|
| 1 | +// Copyright (c) Microsoft Corporation. |
| 2 | +// Licensed under the MIT License. |
| 3 | + |
| 4 | +/** |
| 5 | + * @file |
| 6 | + * @brief Azure Pipelines Credential and options. |
| 7 | + */ |
| 8 | + |
| 9 | +#pragma once |
| 10 | + |
| 11 | +#include "azure/identity/detail/client_credential_core.hpp" |
| 12 | +#include "azure/identity/detail/token_cache.hpp" |
| 13 | + |
| 14 | +#include <azure/core/credentials/token_credential_options.hpp> |
| 15 | +#include <azure/core/http/http.hpp> |
| 16 | +#include <azure/core/internal/http/pipeline.hpp> |
| 17 | + |
| 18 | +#include <string> |
| 19 | +#include <vector> |
| 20 | + |
| 21 | +namespace Azure { namespace Identity { |
| 22 | + namespace _detail { |
| 23 | + class TokenCredentialImpl; |
| 24 | + } // namespace _detail |
| 25 | + |
| 26 | + /** |
| 27 | + * @brief Options for Azure Pipelines credential. |
| 28 | + * |
| 29 | + */ |
| 30 | + struct AzurePipelinesCredentialOptions final : public Core::Credentials::TokenCredentialOptions |
| 31 | + { |
| 32 | + /** |
| 33 | + * @brief Authentication authority URL. |
| 34 | + * @note Defaults to the value of the environment variable 'AZURE_AUTHORITY_HOST'. If that's not |
| 35 | + * set, the default value is Microsoft Entra global authority |
| 36 | + * (https://login.microsoftonline.com/). |
| 37 | + * |
| 38 | + * @note Example of an authority host string: "https://login.microsoftonline.us/". See national |
| 39 | + * clouds' Microsoft Entra authentication endpoints: |
| 40 | + * https://learn.microsoft.com/entra/identity-platform/authentication-national-cloud. |
| 41 | + */ |
| 42 | + std::string AuthorityHost = _detail::DefaultOptionValues::GetAuthorityHost(); |
| 43 | + |
| 44 | + /** |
| 45 | + * @brief For multi-tenant applications, specifies additional tenants for which the credential |
| 46 | + * may acquire tokens. Add the wildcard value `"*"` to allow the credential to acquire tokens |
| 47 | + * for any tenant in which the application is installed. |
| 48 | + */ |
| 49 | + std::vector<std::string> AdditionallyAllowedTenants; |
| 50 | + }; |
| 51 | + |
| 52 | + /** |
| 53 | + * @brief Credential which authenticates using an Azure Pipelines service connection. |
| 54 | + * |
| 55 | + */ |
| 56 | + class AzurePipelinesCredential final : public Core::Credentials::TokenCredential { |
| 57 | + private: |
| 58 | + std::string m_serviceConnectionId; |
| 59 | + std::string m_systemAccessToken; |
| 60 | + _detail::ClientCredentialCore m_clientCredentialCore; |
| 61 | + Azure::Core::Http::_internal::HttpPipeline m_httpPipeline; |
| 62 | + std::string m_oidcRequestUrl; |
| 63 | + std::unique_ptr<_detail::TokenCredentialImpl> m_tokenCredentialImpl; |
| 64 | + std::string m_requestBody; |
| 65 | + _detail::TokenCache m_tokenCache; |
| 66 | + |
| 67 | + std::string GetAssertion(Core::Context const& context) const; |
| 68 | + Azure::Core::Http::Request CreateOidcRequestMessage() const; |
| 69 | + std::string GetOidcTokenResponse( |
| 70 | + std::unique_ptr<Azure::Core::Http::RawResponse> const& response, |
| 71 | + std::string responseBody) const; |
| 72 | + |
| 73 | + public: |
| 74 | + /** |
| 75 | + * @brief Constructs an Azure Pipelines Credential. |
| 76 | + * |
| 77 | + * @param tenantId The tenant ID for the service connection. |
| 78 | + * @param clientId The client ID for the service connection. |
| 79 | + * @param serviceConnectionId The service connection ID for the service connection associated |
| 80 | + * with the pipeline. |
| 81 | + * @param systemAccessToken The pipeline's System.AccessToken value. See |
| 82 | + * https://learn.microsoft.com/azure/devops/pipelines/build/variables?view=azure-devops%26tabs=yaml#systemaccesstoken |
| 83 | + * for more details. |
| 84 | + * @param options Options for token retrieval. |
| 85 | + */ |
| 86 | + explicit AzurePipelinesCredential( |
| 87 | + std::string tenantId, |
| 88 | + std::string clientId, |
| 89 | + std::string serviceConnectionId, |
| 90 | + std::string systemAccessToken, |
| 91 | + AzurePipelinesCredentialOptions const& options = {}); |
| 92 | + |
| 93 | + /** |
| 94 | + * @brief Destructs `%AzurePipelinesCredential`. |
| 95 | + * |
| 96 | + */ |
| 97 | + ~AzurePipelinesCredential() override; |
| 98 | + |
| 99 | + /** |
| 100 | + * @brief Gets an authentication token. |
| 101 | + * |
| 102 | + * @param tokenRequestContext A context to get the token in. |
| 103 | + * @param context A context to control the request lifetime. |
| 104 | + * |
| 105 | + * @throw Azure::Core::Credentials::AuthenticationException Authentication error occurred. |
| 106 | + */ |
| 107 | + Core::Credentials::AccessToken GetToken( |
| 108 | + Core::Credentials::TokenRequestContext const& tokenRequestContext, |
| 109 | + Core::Context const& context) const override; |
| 110 | + }; |
| 111 | + |
| 112 | +}} // namespace Azure::Identity |
0 commit comments