Skip to content

migrate from adal to azidentity #83

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sp98 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

migrate from adal to azidentity #83

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
112 changes: 82 additions & 30 deletions azure/azure_kv.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,27 +4,39 @@ import (
"context"
"encoding/json"
"errors"
"strings"
"time"

"github.com/Azure/azure-sdk-for-go/services/keyvault/2016-10-01/keyvault"
"github.com/Azure/go-autorest/autorest/to"
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
"github.com/Azure/azure-sdk-for-go/sdk/azcore/cloud"
"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets"
"github.com/libopenstorage/secrets"
"github.com/portworx/sched-ops/task"
)

const (
Name = secrets.TypeAzure
AzureCloud = "AzurePublicCloud"
Name = secrets.TypeAzure
// AzureTenantID for Azure Active Directory
AzureTenantID = "AZURE_TENANT_ID"
// AzureClientID of service principal account
AzureClientID = "AZURE_CLIENT_ID"
// AzureClientSecret of service principal account
AzureClientSecret = "AZURE_CLIENT_SECRET"
// AzureClientCertPath is path of the client certificate
AzureClientCertPath = "AZURE_CLIENT_CERT_PATH"
// AzureClientCertPassword is the password of the private key
AzureClientCertPassword = "AZURE_CLIENT_CERT_PASSWORD"
// AzureEnviornment to connect
AzureEnviornment = "AZURE_ENVIRONMENT"
// AzureVaultURI of azure key vault
AzureVaultURL = "AZURE_VAULT_URL"
// Valid cloud environment values (uppercase) - accepting all legacy names for backward compatibility
AzureCloud = "AZURECLOUD" // Public cloud
AzurePublicCloud = "AZUREPUBLICCLOUD" // Public cloud
AzureUSGovernment = "AZUREUSGOVERNMENT" // Government cloud
AzureUSGovernmentCloud = "AZUREUSGOVERNMENTCLOUD" // Government cloud (deprecated)
AzureChinaCloud = "AZURECHINACLOUD" // China cloud
AzureGermanCloud = "AZUREGERMANCLOUD" // Deprecated (Microsoft closed)
// Default context timeout for Azure SDK API's
defaultTimeout = 30 * time.Second
// timeout
Expand All @@ -34,18 +46,21 @@ const (
)

var (
ErrAzureTenantIDNotSet = errors.New("AZURE_TENANT_ID not set.")
ErrAzureClientIDNotSet = errors.New("AZURE_CLIENT_ID not set.")
ErrAzureSecretIDNotSet = errors.New("AZURE_SECRET_ID not set.")
ErrAzureVaultURLNotSet = errors.New("AZURE_VAULT_URL not set.")
ErrAzureEnvironmentNotset = errors.New("AZURE_ENVIRONMENT not set.")
ErrAzureConfigMissing = errors.New("AzureConfig is not provided")
ErrAzureAuthentication = errors.New("Azure authentication failed")
ErrInvalidSecretResp = errors.New("Secret Data received from secrets provider is either empty/invalid")
ErrAzureTenantIDNotSet = errors.New("AZURE_TENANT_ID not set.")
ErrAzureClientIDNotSet = errors.New("AZURE_CLIENT_ID not set.")
ErrAzureSecretIDNotSet = errors.New("AZURE_SECRET_ID not set.")
ErrAzureAuthMethodNotSet = errors.New("AZURE_CLIENT_SECRET or AZURE_CLIENT_CERT_PATH not set")
ErrAzureVaultURLNotSet = errors.New("AZURE_VAULT_URL not set.")
ErrAzureEnvironmentNotset = errors.New("AZURE_ENVIRONMENT not set.")
ErrAzureConfigMissing = errors.New("AzureConfig is not provided")
ErrAzureAuthentication = errors.New("Azure authentication failed")
ErrInvalidSecretResp = errors.New("Secret Data received from secrets provider is either empty/invalid")
ErrAzureInvalidCloudEnv = errors.New("invalid Azure cloud environment")
ErrAzureGermanCloudDeprecated = errors.New("AzureGermanCloud is deprecated - Microsoft closed this cloud")
)

type azureSecrets struct {
kv keyvault.BaseClient
kv azsecrets.Client
baseURL string
}

Expand All @@ -62,26 +77,36 @@ func New(
return nil, ErrAzureClientIDNotSet
}
secretID := getAzureKVParams(secretConfig, AzureClientSecret)
if secretID == "" {
return nil, ErrAzureSecretIDNotSet
}
envName := getAzureKVParams(secretConfig, AzureEnviornment)
if envName == "" {
// we set back to default AzurePublicCloud
envName = AzureCloud
}
clientCertPath := getAzureKVParams(secretConfig, AzureClientCertPath)
clientCertPassword := getAzureKVParams(secretConfig, AzureClientCertPassword)

vaultURL := getAzureKVParams(secretConfig, AzureVaultURL)
if vaultURL == "" {
return nil, ErrAzureVaultURLNotSet
}

client, err := getAzureVaultClient(clientID, secretID, tenantID, envName)
clientOpts, err := getAzureClientOptions(secretConfig)
if err != nil {
return nil, err
}

var client *azsecrets.Client
if secretID != "" {
client, err = getAzureVaultClient(clientID, secretID, tenantID, vaultURL, clientOpts)
if err != nil {
return nil, err
}
} else if clientCertPath != "" {
client, err = getAzureVaultClientWithCert(clientID, tenantID, vaultURL, clientCertPath, clientCertPassword, clientOpts)
if err != nil {
return nil, err
}
Comment thread
sp98 marked this conversation as resolved.
Resolved
} else {
return nil, ErrAzureAuthMethodNotSet
}

return &azureSecrets{
kv: client,
kv: *client,
baseURL: vaultURL,
}, nil
}
Expand All @@ -98,8 +123,14 @@ func (az *azureSecrets) GetSecret(
}

t := func() (interface{}, bool, error) {
secretResp, err := az.kv.GetSecret(ctx, az.baseURL, secretID, "")
// passing empty version to always get the latest version of the secret.
secretResp, err := az.kv.GetSecret(ctx, secretID, "", nil)
if err != nil {
// don't retry if the secret key was not found
responseError, ok := err.(*azcore.ResponseError)
if ok && responseError.StatusCode == 404 {
return nil, false, secrets.ErrInvalidSecretId
}
return nil, true, err
}
return secretResp, false, nil
Expand All @@ -109,7 +140,7 @@ func (az *azureSecrets) GetSecret(
return nil, secrets.NoVersion, err
}

secretResp, ok := resp.(keyvault.SecretBundle)
secretResp, ok := resp.(azsecrets.GetSecretResponse)

@iPraveenParihar iPraveenParihar Mar 8, 2024 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Azure now returns secret version.
can we return version as well?

secretResp.ID.Version()

@sp98 sp98 Mar 11, 2024

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No other KMS in the library is returning the version currently. So I think for now, we can keep it as it is and revisit this later.

@adityadani adityadani Apr 11, 2024

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AWS Secrets Manager returns the version.The only reason all providers have not been updated to return the version is lack of bandwidth to check and test if each one of them If we are modifying this provider and you are able to verify its correctness we can modify it

if !ok || secretResp.Value == nil {
return nil, secrets.NoVersion, ErrInvalidSecretResp
}
Expand All @@ -133,7 +164,7 @@ func (az *azureSecrets) PutSecret(
ctx, cancel := context.WithTimeout(context.Background(), defaultTimeout)
defer cancel()

var secretResp keyvault.SecretBundle
var secretResp azsecrets.SetSecretResponse
if secretName == "" {
return secrets.NoVersion, secrets.ErrEmptySecretId
}
Expand All @@ -146,10 +177,10 @@ func (az *azureSecrets) PutSecret(
return secrets.NoVersion, err
}

valueStr := string(value)
t := func() (interface{}, bool, error) {
secretResp, err = az.kv.SetSecret(ctx, az.baseURL, secretName, keyvault.SecretSetParameters{
Value: to.StringPtr(string(value)),
})
params := azsecrets.SetSecretParameters{Value: &valueStr}
secretResp, err = az.kv.SetSecret(ctx, secretName, params, nil)
if err != nil {
return nil, true, err
}
Expand All @@ -169,7 +200,7 @@ func (az *azureSecrets) DeleteSecret(
if secretName == "" {
return secrets.ErrEmptySecretId
}
_, err := az.kv.DeleteSecret(ctx, az.baseURL, secretName)
_, err := az.kv.DeleteSecret(ctx, secretName, nil)

return err
}
Expand Down Expand Up @@ -213,3 +244,24 @@ func init() {
panic(err.Error())
}
}

func getAzureClientOptions(secretConfig map[string]interface{}) (azcore.ClientOptions, error) {
opts := azcore.ClientOptions{}
cloudEnv := getAzureKVParams(secretConfig, AzureEnviornment)

cloudEnvUpper := strings.ToUpper(cloudEnv)

switch cloudEnvUpper {
case "", AzureCloud, AzurePublicCloud:
opts.Cloud = cloud.AzurePublic
case AzureUSGovernment, AzureUSGovernmentCloud:
opts.Cloud = cloud.AzureGovernment
case AzureChinaCloud:
opts.Cloud = cloud.AzureChina
case AzureGermanCloud:
return opts, ErrAzureGermanCloudDeprecated
default:
return opts, ErrAzureInvalidCloudEnv
}
return opts, nil
}
61 changes: 38 additions & 23 deletions azure/azure_kv_helper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,12 @@
package azure

import (
"net/url"
"fmt"
"os"
"strings"

"github.com/Azure/azure-sdk-for-go/services/keyvault/2016-10-01/keyvault"
"github.com/Azure/go-autorest/autorest"
"github.com/Azure/go-autorest/autorest/adal"
"github.com/Azure/go-autorest/autorest/azure"
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets"
)

func getAzureKVParams(secretConfig map[string]interface{}, name string) string {
Expand All @@ -19,29 +17,46 @@ func getAzureKVParams(secretConfig map[string]interface{}, name string) string {
}
}

func getAzureVaultClient(clientID, secretID, tenantID, envName string) (keyvault.BaseClient, error) {
var environment *azure.Environment
alternateEndpoint, _ := url.Parse(
"https://login.windows.net/" + tenantID + "/oauth2/token")
func getAzureVaultClient(clientID, secretID, tenantID, vaultURL string, opts azcore.ClientOptions) (*azsecrets.Client, error) {
cred, err := azidentity.NewClientSecretCredential(tenantID, clientID, secretID, &azidentity.ClientSecretCredentialOptions{ClientOptions: opts})
if err != nil {
return nil, fmt.Errorf("failed to get client secret credentials. %v", err)
}
client, err := azsecrets.NewClient(vaultURL, cred, &azsecrets.ClientOptions{ClientOptions: opts})
if err != nil {
return nil, fmt.Errorf("failed to get client to access azure kv secrets. %v", err)
}

return client, nil
}

func getAzureVaultClientWithCert(clientID, tenantID, vaultURL, certPath, certPassword string, opts azcore.ClientOptions) (*azsecrets.Client, error) {
certData, err := os.ReadFile(certPath)
if err != nil {
return nil, fmt.Errorf("failed read certificate from path %q. %v", certPath, err)
}

keyClient := keyvault.New()
env, err := azure.EnvironmentFromName(envName)
var passphrase []byte
if certPassword == "" {
passphrase = nil
} else {
passphrase = []byte(certPassword)
}

certs, key, err := azidentity.ParseCertificates(certData, passphrase)
if err != nil {
return keyClient, err
return nil, fmt.Errorf("failed load certificate and private key. %v", err)
}
environment = &env
oauthconfig, err := adal.NewOAuthConfig(
environment.ActiveDirectoryEndpoint, tenantID)

cred, err := azidentity.NewClientCertificateCredential(tenantID, clientID, certs, key, &azidentity.ClientCertificateCredentialOptions{ClientOptions: opts})
if err != nil {
return keyClient, err
return nil, fmt.Errorf("failed to construct client certificate credentials. %v", err)
}
oauthconfig.AuthorizeEndpoint = *alternateEndpoint

token, err := adal.NewServicePrincipalToken(
*oauthconfig, clientID, secretID, strings.TrimSuffix(environment.KeyVaultEndpoint, "/"))
client, err := azsecrets.NewClient(vaultURL, cred, &azsecrets.ClientOptions{ClientOptions: opts})
if err != nil {
return keyClient, err
return nil, fmt.Errorf("failed to get client to access azure kv secrets. %v", err)
}
keyClient.Authorizer = autorest.NewBearerAuthorizer(token)
return keyClient, nil

return client, nil
}
Loading