Adds FederatedIdentityCredentials (FICS) request builders to Graph Client #1086

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Merged

wbreza merged 15 commits into Azure:main from wbreza:graph-fics

Nov 8, 2022

Contributor

wbreza commented Nov 3, 2022 •

edited by puicchan

Loading

Addresses #408

Adds request builders to manage federated identity credentials (fics) to Azure AD Graph applications.
Adds new --auth-type flag for azd pipeline config. Valid values: federated, client-credentials
Defaults github auth to Federated
Updates Github pipeline provider for Federated support

When auth type is Federated in a valid configuration, azd will create a federated identity credential on the new/updated service principal for the following subjects:

repo:${REPO}:ref:refs/heads/main
repo:${REPO}:pull_request

References

https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-portal%2Cwindows

Pipeline providers

Github

Auth Default: Federated
Supported Auth: Federated, ClientCredentials

Github secret configuration is different between Federated and ClientCredentials. The github workflow has been setup to test which secrets have been defined and then use the correct version of the az login command.

Azure DevOps

Auth Default: ClientCredentials
Supported Auth: ClientCredentials

Display error if --auth-type is explicitly set to Federated**(not supported)**

Provision Providers

Bicep

Auth Default: Federated
Supported Auth: Federated, ClientCredentials

Terraform

Auth Default: ClientSecret
Supported Auth: ClientCredentials

Display warning if --auth-type isn't defined (falling back to ClientCredentials)
Display error if --auth-type is explicitly set to Federated**(not supported)**

ghost assigned wbreza

wbreza changed the title ~~Adds FederatedIdentityCredentials request builders to Graph Client~~ Adds FederatedIdentityCredentials (FICS) request builders to Graph Client

weikanglim reviewed

View reviewed changes

cli/azd/cmd/pipeline.go Show resolved Hide resolved

Contributor

weikanglim commented Nov 4, 2022

Do you have a link to the issue that describes the requirements? Are we creating the oidc application or are we using one that is user-provided?

weikanglim reviewed

View reviewed changes

cli/azd/pkg/commands/pipeline/github_provider.go Outdated Show resolved Hide resolved

weikanglim reviewed

View reviewed changes

cli/azd/pkg/commands/pipeline/github_provider.go Show resolved Hide resolved

weikanglim reviewed

View reviewed changes

cli/azd/pkg/commands/pipeline/github_provider.go Outdated Show resolved Hide resolved

weikanglim reviewed

View reviewed changes

cli/azd/pkg/commands/pipeline/github_provider.go Show resolved Hide resolved

weikanglim reviewed

View reviewed changes

cli/azd/pkg/commands/pipeline/github_provider.go Outdated Show resolved Hide resolved

weikanglim reviewed

View reviewed changes

cli/azd/pkg/commands/pipeline/github_provider.go Outdated Show resolved Hide resolved

wbreza added cli feature labels

wbreza added this to the Backlog milestone

Contributor Author

wbreza commented Nov 7, 2022 •

edited

Loading

Do you have a link to the issue that describes the requirements? Are we creating the oidc application or are we using one that is user-provided?

Mentioned issue #408

wbreza marked this pull request as ready for review

November 7, 2022 22:23

wbreza requested review from ellismg, hemarina and vhvb1989 as code owners

November 7, 2022 22:23

wbreza force-pushed the graph-fics branch from 82176aa to 524aa99 Compare

November 7, 2022 22:24

wbreza added 7 commits

November 7, 2022 14:24


          Adds new fics request builders

07c465a


          Updates long lines

8f30ce3


          Adds support for oidc federeated credentials in pipeline config

f6490b0


          Updates github workflow to support both service principal and oidc

03686ef


          Addresses PR feedback.

30713c5


          Adds unit tests for new graph client request builders

13e48c3


          Addresses PR feedback

697fc67

wbreza force-pushed the graph-fics branch from 524aa99 to 697fc67 Compare

November 7, 2022 22:28

wbreza added 2 commits

November 7, 2022 14:47


          Renames 'oidc' to 'federated'

d1839c2


          Updates github workflow

b8e36b8

vhvb1989 reviewed

View reviewed changes

cli/azd/cmd/root.go Outdated Show resolved Hide resolved

cli/azd/pkg/commands/pipeline/azdo_provider.go Outdated Show resolved Hide resolved

cli/azd/pkg/commands/pipeline/github_provider.go Outdated Show resolved Hide resolved

cli/azd/pkg/commands/pipeline/github_provider.go Outdated Show resolved Hide resolved

cli/azd/pkg/commands/pipeline/github_provider.go Show resolved Hide resolved

wbreza added 4 commits

November 7, 2022 15:09


          Adds output formatting messages

d199acb


          Update github pipeline provider to default to client credentials for …

2d2455d

…terraform projects


          Adds validation check for --auth-type flag

281f885


          Fixes long long lint errors

cca4a50

jongio reviewed

View reviewed changes

.vscode/cspell.global.yaml Outdated Show resolved Hide resolved

jongio reviewed

View reviewed changes

cli/azd/pkg/commands/pipeline/github_provider.go Outdated Show resolved Hide resolved

jongio approved these changes

View reviewed changes

Member

jongio left a comment

Tested on Windows and todo-java-mongo. Works great!

vhvb1989 reviewed

View reviewed changes

cli/azd/pkg/commands/pipeline/github_provider.go Outdated Show resolved Hide resolved

wbreza added 2 commits

November 8, 2022 13:19


          Address PR feedback and moves auth type checks to preconfigcheck phase

d929b95


          Updates test name to fix cspell lint errors

dfcd921

Collaborator

azure-sdk commented Nov 8, 2022

Repoman Generation Results

Repoman pushed changes to remotes for the following projects:

Project: todo-csharp-cosmos-sql

Remote: azure-samples-staging

Branch: pr/1086

You can initialize this project with:

azd init -t Azure-Samples/todo-csharp-cosmos-sql -b pr/1086

View Changes | Compare Changes

Project: todo-csharp-sql-swa-func

Remote: azure-samples-staging

Branch: pr/1086

You can initialize this project with:

azd init -t Azure-Samples/todo-csharp-sql-swa-func -b pr/1086

View Changes | Compare Changes

Project: todo-csharp-sql

Remote: azure-samples-staging

Branch: pr/1086

You can initialize this project with:

azd init -t Azure-Samples/todo-csharp-sql -b pr/1086

View Changes | Compare Changes

Project: todo-java-mongo-aca

Remote: azure-samples-staging

Branch: pr/1086

You can initialize this project with:

azd init -t Azure-Samples/todo-java-mongo-aca -b pr/1086

View Changes | Compare Changes

Project: todo-java-mongo

Remote: azure-samples-staging

Branch: pr/1086

You can initialize this project with:

azd init -t Azure-Samples/todo-java-mongo -b pr/1086

View Changes | Compare Changes

Project: todo-nodejs-mongo-aca

Remote: azure-samples-staging

Branch: pr/1086

You can initialize this project with:

azd init -t Azure-Samples/todo-nodejs-mongo-aca -b pr/1086

View Changes | Compare Changes

Project: todo-nodejs-mongo-swa-func

Remote: azure-samples-staging

Branch: pr/1086

You can initialize this project with:

azd init -t Azure-Samples/todo-nodejs-mongo-swa-func -b pr/1086

View Changes | Compare Changes

Project: todo-nodejs-mongo

Remote: azure-samples-staging

Branch: pr/1086

You can initialize this project with:

azd init -t Azure-Samples/todo-nodejs-mongo -b pr/1086

View Changes | Compare Changes

Project: todo-python-mongo-aca

Remote: azure-samples-staging

Branch: pr/1086

You can initialize this project with:

azd init -t Azure-Samples/todo-python-mongo-aca -b pr/1086

View Changes | Compare Changes

Project: todo-python-mongo-swa-func

Remote: azure-samples-staging

Branch: pr/1086

You can initialize this project with:

azd init -t Azure-Samples/todo-python-mongo-swa-func -b pr/1086

View Changes | Compare Changes

Project: todo-python-mongo

Remote: azure-samples-staging

Branch: pr/1086

You can initialize this project with:

azd init -t Azure-Samples/todo-python-mongo -b pr/1086

View Changes | Compare Changes

Collaborator

azure-sdk commented Nov 8, 2022

Azure Dev CLI Install Instructions

Install scripts

MacOS/Linux

May elevate using sudo on some platforms and configurations

bash:

curl -fsSL https://azuresdkreleasepreview.blob.core.windows.net/azd/standalone/pr/1086/uninstall-azd.sh | bash;
curl -fsSL https://azuresdkreleasepreview.blob.core.windows.net/azd/standalone/pr/1086/install-azd.sh | bash -s -- --base-url https://azuresdkreleasepreview.blob.core.windows.net/azd/standalone/pr/1086 --version '' --verbose

pwsh:

Invoke-RestMethod 'https://azuresdkreleasepreview.blob.core.windows.net/azd/standalone/pr/1086/uninstall-azd.ps1' -OutFile uninstall-azd.ps1; ./uninstall-azd.ps1
Invoke-RestMethod 'https://azuresdkreleasepreview.blob.core.windows.net/azd/standalone/pr/1086/install-azd.ps1' -OutFile install-azd.ps1; ./install-azd.ps1 -BaseUrl 'https://azuresdkreleasepreview.blob.core.windows.net/azd/standalone/pr/1086' -Version '' -Verbose

Windows

powershell -c "Set-ExecutionPolicy Bypass Process; irm 'https://azuresdkreleasepreview.blob.core.windows.net/azd/standalone/pr/1086/uninstall-azd.ps1' > uninstall-azd.ps1; ./uninstall-azd.ps1;"
powershell -c "Set-ExecutionPolicy Bypass Process; irm 'https://azuresdkreleasepreview.blob.core.windows.net/azd/standalone/pr/1086/install-azd.ps1' > install-azd.ps1; ./install-azd.ps1 -BaseUrl 'https://azuresdkreleasepreview.blob.core.windows.net/azd/standalone/pr/1086' -Version '' -Verbose;"

Standalone Binary

Container

docker run -it azdevcliextacr.azurecr.io/azure-dev:pr-1086

ellismg approved these changes

View reviewed changes

Member

ellismg left a comment

Awesome to see this coming online! Code changes look great. A small question about the pipeline configuration. Excited for our secret-less future!

templates/common/.github/workflows/bicep/azure-dev.yml Show resolved Hide resolved

vhvb1989 approved these changes

View reviewed changes

Member

vhvb1989 left a comment

Awesome! thank you!

wbreza merged commit 1431693 into Azure:main

wbreza deleted the graph-fics branch

November 8, 2022 23:39

wbreza mentioned this pull request

Update docs for federated identity credentials #1149

Closed

This was referenced Jan 16, 2023

[Issue] AZURE_CREDENTIALS not set in new Github workflow, login fails #1399

Closed

Update Github deploy workflow tonybaloney/django-on-azure#21

Merged

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels