ServiceBus SDK: Rbac support

sdk/servicebus/Microsoft.Azure.ServiceBus/src/Primitives/AzureActiveDirectoryTokenProvider.cs

@@ -5,59 +5,28 @@ namespace Microsoft.Azure.ServiceBus.Primitives
 {
     using System;
     using System.Threading.Tasks;
-    using Microsoft.IdentityModel.Clients.ActiveDirectory;
 
     /// <summary>
     /// Represents the Azure Active Directory token provider for the Service Bus.
     /// </summary>
     public class AzureActiveDirectoryTokenProvider : TokenProvider
     {
-        readonly AuthenticationContext authContext;
-        readonly ClientCredential clientCredential;
-#if !UAP10_0
-        readonly ClientAssertionCertificate clientAssertionCertificate;
-#endif
-        readonly string clientId;
-        readonly Uri redirectUri;
-        readonly IPlatformParameters platformParameters;
-        readonly UserIdentifier userIdentifier;
-
-        enum AuthType
-        {
-            ClientCredential,
-            UserPasswordCredential,
-            ClientAssertionCertificate,
-            InteractiveUserLogin
-        }
+        /// <summary>
+        /// Common authority for Azure Active Directory.
+        /// </summary>
+        public const string CommonAuthority = "https://login.microsoftonline.com/common";
 
-        readonly AuthType authType;
+        readonly string authority;
+        readonly object authCallbackState;
+        event AuthenticationCallback AuthCallback;
 
-        internal AzureActiveDirectoryTokenProvider(AuthenticationContext authContext, ClientCredential credential)
-        {
-            this.clientCredential = credential;
-            this.authContext = authContext;
-            this.authType = AuthType.ClientCredential;
-            this.clientId = clientCredential.ClientId;
-        }
+        public delegate Task<string> AuthenticationCallback(string audience, string authority, object state);
 
-#if !UAP10_0
-        internal AzureActiveDirectoryTokenProvider(AuthenticationContext authContext, ClientAssertionCertificate clientAssertionCertificate)
+        internal AzureActiveDirectoryTokenProvider(AuthenticationCallback authenticationCallback, string authority, object state)
         {
-            this.clientAssertionCertificate = clientAssertionCertificate;
-            this.authContext = authContext;
-            this.authType = AuthType.ClientAssertionCertificate;
-            this.clientId = clientAssertionCertificate.ClientId;
-        }
-#endif
-
-        internal AzureActiveDirectoryTokenProvider(AuthenticationContext authContext, string clientId, Uri redirectUri, IPlatformParameters platformParameters, UserIdentifier userIdentifier)
-        {
-            this.authContext = authContext;
-            this.clientId = clientId;
-            this.redirectUri = redirectUri;
-            this.platformParameters = platformParameters;
-            this.userIdentifier = userIdentifier;
-            this.authType = AuthType.InteractiveUserLogin;
+            this.authority = authority;
+            this.AuthCallback = authenticationCallback;
+            this.authCallbackState = state;
         }
 
         /// <summary>
@@ -68,29 +37,8 @@ internal AzureActiveDirectoryTokenProvider(AuthenticationContext authContext, st
         /// <returns><see cref="SecurityToken"/></returns>
         public override async Task<SecurityToken> GetTokenAsync(string appliesTo, TimeSpan timeout)
         {
-            AuthenticationResult authResult;
-
-            switch (this.authType)
-            {
-                case AuthType.ClientCredential:
-                    authResult = await this.authContext.AcquireTokenAsync(Constants.AadServiceBusAudience, this.clientCredential);
-                    break;
-
-#if !UAP10_0
-                case AuthType.ClientAssertionCertificate:
-                    authResult = await this.authContext.AcquireTokenAsync(Constants.AadServiceBusAudience, this.clientAssertionCertificate);
-                    break;
-#endif
-
-                case AuthType.InteractiveUserLogin:
-                    authResult = await this.authContext.AcquireTokenAsync(Constants.AadServiceBusAudience, this.clientId, this.redirectUri, this.platformParameters, this.userIdentifier);
-                    break;
-
-                default:
-                    throw new NotSupportedException();
-            }
-
-            return new JsonSecurityToken(authResult.AccessToken, appliesTo);
+            var tokenString = await this.AuthCallback(appliesTo, this.authority, this.authCallbackState).ConfigureAwait(false);
+            return new JsonSecurityToken(tokenString, appliesTo);
         }
     }
 }

sdk/servicebus/Microsoft.Azure.ServiceBus/src/Primitives/ManagedServiceIdentityTokenProvider.cs → sdk/servicebus/Microsoft.Azure.ServiceBus/src/Primitives/ManagedIdentityTokenProvider.cs

@@ -10,7 +10,7 @@ namespace Microsoft.Azure.ServiceBus.Primitives
     /// <summary>
     /// Represents the Azure Active Directory token provider for Azure Managed Service Identity integration.
     /// </summary>
-    public class ManagedServiceIdentityTokenProvider : TokenProvider
+    public class ManagedIdentityTokenProvider : TokenProvider
     {
         static AzureServiceTokenProvider azureServiceTokenProvider = new AzureServiceTokenProvider();
 

sdk/servicebus/Microsoft.Azure.ServiceBus/src/Primitives/TokenProvider.cs

@@ -5,7 +5,6 @@ namespace Microsoft.Azure.ServiceBus.Primitives
 {
     using System;
     using System.Threading.Tasks;
-    using Microsoft.IdentityModel.Clients.ActiveDirectory;
 
     /// <summary>
     /// This abstract base class can be extended to implement additional token providers.
@@ -74,88 +73,28 @@ public static TokenProvider CreateSharedAccessSignatureTokenProvider(string keyN
             return new SharedAccessSignatureTokenProvider(keyName, sharedAccessKey, tokenTimeToLive, tokenScope);
         }
 
-        /// <summary>Creates an Azure Active Directory token provider.</summary>
-        /// <param name="authContext">AuthenticationContext for AAD.</param>
-        /// <param name="clientCredential">The app credential.</param>
-        /// <returns>The <see cref="TokenProvider" /> for returning Json web token.</returns>
-        public static TokenProvider CreateAadTokenProvider(AuthenticationContext authContext, ClientCredential clientCredential)
-        {
-            if (authContext == null)
-            {
-                throw new ArgumentNullException(nameof(authContext));
-            }
-
-            if (clientCredential == null)
-            {
-                throw new ArgumentNullException(nameof(clientCredential));
-            }
-
-            return new AzureActiveDirectoryTokenProvider(authContext, clientCredential);
-        }
-
-        /// <summary>Creates an Azure Active Directory token provider.</summary>
-        /// <param name="authContext">AuthenticationContext for AAD.</param>
-        /// <param name="clientId">ClientId for AAD.</param>
-        /// <param name="redirectUri">The redirectUri on Client App.</param>
-        /// <param name="platformParameters">Platform parameters</param>
-        /// <param name="userIdentifier">User Identifier</param>
-        /// <returns>The <see cref="TokenProvider" /> for returning Json web token.</returns>
-        public static TokenProvider CreateAadTokenProvider(
-            AuthenticationContext authContext,
-            string clientId,
-            Uri redirectUri,
-            IPlatformParameters platformParameters,
-            UserIdentifier userIdentifier = null)
-        {
-            if (authContext == null)
-            {
-                throw new ArgumentNullException(nameof(authContext));
-            }
-
-            if (string.IsNullOrEmpty(clientId))
-            {
-                throw new ArgumentNullException(nameof(clientId));
-            }
-
-            if (redirectUri == null)
-            {
-                throw new ArgumentNullException(nameof(redirectUri));
-            }
-
-            if (platformParameters == null)
-            {
-                throw new ArgumentNullException(nameof(platformParameters));
-            }
-
-            return new AzureActiveDirectoryTokenProvider(authContext, clientId, redirectUri, platformParameters, userIdentifier);
-        }
-
-#if !UAP10_0
-        /// <summary>Creates an Azure Active Directory token provider.</summary>
-        /// <param name="authContext">AuthenticationContext for AAD.</param>
-        /// <param name="clientAssertionCertificate">The client assertion certificate credential.</param>
-        /// <returns>The <see cref="TokenProvider" /> for returning Json web token.</returns>
-        public static TokenProvider CreateAadTokenProvider(AuthenticationContext authContext, ClientAssertionCertificate clientAssertionCertificate)
+        /// <param name="authCallback">The authentication delegate to provide access token.</param>
+        /// <param name="authority">Address of the authority to issue token.</param>
+        /// <param name="state">State to be delivered to callback.</param>
+        /// <returns>The <see cref="Microsoft.ServiceBus.TokenProvider" /> for returning Json web token.</returns>
+        public static TokenProvider CreateAzureActiveDirectoryTokenProvider(
+            AzureActiveDirectoryTokenProvider.AuthenticationCallback authCallback,
+            string authority = AzureActiveDirectoryTokenProvider.CommonAuthority,
+            object state = null)
         {
-            if (authContext == null)
-            {
-                throw new ArgumentNullException(nameof(authContext));
-            }
-
-            if (clientAssertionCertificate == null)
+            if (authCallback == null)
             {
-                throw new ArgumentNullException(nameof(clientAssertionCertificate));
+                throw new ArgumentNullException(nameof(authCallback));
             }
 
-            return new AzureActiveDirectoryTokenProvider(authContext, clientAssertionCertificate);
+            return new AzureActiveDirectoryTokenProvider(authCallback, authority, state);
         }
-#endif
 
-        /// <summary>Creates Azure Managed Service Identity token provider.</summary>
+        /// <summary>Creates Azure Managed Identity token provider.</summary>
         /// <returns>The <see cref="TokenProvider" /> for returning Json web token.</returns>
-        public static TokenProvider CreateManagedServiceIdentityTokenProvider()
+        public static TokenProvider CreateManagedIdentityTokenProvider()
         {
-            return new ManagedServiceIdentityTokenProvider();
+            return new ManagedIdentityTokenProvider();
         }
 
         /// <summary>

sdk/servicebus/Microsoft.Azure.ServiceBus/src/QueueClient.cs

@@ -151,6 +151,54 @@ public QueueClient(ServiceBusConnection serviceBusConnection, string entityPath,
             MessagingEventSource.Log.QueueClientCreateStop(serviceBusConnection.Endpoint.Authority, entityPath, this.ClientId);
         }
 
+        /// <summary>
+        /// Creates a new instance of the Queue client using Azure Active Directory authentication.
+        /// </summary>
+        /// <param name="endpoint">Fully qualified domain name for Service Bus. Most likely, {yournamespace}.servicebus.windows.net</param>
+        /// <param name="entityPath">Queue path.</param>
+        /// <param name="authCallback">User provided delegate that will provide the access token.</param>
+        /// <param name="authority">Address of the authority to issue token.</param>
+        /// <param name="transportType">Transport type.</param>
+        /// <param name="receiveMode">Mode of receive of messages. Defaults to <see cref="ReceiveMode"/>.PeekLock.</param>
+        /// <param name="retryPolicy">Retry policy for queue operations. Defaults to <see cref="RetryPolicy.Default"/></param>
+        /// <remarks>Creates a new connection to the queue, which is opened during the first send/receive operation.</remarks>
+        public static QueueClient CreateWithAzureActiveDirectory(
+            string endpoint,
+            string entityPath,
+            AzureActiveDirectoryTokenProvider.AuthenticationCallback authCallback,
+            string authority = AzureActiveDirectoryTokenProvider.CommonAuthority,
+            TransportType transportType = TransportType.Amqp,
+            ReceiveMode receiveMode = ReceiveMode.PeekLock,
+            RetryPolicy retryPolicy = null)
+        {
+            return new QueueClient(new ServiceBusConnection(endpoint, transportType, retryPolicy)
+            {
+                TokenProvider = TokenProvider.CreateAzureActiveDirectoryTokenProvider(authCallback, authority)
+            }, entityPath, receiveMode, retryPolicy);
+        }
+
+        /// <summary>
+        /// Creates a new instance of the Queue client by using Azure Managed Identity authentication.
+        /// </summary>
+        /// <param name="endpoint">Fully qualified domain name for Service Bus. Most likely, {yournamespace}.servicebus.windows.net</param>
+        /// <param name="entityPath">Queue path.</param>
+        /// <param name="transportType">Transport type.</param>
+        /// <param name="receiveMode">Mode of receive of messages. Defaults to <see cref="ReceiveMode"/>.PeekLock.</param>
+        /// <param name="retryPolicy">Retry policy for queue operations. Defaults to <see cref="RetryPolicy.Default"/></param>
+        /// <remarks>Creates a new connection to the queue, which is opened during the first send/receive operation.</remarks>
+        public static QueueClient CreateWithManagedIdentity(
+            string endpoint,
+            string entityPath,
+            TransportType transportType = TransportType.Amqp,
+            ReceiveMode receiveMode = ReceiveMode.PeekLock,
+            RetryPolicy retryPolicy = null)
+        {
+            return new QueueClient(new ServiceBusConnection(endpoint, transportType, retryPolicy)
+            {
+                TokenProvider = TokenProvider.CreateManagedIdentityTokenProvider()
+            }, entityPath, receiveMode, retryPolicy);
+        }
+
         /// <summary>
         /// Gets the name of the queue.
         /// </summary>

sdk/servicebus/Microsoft.Azure.ServiceBus/src/Resources.resx

@@ -216,4 +216,7 @@
   <data name="TimeoutMustBePositiveNonZero" xml:space="preserve">
     <value>Argument {0} must be a positive non-zero timeout value. The provided value was {1}.</value>
   </data>
+  <data name="ArgumentInvalidCombination" xml:space="preserve">
+    <value>The following arguments must all be provided or none at all: {0}.</value>
+  </data>
 </root>

sdk/servicebus/Microsoft.Azure.ServiceBus/src/ServiceBusConnection.cs

@@ -218,6 +218,10 @@ void InitializeConnection(ServiceBusConnectionStringBuilder builder)
             {
                 this.TokenProvider = new SharedAccessSignatureTokenProvider(builder.SasKeyName, builder.SasKey);
             }
+            else if (!string.Equals(builder.Authentication, "Managed Identity", StringComparison.OrdinalIgnoreCase))
+            {
+                this.TokenProvider = Primitives.TokenProvider.CreateManagedIdentityTokenProvider();
+            }
 
             this.OperationTimeout = builder.OperationTimeout;
             this.TransportType = builder.TransportType;

sdk/servicebus/Microsoft.Azure.ServiceBus/src/ServiceBusConnectionStringBuilder.cs

@@ -21,6 +21,7 @@ public class ServiceBusConnectionStringBuilder
         const string SharedAccessKeyNameConfigName = "SharedAccessKeyName";
         const string SharedAccessKeyConfigName = "SharedAccessKey";
         const string SharedAccessSignatureConfigName = "SharedAccessSignature";
+        const string AuthenticationConfigName = "Authentication";
 
         const string EntityPathConfigName = "EntityPath";
         const string TransportTypeConfigName = "TransportType";
@@ -221,6 +222,11 @@ public string SasToken
         /// <remarks>Defaults to 1 minute.</remarks>
         public TimeSpan OperationTimeout { get; set; } = Constants.DefaultOperationTimeout;
 
+        /// <summary>
+        /// Enables Azure Active Directory Managed Identity authentication when set to 'Managed Identity'
+        /// </summary>
+        public string Authentication { get; set; }
+
         internal Dictionary<string, string> ConnectionStringProperties = new Dictionary<string, string>(StringComparer.CurrentCultureIgnoreCase);
 
         /// <summary>
@@ -229,6 +235,7 @@ public string SasToken
         /// <returns>Namespace connection string</returns>
         public string GetNamespaceConnectionString()
         {
+            validate();
             var connectionStringBuilder = new StringBuilder();
             if (this.Endpoint != null)
             {
@@ -260,6 +267,11 @@ public string GetNamespaceConnectionString()
                 connectionStringBuilder.Append($"{OperationTimeoutConfigName}{KeyValueSeparator}{this.OperationTimeout}{KeyValuePairDelimiter}");
             }
 
+            if (!string.IsNullOrWhiteSpace(this.Authentication))
+            {
+                connectionStringBuilder.Append($"{AuthenticationConfigName}{KeyValueSeparator}{this.Authentication}{KeyValuePairDelimiter}");
+            }
+
             return connectionStringBuilder.ToString().Trim(';');
         }
 
@@ -358,11 +370,33 @@ void ParseConnectionString(string connectionString)
                         throw Fx.Exception.Argument(nameof(connectionString), $"The {OperationTimeoutConfigName} ({value}) must be smaller than one hour.");
                     }
                 }
+                else if (key.Equals(AuthenticationConfigName, StringComparison.OrdinalIgnoreCase))
+                {
+                    this.Authentication = value;
+                }
                 else
                 {
                     ConnectionStringProperties[key] = value;
                 }
             }
+            validate();
+        }
+
+        void validate()
+        {
+            bool hasAuthentication = !string.IsNullOrWhiteSpace(this.Authentication);
+            bool hasSharedAccessKeyName = !string.IsNullOrWhiteSpace(this.SasKeyName);
+            bool hasSharedAccessSignature = !string.IsNullOrWhiteSpace(this.SasToken);
+
+            if (hasAuthentication && hasSharedAccessKeyName)
+            {
+                throw Fx.Exception.Argument("Authentication, SharedAccessKeyName", Resources.ArgumentInvalidCombination.FormatForUser("Authentication, SharedAccessKeyName"));
+            }
+
+            if (hasAuthentication && hasSharedAccessSignature)
+            {
+                throw Fx.Exception.Argument("Authentication, SharedAccessSignature", Resources.ArgumentInvalidCombination.FormatForUser("Authentication, SharedAccessSignature"));
+            }
         }
     }
 }