auth: Support azure-pipelines for --federated-credential-provider
#4343
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ellismg
commented
Sep 18, 2024
ellismg
force-pushed
the
ellismg/support-azure-pipelines-auth
branch
4 times, most recently
from
6d6aec1
to
f22a1ca
Compare
vhvb1989
reviewed
Sep 19, 2024
ellismg
force-pushed
the
ellismg/support-azure-pipelines-auth
branch
2 times, most recently
from
0a257b5
to
2ee5a78
Compare
jongio
changed the title
ellismg
force-pushed
the
ellismg/support-azure-pipelines-auth
branch
2 times, most recently
from
cd2961b
to
5a7e72d
Compare
ellismg
force-pushed
the
ellismg/support-azure-pipelines-auth
branch
from
5a7e72d
to
f1d9cdc
Compare
ellismg
force-pushed
the
ellismg/support-azure-pipelines-auth
branch
from
62a7919
to
1a25a0e
Compare
danieljurek
reviewed
Nov 5, 2024
ellismg
changed the title
azure-pipelines for --federated-credential-provider
vhvb1989
approved these changes
Nov 5, 2024
This change adds `azure-pipelines` as a supported value for the
`--federated-credential-provider` switch of `azd auth login`. This
provider can be used to do OIDC based login within the context of a
job running in Azure Pipelines.
When using this provider, `azd` uses the `AzurePipelinesCredential`
type to manage the OIDC dance. In addition to the client and tenant id
of the service principal you plan to authenticate with, we also need
the "service connection id" (this is the ID of the object created in
Azure Pipelines that contains the connection information) and the
system access token which is the security token for the running build
(it's what is used to authenticate to the OIDC endpoint that is being
run inside the pipeline which we use to fetch the federated
credential). The client and tenant ids can be provided on the command
line, via the existing `--client-id` and `--tenant-id` switches, or,
when `azure-pipelines` is the `federated-credential-provider`, they
can be read from the `AZURESUBSCRIPTION_CLIENT_ID` and
`AZURESUBSCRIPTION_TEANT_ID` system environment varaibles. The
service connection ID and acceess token are read from the
`AZURESUBSCRIPTION_SERVICE_CONNECTION_ID` and `SYSTEM_ACCESSTOKEN`
environment variaibles.
These system environment variables correspond to what the `AzureCLI@2`
sets when passing the `azureSubscription` parameter (after translating
the service connection name to a service connection ID, which is
handy) allowing something like this to work:
```yaml
- task: AzureCLI@2
inputs:
azureSubscription: azconnection
scriptType: bash
scriptLocation: inlineScript
inlineScript: |
azd auth login --federated-credential-provider "azure-pipelines"
azd up
```
Note that while the AzureCLI task is used above, it's only used for
setting these environment variables and doing the service connection
name to id translation. You could do something like the following
instead:
```yaml
- bash: |
azd auth login --federated-credential-provider "azure-pipelines"
azd up
env:
AZURE_SUBSCRIPTION_CLIENT_ID: "Your Client ID"
AZURE_SUBSCRIPTION_TENANT_ID: "Your Tenant ID"
AZURE_SUBSCRIPTION_SERVICE_CONNECTION_ID: "Your Service Connection ID"
SYSTEM_ACCESSTOKEN: $(System.AccessToken)
```
And things will work as well. This can be useful in cases where you
can use the `AzureCLI@2` task directly.
We can consider writing our own task as some point as well.
Contributes To Azure#4341
ellismg
force-pushed
the
ellismg/support-azure-pipelines-auth
branch
from
1a25a0e
to
0c1313e
Compare
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
ellismg
added a commit
to ellismg/azure-dev
that referenced
this pull request
Nov 6, 2024
Now that `azd` supports OIDC in Azure Pipelines via Azure#4343, let's use it in the `build-cli` leg of CI. Since we now use OIDC, we can also migrate to the TME environment for the resources created during our tests, by using the new `azd-service-connection` service connection.
ellismg
added a commit
to ellismg/azure-dev
that referenced
this pull request
Nov 6, 2024
Now that `azd` supports OIDC in Azure Pipelines via Azure#4343, let's use it in the `build-cli` leg of CI. Since we now use OIDC, we can also migrate to the TME environment for the resources created during our tests, by using the new `azd-service-connection` service connection. Contributes To Azure#4341
ellismg
added a commit
to ellismg/azure-dev
that referenced
this pull request
Nov 7, 2024
Now that `azd` supports OIDC in Azure Pipelines via Azure#4343, let's use it in the `build-cli` leg of CI. Since we now use OIDC, we can also migrate to the TME environment for the resources created during our tests, by using the new `azd-service-connection` service connection. Contributes To Azure#4341
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This change adds
azure-pipelinesas a supported value for the--federated-credential-providerswitch ofazd auth login. This provider can be used to do OIDC based login within the context of a job running in Azure Pipelines.When using this provider,
azduses theAzurePipelinesCredentialtype to manage the OIDC dance. In addition to the client and tenant id of the service principal you plan to authenticate with, we also need the "service connection id" (this is the ID of the object created in Azure Pipelines that contains the connection information) and the system access token which is the security token for the running build (it's what is used to authenticate to the OIDC endpoint that is being run inside the pipeline which we use to fetch the federated credential). The client and tenant ids can be provided on the command line, via the existing--client-idand--tenant-idswitches, or, whenazure-pipelinesis thefederated-credential-provider, they can be read from theAZURESUBSCRIPTION_CLIENT_IDandAZURESUBSCRIPTION_TEANT_IDsystem environment varaibles. The service connection ID and acceess token are read from theAZURESUBSCRIPTION_SERVICE_CONNECTION_IDandSYSTEM_ACCESSTOKENenvironment variaibles.These system environment variables correspond to what the
AzureCLI@2sets when passing theazureSubscriptionparameter (after translating the service connection name to a service connection ID, which is handy) allowing something like this to work:Note that while the AzureCLI task is used above, it's only used for setting these environment variables and doing the service connection name to id translation. You could do something like the following instead:
And things will work as well. This can be useful in cases where you can use the
AzureCLI@2task directly.We can consider writing our own task as some point as well.
Contributes To #4341