-
Notifications
You must be signed in to change notification settings - Fork 38
/
getCredentials.ts
152 lines (137 loc) · 5.91 KB
/
getCredentials.ts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
// Copyright (c) Microsoft Corporation.
// Licensed under the MIT License.
import * as tl from 'azure-pipelines-task-lib/task';
import { URL } from 'url';
import { UsernamePassword, AuthCredentials } from "@microsoft/powerplatform-cli-wrapper";
import { EndpointAuthorization, getEndpointAuthorization, getEndpointUrl } from "azure-pipelines-task-lib";
import { getAuthenticationType, AuthenticationType } from "./getAuthenticationType";
import { getEndpointName } from "./getEndpointName";
export function getCredentials(defaultAuthType?: AuthenticationType): AuthCredentials {
const authenticationType = getAuthenticationType(defaultAuthType);
switch (authenticationType) {
case "PowerPlatformEnvironment":
return getUsernamePassword();
case "PowerPlatformSPN":
return getClientCredentials();
}
}
function getClientCredentials(): AuthCredentials {
const endpointName = getEndpointName("PowerPlatformSPN");
const authorization = getEndpointAuthorizationParameters(endpointName);
tl.debug("Auth Scheme: " + authorization.scheme);
if (authorization.scheme === "WorkloadIdentityFederation") {
// Set environment variables for Workload Identity Federation
tl.debug('Acquiring Workload Identity Federation details from pipeline service connection');
process.env.PAC_ADO_ID_TOKEN_REQUEST_URL = buildIdTokenRequestUrl();
const pipelineAuth = tl.getEndpointAuthorization('SYSTEMVSSCONNECTION', false);
if (pipelineAuth && pipelineAuth.scheme === 'OAuth') {
tl.debug('Pipeline connection found with OAuth scheme');
process.env.PAC_ADO_ID_TOKEN_REQUEST_TOKEN = pipelineAuth.parameters['AccessToken'];
tl.setSecret(process.env.PAC_ADO_ID_TOKEN_REQUEST_TOKEN); // Mask in logs, though that *should* already be done.
} else {
tl.warning('Could not find pipeline connection details. Workload Identity Federation may not work as expected.');
}
return {
tenantId: authorization.parameters.tenantid,
appId: authorization.parameters.serviceprincipalid,
cloudInstance: resolveCloudInstance(endpointName),
scheme: authorization.scheme,
federationProvider: "AzureDevOps"
};
}
return {
tenantId: authorization.parameters.tenantId,
appId: authorization.parameters.applicationId,
clientSecret: authorization.parameters.clientSecret,
encodeSecret: true,
cloudInstance: resolveCloudInstance(endpointName),
scheme: authorization.scheme
};
}
// Docs: https://learn.microsoft.com/en-us/rest/api/azure/devops/distributedtask/oidctoken/create?view=azure-devops-rest-7.2
function buildIdTokenRequestUrl(): string {
const oidcApiVersion = '7.2-preview.1';
const projectId = tl.getVariable('System.TeamProjectId');
const hub = tl.getVariable("System.HostType");
const planId = tl.getVariable('System.PlanId');
const jobId = tl.getVariable('System.JobId');
const serviceConnectionId = tl.getInput("PowerPlatformSPN", true);
let uri = tl.getVariable("System.CollectionUri");
if (!uri) {
uri = tl.getVariable("System.TeamFoundationServerUri");
}
const tokenRequestUrl = `${uri}${projectId}/_apis/distributedtask/hubs/${hub}/plans/${planId}/jobs/${jobId}/oidctoken?serviceConnectionId=${serviceConnectionId}&api-version=${oidcApiVersion}`;
tl.debug(`OIDC Token Request URL: ${tokenRequestUrl}`);
return tokenRequestUrl;
}
function getUsernamePassword(): UsernamePassword {
const endpointName = getEndpointName("PowerPlatformEnvironment");
const authorization = getEndpointAuthorizationParameters(endpointName);
return {
username: authorization.parameters.username,
password: authorization.parameters.password,
encodePassword: true,
cloudInstance: resolveCloudInstance(endpointName)
};
}
function getEndpointAuthorizationParameters(
endpointName: string
): EndpointAuthorization {
const authorization = getEndpointAuthorization(endpointName, false);
if (authorization === undefined) {
throw new Error(`Could not get credentials for endpoint: ${endpointName}`);
}
return authorization;
}
// needed for backwards compatibility to the PS implementation:
// infer the cloudInstance from the default endpoint url on the service connection
// see Get-Origin in https://dev.azure.com/dynamicscrm/OneCRM/_git/PowerApps.AzDevOpsExtensions?path=/src/extension/common/SharedFunctions.psm1&version=GBmaster&line=23&lineEnd=24&lineStartColumn=1&lineEndColumn=1&lineStyle=plain&_a=contents
function resolveCloudInstance(endpointName: string): string {
const defaultEndpointUrl = getEndpointUrl(endpointName, true);
if (!defaultEndpointUrl) {
return "Public";
}
const hostname = new URL(defaultEndpointUrl)
.hostname
.split('.')
.reverse();
hostname.splice(-1);
const regionalized = hostname.reverse().join('.');
// see also:
// https://docs.microsoft.com/en-us/power-platform/admin/new-datacenter-regions
// https://dev.azure.com/dynamicscrm/OneCRM/_git/CRM.DevToolsCore?path=%2Fsrc%2FGeneralTools%2FDataverseClient%2FClient%2FModel%2FDiscoveryServers.cs&_a=contents&version=GBmaster
switch (regionalized) {
case 'crm.dynamics.com':
case 'crm2.dynamics.com':
case 'crm3.dynamics.com':
case 'crm4.dynamics.com':
case 'crm5.dynamics.com':
case 'crm6.dynamics.com':
case 'crm7.dynamics.com':
case 'crm8.dynamics.com':
case 'crm11.dynamics.com':
case 'crm12.dynamics.com':
case 'crm14.dynamics.com':
case 'crm15.dynamics.com':
case 'crm16.dynamics.com':
case 'crm17.dynamics.com':
case 'crm19.dynamics.com':
case 'crm20.dynamics.com':
case 'crm21.dynamics.com':
return "Public";
case 'crm9.dynamics.com':
return "UsGov";
case 'crm.microsoftdynamics.us':
return "UsGovHigh";
case 'crm.appsplatform.us':
return "UsGovDod";
case 'crm.dynamics.cn':
return "China";
case 'crm10.dynamics.com':
return "Preprod";
case 'crmtest.dynamics.com':
return "Test";
default:
return "Public";
}
}