-
Notifications
You must be signed in to change notification settings - Fork 2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Cosmos: preview for AAD support (#12622)
* Add initial implementation to pass an AAD token to the backend. * Address PR comments * Add AAD authorization test against Cosmos public emulator. Add implementation for missed cases where authorization token migt be computed. * update pom related dependency * update pom dependency * test updates * address PR feedback * address PR feedback * Bug fixes. * enable AAD auth in the Cosmos public emulator * update Cosmos emulator startup switch * update test case to separate access via different clients * Address PR feedback. * Remove constructor which creates unused Cosmos resources. * use HOST and MASTER_KEY for Cosmos connections; these will default to Cosmos public emulator settings. * Update test case expectations. * update Sping related test expectations. * Update Spring tests expectations and fix couple error cases when passing empty strings for endpoints and master keys. * Fix for scope resolution * comment out the test until the CI only failure running public emulator is understood. * update POM dependencies. * Fix merge related issue. * various fixes related to copy/clone of an existing Cosmos client instance. * update test to account for null values such as key, endpoint or credential properties.
- Loading branch information
Showing
21 changed files
with
756 additions
and
158 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
70 changes: 70 additions & 0 deletions
70
...ure-cosmos/src/main/java/com/azure/cosmos/implementation/AadTokenAuthorizationHelper.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| // Copyright (c) Microsoft Corporation. All rights reserved. | ||
| // Licensed under the MIT License. | ||
| package com.azure.cosmos.implementation; | ||
|
|
||
| import com.azure.core.credential.SimpleTokenCache; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
| import reactor.core.publisher.Mono; | ||
|
|
||
| import java.io.UnsupportedEncodingException; | ||
| import java.net.URLEncoder; | ||
|
|
||
| /** | ||
| * This class is used internally and act as a helper in authorization of | ||
| * AAD tokens and its supporting method. | ||
| * | ||
| */ | ||
| public class AadTokenAuthorizationHelper { | ||
| public static final String AAD_AUTH_SCHEMA_TYPE_SEGMENT = "type"; | ||
| public static final String AAD_AUTH_VERSION_SEGMENT = "ver"; | ||
| public static final String AAD_AUTH_SIGNATURE_SEGMENT = "sig"; | ||
| public static final String AAD_AUTH_SCHEMA_TYPE_VALUE = "aad"; | ||
| public static final String AAD_AUTH_VERSION_VALUE = "1.0"; | ||
| public static final String AAD_AUTH_TOKEN_COSMOS_SCOPE = "https://cosmos.azure.com/.default"; | ||
| private static final String AUTH_PREFIX = | ||
| AAD_AUTH_SCHEMA_TYPE_SEGMENT + "=" + AAD_AUTH_SCHEMA_TYPE_VALUE | ||
| + "&" | ||
| + AAD_AUTH_VERSION_SEGMENT + "=" + AAD_AUTH_VERSION_VALUE | ||
| + "&" | ||
| + AAD_AUTH_SIGNATURE_SEGMENT + "="; | ||
| private static final Logger logger = LoggerFactory.getLogger(AadTokenAuthorizationHelper.class); | ||
|
|
||
| /** | ||
| * This method will try to fetch the AAD token to access the resource and add it to the request headers. | ||
| * | ||
| * @param request the request headers. | ||
| * @param simpleTokenCache token cache that supports caching a token and refreshing it. | ||
| * @return the request headers with authorization header updated. | ||
| */ | ||
| public static Mono<RxDocumentServiceRequest> populateAuthorizationHeader(RxDocumentServiceRequest request, SimpleTokenCache simpleTokenCache) { | ||
| if (request == null || request.getHeaders() == null) { | ||
| throw new IllegalArgumentException("request"); | ||
| } | ||
| if (simpleTokenCache == null) { | ||
| throw new IllegalArgumentException("simpleTokenCache"); | ||
| } | ||
|
|
||
| return getAuthorizationToken(simpleTokenCache) | ||
| .map(authorization -> { | ||
| request.getHeaders().put(HttpConstants.HttpHeaders.AUTHORIZATION, authorization); | ||
| return request; | ||
| }); | ||
| } | ||
|
|
||
| public static Mono<String> getAuthorizationToken(SimpleTokenCache simpleTokenCache) { | ||
| return simpleTokenCache.getToken() | ||
| .map(accessToken -> { | ||
| String authorization; | ||
| String authorizationPayload = AUTH_PREFIX + accessToken.getToken(); | ||
|
|
||
| try { | ||
| authorization = URLEncoder.encode(authorizationPayload, "UTF-8"); | ||
| } catch (UnsupportedEncodingException e) { | ||
| throw new IllegalStateException("Failed to encode authorization token.", e); | ||
| } | ||
|
|
||
| return authorization; | ||
| }); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.