Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support managed identities and service principals #1372

Merged
merged 8 commits into from
Aug 16, 2023
Merged

Support managed identities and service principals #1372

merged 8 commits into from
Aug 16, 2023

Commits on Aug 15, 2023

  1. x509: add utils to find certs by thumbprint

    @mjcheetham
    mjcheetham committed Aug 15, 2023
    Configuration menu
    Copy the full SHA
    6676986 View commit details
    Browse the repository at this point in the history

  2. msauth: rename GetTokenAsync to GetTokenForUserAsync 

    Rename the lone GetToken method to clarify that this is for user
principals (regular user identities). This is in preparation for adding
extra principal types including service principals, and managed
identities.

Also add some XML doc comments to the method.
    @mjcheetham
    mjcheetham committed Aug 15, 2023
    Configuration menu
    Copy the full SHA
    b627044 View commit details
    Browse the repository at this point in the history

  3. msauth: abstract token cache init helpers 

    Refactor the token cache helper methods to allow us to re-use the
existing cache registration logic with a different ITokenCache and
StorageCreationProperties.

This will be useful when we later introduce a confidential client
application (for service principals) that needs a different cache
location, and uses the AppTokenCache, rather than the User one.
    @mjcheetham
    mjcheetham committed Aug 15, 2023
    Configuration menu
    Copy the full SHA
    89b099e View commit details
    Browse the repository at this point in the history

  4. msauth: add support for service principal auth 

    Add support for acquiring a token for a service principal.
Either a client secret or certificate can be used to authenticate (the
latter being preferred).
    @mjcheetham
    mjcheetham committed Aug 15, 2023
    Configuration menu
    Copy the full SHA
    6a90c36 View commit details
    Browse the repository at this point in the history

  5. msauth: add support for managed identity 

    Add support for obtaining an access token using either the
system-assigned and a user-assigned managed identity.
    @mjcheetham
    mjcheetham committed Aug 15, 2023
    Configuration menu
    Copy the full SHA
    bfa87db View commit details
    Browse the repository at this point in the history

  6. msauth: add MSAL app token cache support for CCAs 

    Add app token cache support for confidential client applications
(service principals). This is a different cache than the one for user
tokens that is used by public client applications (for normal users).

We do not know of any other app token cache that we can share with
currently, so we just use our own in the GCM data directory.
    @mjcheetham
    mjcheetham committed Aug 15, 2023
    Configuration menu
    Copy the full SHA
    f00c859 View commit details
    Browse the repository at this point in the history

  7. azrepos: support service principals and managed IDs 

    Allow a service principal or managed identity to be used to
authenticate against Azure Repos. Required information for
service principals is specified in Git config or environment
variables, as is the ID for a managed identity.
    @mjcheetham
    mjcheetham committed Aug 15, 2023
    1 Configuration menu
    Copy the full SHA
    aafbda4 View commit details
    Browse the repository at this point in the history

  8. azrepos: add tests of MID and SP get credential 

    Add tests of the `GetCredentialAsync` method on the
`AzureReposHostProvider` using managed identity and service principal.
    @mjcheetham
    mjcheetham committed Aug 15, 2023
    Configuration menu
    Copy the full SHA
    eff4ea6 View commit details
    Browse the repository at this point in the history