders": {
98+
"Cache-Control": "no-store, no-cache",
99+
"Content-Length": "89",
100+
"Content-Type": "application/json; charset=utf-8",
101+
"Date": "Thu, 02 Jun 2022 16:27:23 GMT",
102+
"Expires": "-1",
103+
"P3P": "CP=\u0022DSP CUR OTPi IND OTRi ONL FIN\u0022",
104+
"Pragma": "no-cache",
105+
"Set-Cookie": "fpc=Alg0CxoeRidMjWt5yaT51Z4; expires=Sat, 02-Jul-2022 16:27:24 GMT; path=/; secure; HttpOnly; SameSite=None",
106+
"X-Content-Type-Options": "nosniff",
107+
"x-ms-ests-server": "2.1.12794.7 - WUS2 ProdSlices",
108+
"x-ms-request-id": "e32199b8-7d70-45ec-b403-d1b39593e301",
109+
"X-XSS-Protection": "0"
110+
},
111+
"ResponseBody": {
112+
"token_type": "Bearer",
113+
"expires_in": 3599,
114+
"ext_expires_in": 3599,
115+
"access_token": "redacted"
116+
}
117+
}
118+
],
119+
"Variables": {}
120+
}

0 commit comments

Comments
 (0)