Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update identity to enable live testing in sovereign clouds for multiple services #19203

Merged
merged 17 commits into from
May 4, 2021
Merged

Update identity to enable live testing in sovereign clouds for multiple services #19203

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
9cd679b
only identity change
Luyunmt Mar 4, 2021
577644a
resolve error
Luyunmt Mar 4, 2021
69cab39
change hardcode string
Luyunmt Mar 5, 2021
6892b9c
change to supportedclouds
Luyunmt Mar 31, 2021
570b5e1
remove hardcode
Luyunmt Apr 6, 2021
0d371ce
remove change
Luyunmt Apr 6, 2021
75cc7ff
remove hardcode
Luyunmt Apr 7, 2021
2f5cad9
change to have the default in a common place
Luyunmt Apr 7, 2021
ff57162
merge change
Luyunmt Apr 7, 2021
f9d4618
Remove the StartsWith
zedy-wj Apr 13, 2021
4746cc7
Remove the TestEnvironment.KeyvaultScope
zedy-wj Apr 13, 2021
ded7fd9
Remove change
zedy-wj Apr 14, 2021
e2b88a3
add hardcode string
zedy-wj Apr 14, 2021
dd4a233
resolve conflicts
v-xuto Apr 26, 2021
638c05a
Delete TestEnvVar file.
zedy-wj Apr 26, 2021
912ce82
Remove hardcoded value of KeyvaultScope, add a initial value for it
zedy-wj Apr 27, 2021
bafe9ae
Remove invalid changes.
zedy-wj Apr 29, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion sdk/core/Azure.Core.TestFramework/src/TestEnvironment.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,7 @@ static TestEnvironment()
/// <summary>
/// The URL of the Azure Authority host to be used for authentication. Recorded.
/// </summary>
public string AuthorityHostUrl => GetRecordedOptionalVariable("AZURE_AUTHORITY_HOST");
public string AuthorityHostUrl => GetRecordedOptionalVariable("AZURE_AUTHORITY_HOST") ?? AzureAuthorityHosts.AzurePublicCloud.ToString();

/// <summary>
/// The suffix for Azure Storage accounts for the active cloud environment, such as "core.windows.net". Recorded.
Expand Down
9 changes: 5 additions & 4 deletions sdk/identity/Azure.Identity/tests/ClientCertificateCredentialLiveTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
// Copyright (c) Microsoft Corporation. All rights reserved.
// Licensed under the MIT License.

using System;
using System.IO;
using System.Security.Cryptography.X509Certificates;
using System.Threading.Tasks;
Expand Down Expand Up @@ -35,7 +36,7 @@ public async Task FromCertificatePath(bool usePem)

var credential = InstrumentClient(new ClientCertificateCredential(tenantId, clientId, certPath, options));

var tokenRequestContext = new TokenRequestContext(new[] { AzureAuthorityHosts.GetDefaultScope(AzureAuthorityHosts.AzurePublicCloud) });
var tokenRequestContext = new TokenRequestContext(new[] { AzureAuthorityHosts.GetDefaultScope(new Uri(TestEnvironment.AuthorityHostUrl)) });

// ensure we can initially acquire a token
AccessToken token = await credential.GetTokenAsync(tokenRequestContext);
Expand Down Expand Up @@ -70,7 +71,7 @@ public async Task FromX509Certificate2()

var credential = InstrumentClient(new ClientCertificateCredential(tenantId, clientId, cert, options));

var tokenRequestContext = new TokenRequestContext(new[] { AzureAuthorityHosts.GetDefaultScope(AzureAuthorityHosts.AzurePublicCloud) });
var tokenRequestContext = new TokenRequestContext(new[] { AzureAuthorityHosts.GetDefaultScope(new Uri(TestEnvironment.AuthorityHostUrl)) });

// ensure we can initially acquire a token
AccessToken token = await credential.GetTokenAsync(tokenRequestContext);
Expand Down Expand Up @@ -105,7 +106,7 @@ public async Task IncludeX5CClaimHeader()

var credential = InstrumentClient(new ClientCertificateCredential(tenantId, clientId, certPath, options));

var tokenRequestContext = new TokenRequestContext(new[] { AzureAuthorityHosts.GetDefaultScope(AzureAuthorityHosts.AzurePublicCloud) });
var tokenRequestContext = new TokenRequestContext(new[] { AzureAuthorityHosts.GetDefaultScope(new Uri(TestEnvironment.AuthorityHostUrl)) });

// ensure we can initially acquire a token
AccessToken token = await credential.GetTokenAsync(tokenRequestContext);
Expand All @@ -124,7 +125,7 @@ public void IncorrectCertificate()

var credential = InstrumentClient(new ClientCertificateCredential(tenantId, clientId, new X509Certificate2(certPath), options));

var tokenRequestContext = new TokenRequestContext(new[] { AzureAuthorityHosts.GetDefaultScope(AzureAuthorityHosts.AzurePublicCloud) });
var tokenRequestContext = new TokenRequestContext(new[] { AzureAuthorityHosts.GetDefaultScope(new Uri(TestEnvironment.AuthorityHostUrl)) });

// ensure the incorrect client claim is rejected, handled and wrapped in AuthenticationFailedException
Assert.ThrowsAsync<AuthenticationFailedException>(async () => await credential.GetTokenAsync(tokenRequestContext));
Expand Down
5 changes: 3 additions & 2 deletions sdk/identity/Azure.Identity/tests/ClientSecretCredentialLiveTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
// Copyright (c) Microsoft Corporation. All rights reserved.
// Licensed under the MIT License.

using System;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Core.TestFramework;
Expand Down Expand Up @@ -32,7 +33,7 @@ public async Task GetToken()

var credential = InstrumentClient(new ClientSecretCredential(tenantId, clientId, secret, options));

var tokenRequestContext = new TokenRequestContext(new[] { AzureAuthorityHosts.GetDefaultScope(AzureAuthorityHosts.AzurePublicCloud) });
var tokenRequestContext = new TokenRequestContext(new[] { AzureAuthorityHosts.GetDefaultScope(new Uri(TestEnvironment.AuthorityHostUrl)) });

// ensure we can initially acquire a token
AccessToken token = await credential.GetTokenAsync(tokenRequestContext);
Expand Down Expand Up @@ -66,7 +67,7 @@ public void GetTokenIncorrectPassword()

var credential = InstrumentClient(new ClientSecretCredential(tenantId, clientId, secret, options));

var tokenRequestContext = new TokenRequestContext(new[] { AzureAuthorityHosts.GetDefaultScope(AzureAuthorityHosts.AzurePublicCloud) });
var tokenRequestContext = new TokenRequestContext(new[] { AzureAuthorityHosts.GetDefaultScope(new Uri(TestEnvironment.AuthorityHostUrl)) });

// ensure we can initially acquire a token
Assert.ThrowsAsync<AuthenticationFailedException>(async () => await credential.GetTokenAsync(tokenRequestContext));
Expand Down
4 changes: 3 additions & 1 deletion sdk/identity/Azure.Identity/tests/CredentialTestHelpers.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,13 +135,15 @@ public static async Task<string> GetRefreshTokenAsync(IdentityTestEnvironment te
var clientId = "aebc6443-996d-45c2-90f0-388ff96faa56";
var username = testEnvironment.Username;
var password = testEnvironment.Password;
var authorityUri = new Uri(new Uri(testEnvironment.AuthorityHostUrl), testEnvironment.TestTenantId).ToString();

var client = PublicClientApplicationBuilder.Create(clientId)
.WithAuthority(authorityUri)
.WithTenantId(testEnvironment.TestTenantId)
.Build();

var retriever = new RefreshTokenRetriever(client.UserTokenCache);
await client.AcquireTokenByUsernamePassword(new[] {".default"}, username, password.ToSecureString()).ExecuteAsync();
await client.AcquireTokenByUsernamePassword(new[] { ".default" }, username, password.ToSecureString()).ExecuteAsync();

StaticCachesUtilities.ClearStaticMetadataProviderCache();
StaticCachesUtilities.ClearAuthorityEndpointResolutionManagerCache();
Expand Down
16 changes: 9 additions & 7 deletions sdk/identity/Azure.Identity/tests/DefaultAzureCredentialLiveTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ public async Task DefaultAzureCredential_UseVisualStudioCredential()

using (ClientDiagnosticListener diagnosticListener = new ClientDiagnosticListener(s => s.StartsWith("Azure.Identity")))
{
token = await credential.GetTokenAsync(new TokenRequestContext(new[] {"https://vault.azure.net/.default"}), CancellationToken.None);
token = await credential.GetTokenAsync(new TokenRequestContext(new[] {TestEnvironment.KeyvaultScope}), CancellationToken.None);
scopes = diagnosticListener.Scopes;
}

Expand All @@ -66,6 +66,7 @@ public async Task DefaultAzureCredential_UseVisualStudioCodeCredential()
ExcludeEnvironmentCredential = true,
ExcludeInteractiveBrowserCredential = true,
ExcludeSharedTokenCacheCredential = true,
ExcludeManagedIdentityCredential = true,
VisualStudioCodeTenantId = TestEnvironment.TestTenantId
});

Expand All @@ -82,7 +83,7 @@ public async Task DefaultAzureCredential_UseVisualStudioCodeCredential()
using (await CredentialTestHelpers.CreateRefreshTokenFixtureAsync(TestEnvironment, Mode, ExpectedServiceName, cloudName))
using (ClientDiagnosticListener diagnosticListener = new ClientDiagnosticListener(s => s.StartsWith("Azure.Identity")))
{
token = await credential.GetTokenAsync(new TokenRequestContext(new[] {"https://vault.azure.net/.default"}), CancellationToken.None);
token = await credential.GetTokenAsync(new TokenRequestContext(new[] {TestEnvironment.KeyvaultScope}), CancellationToken.None);
scopes = diagnosticListener.Scopes;
}

Expand All @@ -102,6 +103,7 @@ public async Task DefaultAzureCredential_UseVisualStudioCodeCredential_ParallelC
ExcludeEnvironmentCredential = true,
ExcludeInteractiveBrowserCredential = true,
ExcludeSharedTokenCacheCredential = true,
ExcludeManagedIdentityCredential = true,
VisualStudioCodeTenantId = TestEnvironment.TestTenantId
});

Expand All @@ -117,7 +119,7 @@ public async Task DefaultAzureCredential_UseVisualStudioCodeCredential_ParallelC
{
for (int i = 0; i < 10; i++)
{
tasks.Add(Task.Run(async () => await credential.GetTokenAsync(new TokenRequestContext(new[] {"https://vault.azure.net/.default"}), CancellationToken.None)));
tasks.Add(Task.Run(async () => await credential.GetTokenAsync(new TokenRequestContext(new[] {TestEnvironment.KeyvaultScope}), CancellationToken.None)));
}

await Task.WhenAll(tasks);
Expand Down Expand Up @@ -153,7 +155,7 @@ public async Task DefaultAzureCredential_UseAzureCliCredential()

using (ClientDiagnosticListener diagnosticListener = new ClientDiagnosticListener(s => s.StartsWith("Azure.Identity")))
{
token = await credential.GetTokenAsync(new TokenRequestContext(new[] {"https://vault.azure.net/.default"}), CancellationToken.None);
token = await credential.GetTokenAsync(new TokenRequestContext(new[] {TestEnvironment.KeyvaultScope}), CancellationToken.None);
scopes = diagnosticListener.Scopes;
}

Expand Down Expand Up @@ -187,7 +189,7 @@ public async Task DefaultAzureCredential_UseAzureCliCredential_ParallelCalls()
var tasks = new List<Task<AccessToken>>();
for (int i = 0; i < 10; i++)
{
tasks.Add(Task.Run(async () => await credential.GetTokenAsync(new TokenRequestContext(new[] {"https://vault.azure.net/.default"}), CancellationToken.None)));
tasks.Add(Task.Run(async () => await credential.GetTokenAsync(new TokenRequestContext(new[] {TestEnvironment.KeyvaultScope}), CancellationToken.None)));
}

await Task.WhenAll(tasks);
Expand Down Expand Up @@ -218,7 +220,7 @@ public void DefaultAzureCredential_AllCredentialsHaveFailed_CredentialUnavailabl

using (ClientDiagnosticListener diagnosticListener = new ClientDiagnosticListener(s => s.StartsWith("Azure.Identity")))
{
Assert.CatchAsync<CredentialUnavailableException>(async () => await credential.GetTokenAsync(new TokenRequestContext(new[] {"https://vault.azure.net/.default"}), CancellationToken.None));
Assert.CatchAsync<CredentialUnavailableException>(async () => await credential.GetTokenAsync(new TokenRequestContext(new[] {TestEnvironment.KeyvaultScope}), CancellationToken.None));
scopes = diagnosticListener.Scopes;
}

Expand Down Expand Up @@ -274,7 +276,7 @@ public void DefaultAzureCredential_AllCredentialsHaveFailed_LastAuthenticationFa

using (ClientDiagnosticListener diagnosticListener = new ClientDiagnosticListener(s => s.StartsWith("Azure.Identity")))
{
Assert.CatchAsync<AuthenticationFailedException>(async () => await credential.GetTokenAsync(new TokenRequestContext(new[] {"https://vault.azure.net/.default"}), CancellationToken.None));
Assert.CatchAsync<AuthenticationFailedException>(async () => await credential.GetTokenAsync(new TokenRequestContext(new[] {TestEnvironment.KeyvaultScope}), CancellationToken.None));
scopes = diagnosticListener.Scopes;
}

Expand Down
15 changes: 9 additions & 6 deletions sdk/identity/Azure.Identity/tests/DeviceCodeCredentialTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,6 +176,7 @@ public async Task AuthenticateWithDeviceCodeMockVerifyCallbackCancellationAsync(
[Test]
public void AuthenticateWithDeviceCodeCallbackThrowsAsync()
{
IdentityTestEnvironment testEnvironment = new IdentityTestEnvironment();
var expectedCode = Guid.NewGuid().ToString();

var expectedToken = Guid.NewGuid().ToString();
Expand All @@ -188,19 +189,20 @@ public void AuthenticateWithDeviceCodeCallbackThrowsAsync()

var cred = InstrumentClient(new DeviceCodeCredential(ThrowingDeviceCodeCallback, ClientId, options: options));

var ex = Assert.ThrowsAsync<AuthenticationFailedException>(async () => await cred.GetTokenAsync(new TokenRequestContext(new string[] { "https://vault.azure.net/.default" }), cancelSource.Token));
var ex = Assert.ThrowsAsync<AuthenticationFailedException>(async () => await cred.GetTokenAsync(new TokenRequestContext(new string[] { testEnvironment.KeyvaultScope }), cancelSource.Token));

Assert.IsInstanceOf(typeof(MockException), ex.InnerException);
}

[Test]
public void DisableAutomaticAuthenticationException()
{
IdentityTestEnvironment testEnvironment = new IdentityTestEnvironment();
var expectedCode = Guid.NewGuid().ToString();

var cred = InstrumentClient(new DeviceCodeCredential(new DeviceCodeCredentialOptions { DisableAutomaticAuthentication = true, DeviceCodeCallback = (code, cancelToken) => VerifyDeviceCode(code, expectedCode) }));

var expTokenRequestContext = new TokenRequestContext(new string[] { "https://vault.azure.net/.default" }, Guid.NewGuid().ToString());
var expTokenRequestContext = new TokenRequestContext(new string[] { testEnvironment.KeyvaultScope }, Guid.NewGuid().ToString());

var ex = Assert.ThrowsAsync<AuthenticationRequiredException>(async () => await cred.GetTokenAsync(expTokenRequestContext));

Expand All @@ -209,24 +211,25 @@ public void DisableAutomaticAuthenticationException()

private MockResponse ProcessMockRequest(MockRequest mockRequest, string code, string token)
{
IdentityTestEnvironment testEnvironment = new IdentityTestEnvironment();
string requestUrl = mockRequest.Uri.ToUri().AbsoluteUri;

if (requestUrl.StartsWith("https://login.microsoftonline.com/common/discovery/instance"))
if (requestUrl.StartsWith(new Uri(new Uri(testEnvironment.AuthorityHostUrl), "common/discovery/instance").ToString()))
{
return DiscoveryInstanceResponse;
}

if (requestUrl.StartsWith("https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration"))
if (requestUrl.StartsWith(new Uri(new Uri(testEnvironment.AuthorityHostUrl), "organizations/v2.0/.well-known/openid-configuration").ToString()))
{
return OpenIdConfigurationResponse;
}

if (requestUrl.StartsWith("https://login.microsoftonline.com/organizations/oauth2/v2.0/devicecode"))
if (requestUrl.StartsWith(new Uri(new Uri(testEnvironment.AuthorityHostUrl), "organizations/oauth2/v2.0/devicecode").ToString()) || requestUrl.StartsWith("https://login.partner.microsoftonline.cn/organizations/oauth2/v2.0/devicecode"))
{
return CreateDeviceCodeResponse(code);
}

if (requestUrl.StartsWith("https://login.microsoftonline.com/organizations/oauth2/v2.0/token"))
if (requestUrl.StartsWith(new Uri(new Uri(testEnvironment.AuthorityHostUrl), "organizations/oauth2/v2.0/token").ToString()) || requestUrl.StartsWith($"https://login.partner.microsoftonline.cn/organizations/oauth2/v2.0/token"))
{
return CreateTokenResponse(code, token);
}
Expand Down
1 change: 1 addition & 0 deletions sdk/identity/Azure.Identity/tests/IdentityTestEnvironment.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ public class IdentityTestEnvironment : TestEnvironment

public string TestPassword => GetOptionalVariable("AZURE_IDENTITY_TEST_PASSWORD") ?? "SANITIZED";
public string TestTenantId => GetRecordedOptionalVariable("TENANT_ID") ?? GetRecordedVariable("AZURE_IDENTITY_TEST_TENANTID");
public string KeyvaultScope => GetOptionalVariable("AZURE_KEYVAULT_SCOPE") ?? "https://vault.azure.net/.default";
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should also not be hardcoded in the test code, but rather the ARM template config and live test config.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, please adding AZURE_KEYVAULT_SCOPE to the public subscription config.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated.

Copy link
Contributor Author

@Luyunmt Luyunmt Apr 6, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If removing ?? "https://vault.azure.net/.default" or ?? AzureAuthorityHosts.AzurePublicCloud.ToString() , some tests will fail. Because when running on Public cloud, now KeyvaultScope and AuthorityHostUrl is null leading to tests failed. The reason is AZURE_KEYVAULT_SCOPE and AZURE_AUTHORITY_HOST are still not in the ARM template config and live test config.

Copy link
Member

@benbp benbp Apr 6, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's in the config, so it's odd that it's not showing up. But I think it's fine to have the default in a common place here regardless for local testing.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pakrym pointed out that this value gets defaulted even outside of the sub config: https://github.com/Azure/azure-sdk-tools/blob/master/eng/common/TestResources/New-TestResources.ps1#L492, so I don't think we need the default here at all, but am not sure why it's showing empty for you.

Copy link
Contributor

@pakrym pakrym Apr 6, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In addition this variable is used in the recorded test as an input so we might need to use the GetRecordedVariable so we can play the test back in any environment.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See https://dev.azure.com/azure-sdk/public/_build/results?buildId=828673&view=results, if removing it tests will fail. Also regardless for local testing ,so I change to have the default in a common place here.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See https://dev.azure.com/azure-sdk/public/_build/results?buildId=828673&view=results, if removing it tests will fail. Also regardless for local testing ,so I change to have the default in a common place here.


public string ServicePrincipalClientId => GetRecordedVariable("IDENTITY_SP_CLIENT_ID");
public string ServicePrincipalTenantId => GetRecordedVariable("IDENTITY_SP_TENANT_ID");
Expand Down
4 changes: 2 additions & 2 deletions sdk/identity/Azure.Identity/tests/UsernamePasswordCredentialLiveTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ public async Task GetToken()

var cred = InstrumentClient(new UsernamePasswordCredential(username, password, tenantId, ClientId, options));

AccessToken token = await cred.GetTokenAsync(new TokenRequestContext(new string[] { "https://vault.azure.net/.default" }));
AccessToken token = await cred.GetTokenAsync(new TokenRequestContext(new string[] { TestEnvironment.KeyvaultScope }));

Assert.IsNotNull(token.Token);
}
Expand Down Expand Up @@ -107,7 +107,7 @@ public async Task AuthenticateWithContext()

var cred = InstrumentClient(new UsernamePasswordCredential(username, password, tenantId, ClientId, options));

AuthenticationRecord record = await cred.AuthenticateAsync(new TokenRequestContext(new[] { "https://vault.azure.net/.default" }));
AuthenticationRecord record = await cred.AuthenticateAsync(new TokenRequestContext(new[] { TestEnvironment.KeyvaultScope }));

Assert.IsNotNull(record);

Expand Down
Loading