From 7e34579b7eab657e978260bbbda653e723ca38e1 Mon Sep 17 00:00:00 2001 From: Paul Meyer Date: Thu, 10 Jan 2019 23:21:16 +0000 Subject: [PATCH 1/3] Factor out Azure client credential config --- builder/azure/arm/authenticate.go | 41 +--- builder/azure/arm/authenticate_devicewflow.go | 36 ++++ builder/azure/arm/authenticate_msi.go | 23 ++ builder/azure/arm/authenticate_secret.go | 35 +++ ...te_test.go => authenticate_secret_test.go} | 4 +- builder/azure/arm/builder.go | 47 +---- builder/azure/arm/clientconfig.go | 165 +++++++++++++++ builder/azure/arm/clientconfig_test.go | 199 ++++++++++++++++++ builder/azure/arm/config.go | 84 +------- builder/azure/arm/config_test.go | 81 ------- 10 files changed, 468 insertions(+), 247 deletions(-) create mode 100644 builder/azure/arm/authenticate_devicewflow.go create mode 100644 builder/azure/arm/authenticate_msi.go create mode 100644 builder/azure/arm/authenticate_secret.go rename builder/azure/arm/{authenticate_test.go => authenticate_secret_test.go} (88%) create mode 100644 builder/azure/arm/clientconfig.go create mode 100644 builder/azure/arm/clientconfig_test.go diff --git a/builder/azure/arm/authenticate.go b/builder/azure/arm/authenticate.go index 10b8e4bd7..8204660de 100644 --- a/builder/azure/arm/authenticate.go +++ b/builder/azure/arm/authenticate.go @@ -2,44 +2,9 @@ package arm import ( "github.com/Azure/go-autorest/autorest/adal" - "github.com/Azure/go-autorest/autorest/azure" ) -type Authenticate struct { - env azure.Environment - clientID string - clientSecret string - tenantID string -} - -func NewAuthenticate(env azure.Environment, clientID, clientSecret, tenantID string) *Authenticate { - return &Authenticate{ - env: env, - clientID: clientID, - clientSecret: clientSecret, - tenantID: tenantID, - } -} - -func (a *Authenticate) getServicePrincipalToken() (*adal.ServicePrincipalToken, error) { - return a.getServicePrincipalTokenWithResource(a.env.ResourceManagerEndpoint) -} - -func (a *Authenticate) getServicePrincipalTokenWithResource(resource string) (*adal.ServicePrincipalToken, error) { - oauthConfig, err := adal.NewOAuthConfig(a.env.ActiveDirectoryEndpoint, a.tenantID) - if err != nil { - return nil, err - } - - if a.clientID == "" && a.clientSecret == "" { - return adal.NewServicePrincipalTokenFromMSI("http://169.254.169.254/metadata/identity/oauth2/token", resource) - } - - spt, err := adal.NewServicePrincipalToken( - *oauthConfig, - a.clientID, - a.clientSecret, - resource) - - return spt, err +type oAuthTokenProvider interface { + getServicePrincipalToken() (*adal.ServicePrincipalToken, error) + getServicePrincipalTokenWithResource(resource string) (*adal.ServicePrincipalToken, error) } diff --git a/builder/azure/arm/authenticate_devicewflow.go b/builder/azure/arm/authenticate_devicewflow.go new file mode 100644 index 000000000..48a6d2f69 --- /dev/null +++ b/builder/azure/arm/authenticate_devicewflow.go @@ -0,0 +1,36 @@ +package arm + +import ( + "fmt" + "strings" + + "github.com/Azure/go-autorest/autorest/adal" + "github.com/Azure/go-autorest/autorest/azure" + packerAzureCommon "github.com/hashicorp/packer/builder/azure/common" +) + +func NewDeviceFlowOAuthTokenProvider(env azure.Environment, say func(string), tenantID string) oAuthTokenProvider { + return &deviceflowOauthTokenProvider{} +} + +type deviceflowOauthTokenProvider struct { + env azure.Environment + say func(string) + tenantID string +} + +func (tp *deviceflowOauthTokenProvider) getServicePrincipalToken() (*adal.ServicePrincipalToken, error) { + return tp.getServicePrincipalTokenWithResource(tp.env.ResourceManagerEndpoint) +} + +func (tp *deviceflowOauthTokenProvider) getServicePrincipalTokenWithResource(resource string) (*adal.ServicePrincipalToken, error) { + if resource == tp.env.ServiceManagementEndpoint { + tp.say("Getting auth token for Service management endpoint") + } else if resource == strings.TrimRight(tp.env.KeyVaultEndpoint, "/") { + tp.say("Getting token for Vault resource") + } else { + tp.say(fmt.Sprintf("Getting token for %s", resource)) + } + + return packerAzureCommon.Authenticate(tp.env, tp.tenantID, tp.say, resource) +} diff --git a/builder/azure/arm/authenticate_msi.go b/builder/azure/arm/authenticate_msi.go new file mode 100644 index 000000000..b9f551eeb --- /dev/null +++ b/builder/azure/arm/authenticate_msi.go @@ -0,0 +1,23 @@ +package arm + +import ( + "github.com/Azure/go-autorest/autorest/adal" + "github.com/Azure/go-autorest/autorest/azure" +) + +// for managed identity auth +type msiOAuthTokenProvider struct { + env azure.Environment +} + +func NewMSIOAuthTokenProvider(env azure.Environment) oAuthTokenProvider { + return &msiOAuthTokenProvider{env} +} + +func (tp *msiOAuthTokenProvider) getServicePrincipalToken() (*adal.ServicePrincipalToken, error) { + return tp.getServicePrincipalTokenWithResource(tp.env.ResourceManagerEndpoint) +} + +func (tp *msiOAuthTokenProvider) getServicePrincipalTokenWithResource(resource string) (*adal.ServicePrincipalToken, error) { + return adal.NewServicePrincipalTokenFromMSI("http://169.254.169.254/metadata/identity/oauth2/token", resource) +} diff --git a/builder/azure/arm/authenticate_secret.go b/builder/azure/arm/authenticate_secret.go new file mode 100644 index 000000000..6a434591a --- /dev/null +++ b/builder/azure/arm/authenticate_secret.go @@ -0,0 +1,35 @@ +package arm + +import ( + "github.com/Azure/go-autorest/autorest/adal" + "github.com/Azure/go-autorest/autorest/azure" +) + +// for clientID/secret auth +type secretOAuthTokenProvider struct { + env azure.Environment + clientID, clientSecret, tenantID string +} + +func NewSecretOAuthTokenProvider(env azure.Environment, clientID, clientSecret, tenantID string) oAuthTokenProvider { + return &secretOAuthTokenProvider{env, clientID, clientSecret, tenantID} +} + +func (tp *secretOAuthTokenProvider) getServicePrincipalToken() (*adal.ServicePrincipalToken, error) { + return tp.getServicePrincipalTokenWithResource(tp.env.ResourceManagerEndpoint) +} + +func (tp *secretOAuthTokenProvider) getServicePrincipalTokenWithResource(resource string) (*adal.ServicePrincipalToken, error) { + oauthConfig, err := adal.NewOAuthConfig(tp.env.ActiveDirectoryEndpoint, tp.tenantID) + if err != nil { + return nil, err + } + + spt, err := adal.NewServicePrincipalToken( + *oauthConfig, + tp.clientID, + tp.clientSecret, + resource) + + return spt, err +} diff --git a/builder/azure/arm/authenticate_test.go b/builder/azure/arm/authenticate_secret_test.go similarity index 88% rename from builder/azure/arm/authenticate_test.go rename to builder/azure/arm/authenticate_secret_test.go index 63fd1c3aa..532883b4f 100644 --- a/builder/azure/arm/authenticate_test.go +++ b/builder/azure/arm/authenticate_secret_test.go @@ -9,8 +9,8 @@ import ( // Behavior is the most important thing to assert for ServicePrincipalToken, but // that cannot be done in a unit test because it involves network access. Instead, // I assert the expected inertness of this class. -func TestNewAuthenticate(t *testing.T) { - testSubject := NewAuthenticate(azure.PublicCloud, "clientID", "clientString", "tenantID") +func TestNewSecretOAuthTokenProvider(t *testing.T) { + testSubject := NewSecretOAuthTokenProvider(azure.PublicCloud, "clientID", "clientString", "tenantID") spn, err := testSubject.getServicePrincipalToken() if err != nil { t.Fatalf(err.Error()) diff --git a/builder/azure/arm/builder.go b/builder/azure/arm/builder.go index 1dfd66fa5..48c19263e 100644 --- a/builder/azure/arm/builder.go +++ b/builder/azure/arm/builder.go @@ -385,52 +385,7 @@ func (b *Builder) setImageParameters(stateBag multistep.StateBag) { } func (b *Builder) getServicePrincipalTokens(say func(string)) (*adal.ServicePrincipalToken, *adal.ServicePrincipalToken, error) { - var servicePrincipalToken *adal.ServicePrincipalToken - var servicePrincipalTokenVault *adal.ServicePrincipalToken - - var err error - - if b.config.useDeviceLogin { - say("Getting auth token for Service management endpoint") - servicePrincipalToken, err = packerAzureCommon.Authenticate(*b.config.cloudEnvironment, b.config.TenantID, say, b.config.cloudEnvironment.ServiceManagementEndpoint) - if err != nil { - return nil, nil, err - } - say("Getting token for Vault resource") - servicePrincipalTokenVault, err = packerAzureCommon.Authenticate(*b.config.cloudEnvironment, b.config.TenantID, say, strings.TrimRight(b.config.cloudEnvironment.KeyVaultEndpoint, "/")) - if err != nil { - return nil, nil, err - } - - } else { - auth := NewAuthenticate(*b.config.cloudEnvironment, b.config.ClientID, b.config.ClientSecret, b.config.TenantID) - - servicePrincipalToken, err = auth.getServicePrincipalToken() - if err != nil { - return nil, nil, err - } - - servicePrincipalTokenVault, err = auth.getServicePrincipalTokenWithResource( - strings.TrimRight(b.config.cloudEnvironment.KeyVaultEndpoint, "/")) - if err != nil { - return nil, nil, err - } - - } - - err = servicePrincipalToken.EnsureFresh() - - if err != nil { - return nil, nil, err - } - - err = servicePrincipalTokenVault.EnsureFresh() - - if err != nil { - return nil, nil, err - } - - return servicePrincipalToken, servicePrincipalTokenVault, nil + return b.config.ClientConfig.getServicePrincipalTokens(say) } func getObjectIdFromToken(ui packer.Ui, token *adal.ServicePrincipalToken) string { diff --git a/builder/azure/arm/clientconfig.go b/builder/azure/arm/clientconfig.go new file mode 100644 index 000000000..d4daff259 --- /dev/null +++ b/builder/azure/arm/clientconfig.go @@ -0,0 +1,165 @@ +package arm + +import ( + "fmt" + "strings" + + "github.com/Azure/go-autorest/autorest/adal" + "github.com/Azure/go-autorest/autorest/azure" + "github.com/hashicorp/packer/packer" +) + +// ClientConfig allows for various ways to authenticate Azure clients +type ClientConfig struct { + // Describes where API's are + + CloudEnvironmentName string `mapstructure:"cloud_environment_name"` + cloudEnvironment *azure.Environment + + // Authentication fields + + // Client ID + ClientID string `mapstructure:"client_id"` + // Client secret/password + ClientSecret string `mapstructure:"client_secret"` + ObjectID string `mapstructure:"object_id"` + TenantID string `mapstructure:"tenant_id"` + SubscriptionID string `mapstructure:"subscription_id"` +} + +const DefaultCloudEnvironmentName = "Public" + +func (c *ClientConfig) provideDefaultValues() { + if c.CloudEnvironmentName == "" { + c.CloudEnvironmentName = DefaultCloudEnvironmentName + } +} + +func (c *ClientConfig) setCloudEnvironment() error { + lookup := map[string]string{ + "CHINA": "AzureChinaCloud", + "CHINACLOUD": "AzureChinaCloud", + "AZURECHINACLOUD": "AzureChinaCloud", + + "GERMAN": "AzureGermanCloud", + "GERMANCLOUD": "AzureGermanCloud", + "AZUREGERMANCLOUD": "AzureGermanCloud", + + "GERMANY": "AzureGermanCloud", + "GERMANYCLOUD": "AzureGermanCloud", + "AZUREGERMANYCLOUD": "AzureGermanCloud", + + "PUBLIC": "AzurePublicCloud", + "PUBLICCLOUD": "AzurePublicCloud", + "AZUREPUBLICCLOUD": "AzurePublicCloud", + + "USGOVERNMENT": "AzureUSGovernmentCloud", + "USGOVERNMENTCLOUD": "AzureUSGovernmentCloud", + "AZUREUSGOVERNMENTCLOUD": "AzureUSGovernmentCloud", + } + + name := strings.ToUpper(c.CloudEnvironmentName) + envName, ok := lookup[name] + if !ok { + return fmt.Errorf("There is no cloud environment matching the name '%s'!", c.CloudEnvironmentName) + } + + env, err := azure.EnvironmentFromName(envName) + c.cloudEnvironment = &env + return err +} + +func (c ClientConfig) assertRequiredParametersSet(errs *packer.MultiError) { + ///////////////////////////////////////////// + // Authentication via OAUTH + + // Check if device login is being asked for, and is allowed. + // + // Device login is enabled if the user only defines SubscriptionID and not + // ClientID, ClientSecret, and TenantID. + // + // Device login is not enabled for Windows because the WinRM certificate is + // readable by the ObjectID of the App. There may be another way to handle + // this case, but I am not currently aware of it - send feedback. + + if c.useMSI() { + return + } + + if c.SubscriptionID == "" { + errs = packer.MultiErrorAppend(errs, fmt.Errorf("A subscription_id must be specified")) + } + + if c.useDeviceLogin() { + return + } + + if c.SubscriptionID != "" && c.ClientID != "" && c.ClientSecret != "" { + // Service principal using secret + return + } + + errs = packer.MultiErrorAppend(errs, fmt.Errorf("No valid set of authentication values specified:\n"+ + "* to use the Managed Identity of teh current machine, do not specify any of the fields below\n"+ + "* to use interactive user authentication, specify only subscription_id\n"+ + "* to use an Azure Active Directory service principal, specify subscription_id, client_id and client_secret.")) +} + +func (c ClientConfig) useDeviceLogin() bool { + return c.SubscriptionID != "" && + c.ClientID == "" && + c.ClientSecret == "" && + c.TenantID == "" +} + +func (c ClientConfig) useMSI() bool { + return c.SubscriptionID == "" && + c.ClientID == "" && + c.ClientSecret == "" && + c.TenantID == "" +} + +func (c ClientConfig) getServicePrincipalTokens( + say func(string)) ( + servicePrincipalToken *adal.ServicePrincipalToken, + servicePrincipalTokenVault *adal.ServicePrincipalToken, + err error) { + + tenantID := c.TenantID + + var auth oAuthTokenProvider + + if c.useDeviceLogin() { + say("Getting tokens using device flow") + auth = NewDeviceFlowOAuthTokenProvider(*c.cloudEnvironment, say, tenantID) + } else if c.useMSI() { + say("Getting tokens using Managed Identity for Azure") + auth = NewMSIOAuthTokenProvider(*c.cloudEnvironment) + } else { + say("Getting tokens using client secret") + auth = NewSecretOAuthTokenProvider(*c.cloudEnvironment, c.ClientID, c.ClientSecret, tenantID) + } + + servicePrincipalToken, err = auth.getServicePrincipalToken() + if err != nil { + return nil, nil, err + } + + err = servicePrincipalToken.EnsureFresh() + if err != nil { + return nil, nil, err + } + + servicePrincipalTokenVault, err = auth.getServicePrincipalTokenWithResource( + strings.TrimRight(c.cloudEnvironment.KeyVaultEndpoint, "/")) + if err != nil { + return nil, nil, err + } + + err = servicePrincipalTokenVault.EnsureFresh() + if err != nil { + return nil, nil, err + } + + return servicePrincipalToken, servicePrincipalTokenVault, nil +} diff --git a/builder/azure/arm/clientconfig_test.go b/builder/azure/arm/clientconfig_test.go new file mode 100644 index 000000000..87fefae09 --- /dev/null +++ b/builder/azure/arm/clientconfig_test.go @@ -0,0 +1,199 @@ +package arm + +import ( + "fmt" + "os" + "testing" + + "github.com/Azure/go-autorest/autorest/azure" + "github.com/hashicorp/packer/packer" +) + +func Test_ClientConfig_RequiredParametersSet(t *testing.T) { + + tests := []struct { + name string + config ClientConfig + wantErr bool + }{ + { + name: "no client_id, client_secret or subscription_id should enable MSI auth", + config: ClientConfig{}, + wantErr: false, + }, + { + name: "subscription_id is set will trigger device flow", + config: ClientConfig{ + SubscriptionID: "error", + }, + wantErr: false, + }, + { + name: "client_id without client_secret should error", + config: ClientConfig{ + ClientID: "error", + }, + wantErr: true, + }, + { + name: "client_secret without client_id should error", + config: ClientConfig{ + ClientSecret: "error", + }, + wantErr: true, + }, + { + name: "missing subscription_id when using secret", + config: ClientConfig{ + ClientID: "ok", + ClientSecret: "ok", + }, + wantErr: true, + }, + { + name: "tenant_id alone should fail", + config: ClientConfig{ + TenantID: "ok", + }, + wantErr: true, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + + errs := &packer.MultiError{} + tt.config.assertRequiredParametersSet(errs) + if (len(errs.Errors) != 0) != tt.wantErr { + t.Errorf("newConfig() error = %v, wantErr %v", errs, tt.wantErr) + return + } + }) + } +} + +func Test_ClientConfig_DeviceLogin(t *testing.T) { + getEnvOrSkip(t, "AZURE_DEVICE_LOGIN") + cfg := ClientConfig{ + SubscriptionID: getEnvOrSkip(t, "AZURE_SUBSCRIPTION"), + cloudEnvironment: getCloud(), + } + assertValid(t, cfg) + + spt, sptkv, err := cfg.getServicePrincipalTokens( + func(s string) { fmt.Printf("SAY: %s\n", s) }) + if err != nil { + t.Fatalf("Expected nil err, but got: %v", err) + } + token := spt.Token() + if token.AccessToken == "" { + t.Fatal("Expected management token to have non-nil access token") + } + if token.RefreshToken == "" { + t.Fatal("Expected management token to have non-nil refresh token") + } + kvtoken := sptkv.Token() + if kvtoken.AccessToken == "" { + t.Fatal("Expected keyvault token to have non-nil access token") + } + if kvtoken.RefreshToken == "" { + t.Fatal("Expected keyvault token to have non-nil refresh token") + } +} + +func Test_ClientConfig_ClientPassword(t *testing.T) { + cfg := ClientConfig{ + SubscriptionID: getEnvOrSkip(t, "AZURE_SUBSCRIPTION"), + ClientID: getEnvOrSkip(t, "AZURE_CLIENTID"), + ClientSecret: getEnvOrSkip(t, "AZURE_CLIENTSECRET"), + TenantID: getEnvOrSkip(t, "AZURE_TENANTID"), + cloudEnvironment: getCloud(), + } + assertValid(t, cfg) + + spt, sptkv, err := cfg.getServicePrincipalTokens(func(s string) { fmt.Printf("SAY: %s\n", s) }) + if err != nil { + t.Fatalf("Expected nil err, but got: %v", err) + } + token := spt.Token() + if token.AccessToken == "" { + t.Fatal("Expected management token to have non-nil access token") + } + if token.RefreshToken != "" { + t.Fatal("Expected management token to have no refresh token") + } + kvtoken := sptkv.Token() + if kvtoken.AccessToken == "" { + t.Fatal("Expected keyvault token to have non-nil access token") + } + if kvtoken.RefreshToken != "" { + t.Fatal("Expected keyvault token to have no refresh token") + } +} + +func getEnvOrSkip(t *testing.T, envVar string) string { + v := os.Getenv(envVar) + if v == "" { + t.Skipf("%s is empty, skipping", envVar) + } + return v +} + +func getCloud() *azure.Environment { + cloudName := os.Getenv("AZURE_CLOUD") + if cloudName == "" { + cloudName = "AZUREPUBLICCLOUD" + } + c, _ := azure.EnvironmentFromName(cloudName) + return &c +} + +// tests for assertRequiredParametersSet + +func Test_ClientConfig_CanUseDeviceCode(t *testing.T) { + cfg := emptyClientConfig() + cfg.SubscriptionID = "12345" + // TenantID is optional + + assertValid(t, cfg) +} + +func assertValid(t *testing.T, cfg ClientConfig) { + errs := &packer.MultiError{} + cfg.assertRequiredParametersSet(errs) + if len(errs.Errors) != 0 { + t.Fatal("Expected errs to be empty: ", errs) + } +} + +func assertInvalid(t *testing.T, cfg ClientConfig) { + errs := &packer.MultiError{} + cfg.assertRequiredParametersSet(errs) + if len(errs.Errors) == 0 { + t.Fatal("Expected errs to be non-empty") + } +} + +func Test_ClientConfig_CanUseClientSecret(t *testing.T) { + cfg := emptyClientConfig() + cfg.SubscriptionID = "12345" + cfg.ClientID = "12345" + cfg.ClientSecret = "12345" + + assertValid(t, cfg) +} + +func Test_ClientConfig_CanUseClientSecretWithTenantID(t *testing.T) { + cfg := emptyClientConfig() + cfg.SubscriptionID = "12345" + cfg.ClientID = "12345" + cfg.ClientSecret = "12345" + cfg.TenantID = "12345" + + assertValid(t, cfg) +} + +func emptyClientConfig() ClientConfig { + cfg := ClientConfig{} + _ = cfg.setCloudEnvironment() + return cfg +} diff --git a/builder/azure/arm/config.go b/builder/azure/arm/config.go index 35f79e6f8..862226245 100644 --- a/builder/azure/arm/config.go +++ b/builder/azure/arm/config.go @@ -15,7 +15,6 @@ import ( "time" "github.com/Azure/azure-sdk-for-go/services/compute/mgmt/2018-04-01/compute" - "github.com/Azure/go-autorest/autorest/azure" "github.com/Azure/go-autorest/autorest/to" "github.com/masterzen/winrm" @@ -32,7 +31,6 @@ import ( ) const ( - DefaultCloudEnvironmentName = "Public" DefaultImageVersion = "latest" DefaultUserName = "packer" DefaultPrivateVirtualNetworkWithPublicIp = false @@ -79,11 +77,7 @@ type Config struct { common.PackerConfig `mapstructure:",squash"` // Authentication via OAUTH - ClientID string `mapstructure:"client_id"` - ClientSecret string `mapstructure:"client_secret"` - ObjectID string `mapstructure:"object_id"` - TenantID string `mapstructure:"tenant_id"` - SubscriptionID string `mapstructure:"subscription_id"` + ClientConfig `mapstructure:",squash"` // Capture CaptureNamePrefix string `mapstructure:"capture_name_prefix"` @@ -122,8 +116,6 @@ type Config struct { TempResourceGroupName string `mapstructure:"temp_resource_group_name"` BuildResourceGroupName string `mapstructure:"build_resource_group_name"` storageAccountBlobEndpoint string - CloudEnvironmentName string `mapstructure:"cloud_environment_name"` - cloudEnvironment *azure.Environment PrivateVirtualNetworkWithPublicIp bool `mapstructure:"private_virtual_network_with_public_ip"` VirtualNetworkName string `mapstructure:"virtual_network_name"` VirtualNetworkSubnetName string `mapstructure:"virtual_network_subnet_name"` @@ -157,8 +149,6 @@ type Config struct { tmpVirtualNetworkName string tmpWinRMCertificateUrl string - useDeviceLogin bool - // Authentication with the VM via SSH sshAuthorizedKey string @@ -287,7 +277,7 @@ func newConfig(raws ...interface{}) (*Config, []string, error) { provideDefaultValues(&c) setRuntimeValues(&c) setUserNamePassword(&c) - err = setCloudEnvironment(&c) + err = c.ClientConfig.setCloudEnvironment() if err != nil { return nil, nil, err } @@ -416,40 +406,6 @@ func setUserNamePassword(c *Config) { } } -func setCloudEnvironment(c *Config) error { - lookup := map[string]string{ - "CHINA": "AzureChinaCloud", - "CHINACLOUD": "AzureChinaCloud", - "AZURECHINACLOUD": "AzureChinaCloud", - - "GERMAN": "AzureGermanCloud", - "GERMANCLOUD": "AzureGermanCloud", - "AZUREGERMANCLOUD": "AzureGermanCloud", - - "GERMANY": "AzureGermanCloud", - "GERMANYCLOUD": "AzureGermanCloud", - "AZUREGERMANYCLOUD": "AzureGermanCloud", - - "PUBLIC": "AzurePublicCloud", - "PUBLICCLOUD": "AzurePublicCloud", - "AZUREPUBLICCLOUD": "AzurePublicCloud", - - "USGOVERNMENT": "AzureUSGovernmentCloud", - "USGOVERNMENTCLOUD": "AzureUSGovernmentCloud", - "AZUREUSGOVERNMENTCLOUD": "AzureUSGovernmentCloud", - } - - name := strings.ToUpper(c.CloudEnvironmentName) - envName, ok := lookup[name] - if !ok { - return fmt.Errorf("There is no cloud environment matching the name '%s'!", c.CloudEnvironmentName) - } - - env, err := azure.EnvironmentFromName(envName) - c.cloudEnvironment = &env - return err -} - func setCustomData(c *Config) error { if c.CustomDataFile == "" { return nil @@ -481,9 +437,7 @@ func provideDefaultValues(c *Config) { c.ImageVersion = DefaultImageVersion } - if c.CloudEnvironmentName == "" { - c.CloudEnvironmentName = DefaultCloudEnvironmentName - } + c.provideDefaultValues() } func assertTagProperties(c *Config, errs *packer.MultiError) { @@ -502,37 +456,7 @@ func assertTagProperties(c *Config, errs *packer.MultiError) { } func assertRequiredParametersSet(c *Config, errs *packer.MultiError) { - ///////////////////////////////////////////// - // Authentication via OAUTH - - // Check if device login is being asked for, and is allowed. - // - // Device login is enabled if the user only defines SubscriptionID and not - // ClientID, ClientSecret, and TenantID. - // - // Device login is not enabled for Windows because the WinRM certificate is - // readable by the ObjectID of the App. There may be another way to handle - // this case, but I am not currently aware of it - send feedback. - isUseDeviceLogin := func(c *Config) bool { - - return c.SubscriptionID != "" && - c.ClientID == "" && - c.ClientSecret == "" && - c.TenantID == "" - } - - if isUseDeviceLogin(c) { - c.useDeviceLogin = true - } else { - if c.ClientID == "" && c.ClientSecret != "" || c.ClientID != "" && c.ClientSecret == "" { - errs = packer.MultiErrorAppend(errs, fmt.Errorf("A client_id and client_secret must be specified together or not specified at all")) - } - - if c.ClientID != "" && c.SubscriptionID == "" { - errs = packer.MultiErrorAppend(errs, fmt.Errorf("A subscription_id must be specified when client_id & client_secret are")) - } - - } + c.ClientConfig.assertRequiredParametersSet(errs) ///////////////////////////////////////////// // Capture diff --git a/builder/azure/arm/config_test.go b/builder/azure/arm/config_test.go index e5b7e6ece..bf1bd5023 100644 --- a/builder/azure/arm/config_test.go +++ b/builder/azure/arm/config_test.go @@ -133,87 +133,6 @@ func TestConfigShouldNotDefaultImageVersionIfCustomImage(t *testing.T) { } } -func Test_newConfig_MSI(t *testing.T) { - baseConfig := map[string]string{ - "capture_name_prefix": "ignore", - "capture_container_name": "ignore", - "location": "ignore", - "image_url": "ignore", - "storage_account": "ignore", - "resource_group_name": "ignore", - "os_type": constants.Target_Linux, - } - - tests := []struct { - name string - args []interface{} - wantErr bool - }{ - { - name: "no client_id and no client_secret should enable MSI auth", - args: []interface{}{ - baseConfig, - getPackerConfiguration(), - }, - wantErr: false, - }, - { - name: "subscription_id is will be taken from MSI", - args: []interface{}{ - baseConfig, - map[string]string{ - "subscription_id": "error", - }, - getPackerConfiguration(), - }, - wantErr: false, - }, - { - name: "client_id without client_secret should error", - args: []interface{}{ - baseConfig, - map[string]string{ - "client_id": "error", - }, - getPackerConfiguration(), - }, - wantErr: true, - }, - { - name: "client_secret without client_id should error", - args: []interface{}{ - baseConfig, - map[string]string{ - "client_secret": "error", - }, - getPackerConfiguration(), - }, - wantErr: true, - }, - { - name: "missing subscription_id", - args: []interface{}{ - baseConfig, - map[string]string{ - "client_id": "ok", - "client_secret": "ok", - }, - getPackerConfiguration(), - }, - wantErr: true, - }, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - _, _, err := newConfig(tt.args...) - if (err != nil) != tt.wantErr { - t.Errorf("newConfig() error = %v, wantErr %v", err, tt.wantErr) - return - } - }) - } -} - func TestConfigShouldNormalizeOSTypeCase(t *testing.T) { config := map[string]string{ "capture_name_prefix": "ignore", From aa29facdae3e85481b1aa858cdde25f715690eea Mon Sep 17 00:00:00 2001 From: Paul Meyer Date: Fri, 11 Jan 2019 20:54:15 +0000 Subject: [PATCH 2/3] Allow certificate bearer JWT client authentication This allows certificate based authentication, both by just referencing the certificate file as well as by providing a bearer JWT. This last option allows authentication without exposing the private key to packer using an expiring JWT containting the thumbprint (and sometimes the whole certificate for subject/issuer based auth), signed using the certificate private key. --- builder/azure/arm/authenticate_cert.go | 155 +++++++++++++++++++ builder/azure/arm/authenticate_jwt.go | 43 ++++++ builder/azure/arm/clientconfig.go | 78 ++++++++-- builder/azure/arm/clientconfig_test.go | 200 ++++++++++++++++++++++++- 4 files changed, 465 insertions(+), 11 deletions(-) create mode 100644 builder/azure/arm/authenticate_cert.go create mode 100644 builder/azure/arm/authenticate_jwt.go diff --git a/builder/azure/arm/authenticate_cert.go b/builder/azure/arm/authenticate_cert.go new file mode 100644 index 000000000..0c1fb6e49 --- /dev/null +++ b/builder/azure/arm/authenticate_cert.go @@ -0,0 +1,155 @@ +package arm + +import ( + "crypto/ecdsa" + "crypto/rand" + "crypto/rsa" + "crypto/sha1" + "crypto/x509" + "encoding/base64" + "encoding/pem" + "fmt" + "io/ioutil" + "os" + "time" + + "github.com/Azure/go-autorest/autorest/azure" + jwt "github.com/dgrijalva/jwt-go" +) + +func NewCertOAuthTokenProvider(env azure.Environment, clientID, clientCertPath, tenantID string) (oAuthTokenProvider, error) { + cert, key, err := readCert(clientCertPath) + if err != nil { + return nil, fmt.Errorf("Error reading certificate: %v", err) + } + + audience := fmt.Sprintf("%s%s/oauth2/token", env.ActiveDirectoryEndpoint, tenantID) + jwt, err := makeJWT(clientID, audience, cert, key, time.Hour, true) + if err != nil { + return nil, fmt.Errorf("Error generating JWT: %v", err) + } + + return NewJWTOAuthTokenProvider(env, clientID, jwt, tenantID), nil +} + +// Creates a new JSON Web Token to be used as bearer JWT to authenticate +// to the Azure AD token endpoint to retrieve an access token for `audience`. +// If the full certificate is included in the token, then issuer/subject name +// could be used to authenticate if configured by the identity provider (AAD). +func makeJWT(clientID string, audience string, + cert *x509.Certificate, privatekey interface{}, + validFor time.Duration, includeFullCertificate bool) (string, error) { + + // The jti (JWT ID) claim provides a unique identifier for the JWT. + // See https://tools.ietf.org/html/rfc7519#section-4.1.7 + jti := make([]byte, 20) + _, err := rand.Read(jti) + if err != nil { + return "", err + } + + var token *jwt.Token + if cert.PublicKeyAlgorithm == x509.RSA { + token = jwt.New(jwt.SigningMethodRS256) + } else if cert.PublicKeyAlgorithm == x509.ECDSA { + token = jwt.New(jwt.SigningMethodES256) + } else { + return "", fmt.Errorf("Don't know how to handle this type of key algorithm: %v", cert.PublicKeyAlgorithm) + } + + hasher := sha1.New() + if _, err := hasher.Write(cert.Raw); err != nil { + return "", err + } + thumbprint := base64.URLEncoding.EncodeToString(hasher.Sum(nil)) + + // X.509 thumbprint, see https://tools.ietf.org/html/rfc7515#section-4.1.7 + token.Header["x5t"] = thumbprint + if includeFullCertificate { + // X.509 certificate (chain), see https://tools.ietf.org/html/rfc7515#section-4.1.6 + token.Header["x5c"] = []string{base64.StdEncoding.EncodeToString(cert.Raw)} + } + + token.Claims = jwt.MapClaims{ + // See https://tools.ietf.org/html/rfc7519#section-4.1 + "aud": audience, + "iss": clientID, + "sub": clientID, + "jti": base64.URLEncoding.EncodeToString(jti), + "nbf": time.Now().Unix(), + "exp": time.Now().Add(validFor).Unix(), + } + + return token.SignedString(privatekey) +} + +func readCert(file string) (cert *x509.Certificate, key interface{}, err error) { + f, err := os.Open(file) + if err != nil { + return nil, nil, err + } + defer f.Close() + d, err := ioutil.ReadAll(f) + if err != nil { + return nil, nil, err + } + + blocks := []*pem.Block{} + for len(d) > 0 { + var b *pem.Block + b, d = pem.Decode(d) + if b == nil { + break + } + blocks = append(blocks, b) + } + + certs := []*x509.Certificate{} + for _, block := range blocks { + if block.Type == "CERTIFICATE" { + c, err := x509.ParseCertificate(block.Bytes) + if err != nil { + return nil, nil, fmt.Errorf( + "Failed to read certificate block: %v", err) + } + certs = append(certs, c) + } else if block.Type == "PRIVATE KEY" { + key, err = x509.ParsePKCS8PrivateKey(block.Bytes) + if err != nil { + return nil, nil, fmt.Errorf( + "Failed to read private key block: %v", err) + } + } + // Don't care about other types of blocks, ignore + } + + if key == nil { + return nil, nil, fmt.Errorf("Did not find private key in pem file") + } + + // find the certificate that belongs to the private key by comparing the public keys + switch key := key.(type) { + case *rsa.PrivateKey: + for _, c := range certs { + if cp, ok := c.PublicKey.(*rsa.PublicKey); ok && + (cp.N.Cmp(key.PublicKey.N) == 0) { + cert = c + } + } + + case *ecdsa.PrivateKey: + for _, c := range certs { + if cp, ok := c.PublicKey.(*ecdsa.PublicKey); ok && + (cp.X.Cmp(key.PublicKey.X) == 0) && + (cp.Y.Cmp(key.PublicKey.Y) == 0) { + cert = c + } + } + } + + if cert == nil { + return nil, nil, fmt.Errorf("Did not find certificate belonging to private key in pem file") + } + + return cert, key, nil +} diff --git a/builder/azure/arm/authenticate_jwt.go b/builder/azure/arm/authenticate_jwt.go new file mode 100644 index 000000000..d4bb41748 --- /dev/null +++ b/builder/azure/arm/authenticate_jwt.go @@ -0,0 +1,43 @@ +package arm + +import ( + "net/url" + + "github.com/Azure/go-autorest/autorest/adal" + "github.com/Azure/go-autorest/autorest/azure" +) + +// for clientID/bearer JWT auth +type jwtOAuthTokenProvider struct { + env azure.Environment + clientID, clientJWT, tenantID string +} + +func NewJWTOAuthTokenProvider(env azure.Environment, clientID, clientJWT, tenantID string) oAuthTokenProvider { + return &jwtOAuthTokenProvider{env, clientID, clientJWT, tenantID} +} + +func (tp *jwtOAuthTokenProvider) getServicePrincipalToken() (*adal.ServicePrincipalToken, error) { + return tp.getServicePrincipalTokenWithResource(tp.env.ResourceManagerEndpoint) +} + +func (tp *jwtOAuthTokenProvider) getServicePrincipalTokenWithResource(resource string) (*adal.ServicePrincipalToken, error) { + oauthConfig, err := adal.NewOAuthConfig(tp.env.ActiveDirectoryEndpoint, tp.tenantID) + if err != nil { + return nil, err + } + + return adal.NewServicePrincipalTokenWithSecret( + *oauthConfig, + tp.clientID, + resource, + tp) +} + +// implements github.com/Azure/go-autorest/autorest/adal.ServicePrincipalSecret +func (tp *jwtOAuthTokenProvider) SetAuthenticationValues( + t *adal.ServicePrincipalToken, v *url.Values) error { + v.Set("client_assertion", tp.clientJWT) + v.Set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer") + return nil +} diff --git a/builder/azure/arm/clientconfig.go b/builder/azure/arm/clientconfig.go index d4daff259..69dfffbea 100644 --- a/builder/azure/arm/clientconfig.go +++ b/builder/azure/arm/clientconfig.go @@ -2,10 +2,13 @@ package arm import ( "fmt" + "os" "strings" + "time" "github.com/Azure/go-autorest/autorest/adal" "github.com/Azure/go-autorest/autorest/azure" + jwt "github.com/dgrijalva/jwt-go" "github.com/hashicorp/packer/packer" ) @@ -21,7 +24,11 @@ type ClientConfig struct { // Client ID ClientID string `mapstructure:"client_id"` // Client secret/password - ClientSecret string `mapstructure:"client_secret"` + ClientSecret string `mapstructure:"client_secret"` + // Certificate path for client auth + ClientCertPath string `mapstructure:"client_cert_path"` + // JWT bearer token for client auth (RFC 7523, Sec. 2.2) + ClientJWT string `mapstructure:"client_jwt"` ObjectID string `mapstructure:"object_id"` TenantID string `mapstructure:"tenant_id"` SubscriptionID string `mapstructure:"subscription_id"` @@ -86,29 +93,69 @@ func (c ClientConfig) assertRequiredParametersSet(errs *packer.MultiError) { return } - if c.SubscriptionID == "" { - errs = packer.MultiErrorAppend(errs, fmt.Errorf("A subscription_id must be specified")) - } - if c.useDeviceLogin() { return } - if c.SubscriptionID != "" && c.ClientID != "" && c.ClientSecret != "" { + if c.SubscriptionID != "" && c.ClientID != "" && + c.ClientSecret != "" && + c.ClientCertPath == "" && + c.ClientJWT == "" { // Service principal using secret return } + if c.SubscriptionID != "" && c.ClientID != "" && + c.ClientSecret == "" && + c.ClientCertPath != "" && + c.ClientJWT == "" { + // Service principal using certificate + + if _, err := os.Stat(c.ClientCertPath); err != nil { + errs = packer.MultiErrorAppend(errs, fmt.Errorf("client_cert_path is not an accessible file: %v", err)) + } + return + } + + if c.SubscriptionID != "" && c.ClientID != "" && + c.ClientSecret == "" && + c.ClientCertPath == "" && + c.ClientJWT != "" { + // Service principal using JWT + // Check that JWT is valid for at least 5 more minutes + + p := jwt.Parser{} + claims := jwt.StandardClaims{} + token, _, err := p.ParseUnverified(c.ClientJWT, &claims) + if err != nil { + errs = packer.MultiErrorAppend(errs, fmt.Errorf("client_jwt is not a JWT: %v", err)) + } else { + if claims.ExpiresAt < time.Now().Add(5*time.Minute).Unix() { + errs = packer.MultiErrorAppend(errs, fmt.Errorf("client_jwt will expire within 5 minutes, please use a JWT that is valid for at least 5 minutes")) + } + if t, ok := token.Header["x5t"]; !ok || t == "" { + errs = packer.MultiErrorAppend(errs, fmt.Errorf("client_jwt is missing the x5t header value, which is required for bearer JWT client authentication to Azure")) + } + } + + return + } + errs = packer.MultiErrorAppend(errs, fmt.Errorf("No valid set of authentication values specified:\n"+ - "* to use the Managed Identity of teh current machine, do not specify any of the fields below\n"+ - "* to use interactive user authentication, specify only subscription_id\n"+ - "* to use an Azure Active Directory service principal, specify subscription_id, client_id and client_secret.")) + " to use the Managed Identity of the current machine, do not specify any of the fields below\n"+ + " to use interactive user authentication, specify only subscription_id\n"+ + " to use an Azure Active Directory service principal, specify either:\n"+ + " - subscription_id, client_id and client_secret\n"+ + " - subscription_id, client_id and client_cert_path\n"+ + " - subscription_id, client_id and client_jwt.")) } func (c ClientConfig) useDeviceLogin() bool { return c.SubscriptionID != "" && c.ClientID == "" && c.ClientSecret == "" && + c.ClientJWT == "" && + c.ClientCertPath == "" && c.TenantID == "" } @@ -116,6 +163,8 @@ func (c ClientConfig) useMSI() bool { return c.SubscriptionID == "" && c.ClientID == "" && c.ClientSecret == "" && + c.ClientJWT == "" && + c.ClientCertPath == "" && c.TenantID == "" } @@ -135,9 +184,18 @@ func (c ClientConfig) getServicePrincipalTokens( } else if c.useMSI() { say("Getting tokens using Managed Identity for Azure") auth = NewMSIOAuthTokenProvider(*c.cloudEnvironment) - } else { + } else if c.ClientSecret != "" { say("Getting tokens using client secret") auth = NewSecretOAuthTokenProvider(*c.cloudEnvironment, c.ClientID, c.ClientSecret, tenantID) + } else if c.ClientCertPath != "" { + say("Getting tokens using client certificate") + auth, err = NewCertOAuthTokenProvider(*c.cloudEnvironment, c.ClientID, c.ClientCertPath, tenantID) + if err != nil { + return nil, nil, err + } + } else { + say("Getting tokens using client bearer JWT") + auth = NewJWTOAuthTokenProvider(*c.cloudEnvironment, c.ClientID, c.ClientJWT, tenantID) } servicePrincipalToken, err = auth.getServicePrincipalToken() diff --git a/builder/azure/arm/clientconfig_test.go b/builder/azure/arm/clientconfig_test.go index 87fefae09..f9fafd2f2 100644 --- a/builder/azure/arm/clientconfig_test.go +++ b/builder/azure/arm/clientconfig_test.go @@ -1,11 +1,19 @@ package arm import ( + crand "crypto/rand" + "crypto/rsa" + "encoding/base64" + "encoding/binary" "fmt" + "io" + mrand "math/rand" "os" "testing" + "time" "github.com/Azure/go-autorest/autorest/azure" + jwt "github.com/dgrijalva/jwt-go" "github.com/hashicorp/packer/packer" ) @@ -29,7 +37,7 @@ func Test_ClientConfig_RequiredParametersSet(t *testing.T) { wantErr: false, }, { - name: "client_id without client_secret should error", + name: "client_id without client_secret, client_cert_path or client_jwt should error", config: ClientConfig{ ClientID: "error", }, @@ -42,6 +50,20 @@ func Test_ClientConfig_RequiredParametersSet(t *testing.T) { }, wantErr: true, }, + { + name: "client_cert_path without client_id should error", + config: ClientConfig{ + ClientCertPath: "/dev/null", + }, + wantErr: true, + }, + { + name: "client_jwt without client_id should error", + config: ClientConfig{ + ClientJWT: "error", + }, + wantErr: true, + }, { name: "missing subscription_id when using secret", config: ClientConfig{ @@ -50,6 +72,42 @@ func Test_ClientConfig_RequiredParametersSet(t *testing.T) { }, wantErr: true, }, + { + name: "missing subscription_id when using certificate", + config: ClientConfig{ + ClientID: "ok", + ClientCertPath: "ok", + }, + wantErr: true, + }, + { + name: "missing subscription_id when using JWT", + config: ClientConfig{ + ClientID: "ok", + ClientJWT: "ok", + }, + wantErr: true, + }, + { + name: "too many client_* values", + config: ClientConfig{ + SubscriptionID: "ok", + ClientID: "ok", + ClientSecret: "ok", + ClientCertPath: "error", + }, + wantErr: true, + }, + { + name: "too many client_* values (2)", + config: ClientConfig{ + SubscriptionID: "ok", + ClientID: "ok", + ClientSecret: "ok", + ClientJWT: "error", + }, + wantErr: true, + }, { name: "tenant_id alone should fail", config: ClientConfig{ @@ -130,6 +188,66 @@ func Test_ClientConfig_ClientPassword(t *testing.T) { } } +func Test_ClientConfig_ClientCert(t *testing.T) { + cfg := ClientConfig{ + SubscriptionID: getEnvOrSkip(t, "AZURE_SUBSCRIPTION"), + ClientID: getEnvOrSkip(t, "AZURE_CLIENTID"), + ClientCertPath: getEnvOrSkip(t, "AZURE_CLIENTCERT"), + TenantID: getEnvOrSkip(t, "AZURE_TENANTID"), + cloudEnvironment: getCloud(), + } + assertValid(t, cfg) + + spt, sptkv, err := cfg.getServicePrincipalTokens(func(s string) { fmt.Printf("SAY: %s\n", s) }) + if err != nil { + t.Fatalf("Expected nil err, but got: %v", err) + } + token := spt.Token() + if token.AccessToken == "" { + t.Fatal("Expected management token to have non-nil access token") + } + if token.RefreshToken != "" { + t.Fatal("Expected management token to have no refresh token") + } + kvtoken := sptkv.Token() + if kvtoken.AccessToken == "" { + t.Fatal("Expected keyvault token to have non-nil access token") + } + if kvtoken.RefreshToken != "" { + t.Fatal("Expected keyvault token to have no refresh token") + } +} + +func Test_ClientConfig_ClientJWT(t *testing.T) { + cfg := ClientConfig{ + SubscriptionID: getEnvOrSkip(t, "AZURE_SUBSCRIPTION"), + ClientID: getEnvOrSkip(t, "AZURE_CLIENTID"), + ClientJWT: getEnvOrSkip(t, "AZURE_CLIENTJWT"), + TenantID: getEnvOrSkip(t, "AZURE_TENANTID"), + cloudEnvironment: getCloud(), + } + assertValid(t, cfg) + + spt, sptkv, err := cfg.getServicePrincipalTokens(func(s string) { fmt.Printf("SAY: %s\n", s) }) + if err != nil { + t.Fatalf("Expected nil err, but got: %v", err) + } + token := spt.Token() + if token.AccessToken == "" { + t.Fatal("Expected management token to have non-nil access token") + } + if token.RefreshToken != "" { + t.Fatal("Expected management token to have no refresh token") + } + kvtoken := sptkv.Token() + if kvtoken.AccessToken == "" { + t.Fatal("Expected keyvault token to have non-nil access token") + } + if kvtoken.RefreshToken != "" { + t.Fatal("Expected keyvault token to have no refresh token") + } +} + func getEnvOrSkip(t *testing.T, envVar string) string { v := os.Getenv(envVar) if v == "" { @@ -192,8 +310,88 @@ func Test_ClientConfig_CanUseClientSecretWithTenantID(t *testing.T) { assertValid(t, cfg) } +func Test_ClientConfig_CanUseClientJWT(t *testing.T) { + cfg := emptyClientConfig() + cfg.SubscriptionID = "12345" + cfg.ClientID = "12345" + cfg.ClientJWT = getJWT(10*time.Minute, true) + + assertValid(t, cfg) +} + +func Test_ClientConfig_CanUseClientJWTWithTenantID(t *testing.T) { + cfg := emptyClientConfig() + cfg.SubscriptionID = "12345" + cfg.ClientID = "12345" + cfg.ClientJWT = getJWT(10*time.Minute, true) + cfg.TenantID = "12345" + + assertValid(t, cfg) +} + +func Test_ClientConfig_CannotUseBothClientJWTAndSecret(t *testing.T) { + cfg := emptyClientConfig() + cfg.SubscriptionID = "12345" + cfg.ClientID = "12345" + cfg.ClientSecret = "12345" + cfg.ClientJWT = getJWT(10*time.Minute, true) + + assertInvalid(t, cfg) +} + +func Test_ClientConfig_ClientJWTShouldBeValidForAtLeast5Minutes(t *testing.T) { + cfg := emptyClientConfig() + cfg.SubscriptionID = "12345" + cfg.ClientID = "12345" + cfg.ClientJWT = getJWT(time.Minute, true) + + assertInvalid(t, cfg) +} + +func Test_ClientConfig_ClientJWTShouldHaveThumbprint(t *testing.T) { + cfg := emptyClientConfig() + cfg.SubscriptionID = "12345" + cfg.ClientID = "12345" + cfg.ClientJWT = getJWT(10*time.Minute, false) + + assertInvalid(t, cfg) +} + func emptyClientConfig() ClientConfig { cfg := ClientConfig{} _ = cfg.setCloudEnvironment() return cfg } + +func Test_getJWT(t *testing.T) { + if getJWT(time.Minute, true) == "" { + t.Fatalf("getJWT is broken") + } +} + +func newRandReader() io.Reader { + var seed int64 + binary.Read(crand.Reader, binary.LittleEndian, &seed) + + return mrand.New(mrand.NewSource(seed)) +} + +func getJWT(validFor time.Duration, withX5tHeader bool) string { + token := jwt.New(jwt.SigningMethodRS256) + key, _ := rsa.GenerateKey(newRandReader(), 2048) + + token.Claims = jwt.MapClaims{ + "aud": "https://login.microsoftonline.com/tenant.onmicrosoft.com/oauth2/token?api-version=1.0", + "iss": "355dff10-cd78-11e8-89fe-000d3afd16e3", + "sub": "355dff10-cd78-11e8-89fe-000d3afd16e3", + "jti": base64.URLEncoding.EncodeToString([]byte{0}), + "nbf": time.Now().Unix(), + "exp": time.Now().Add(validFor).Unix(), + } + if withX5tHeader { + token.Header["x5t"] = base64.URLEncoding.EncodeToString([]byte("thumbprint")) + } + + jwt, _ := token.SignedString(key) + return jwt +} From 812a2dfb951738c58739884ecf97b15ab3e89648 Mon Sep 17 00:00:00 2001 From: Paul Meyer Date: Fri, 11 Jan 2019 21:49:10 +0000 Subject: [PATCH 3/3] Update documentation --- .../source/docs/builders/azure-setup.html.md | 40 +++++-------------- website/source/docs/builders/azure.html.md | 28 ++++++++++--- 2 files changed, 32 insertions(+), 36 deletions(-) diff --git a/website/source/docs/builders/azure-setup.html.md b/website/source/docs/builders/azure-setup.html.md index de107a78c..99173fe5e 100644 --- a/website/source/docs/builders/azure-setup.html.md +++ b/website/source/docs/builders/azure-setup.html.md @@ -204,37 +204,12 @@ Make sure that `GROUPNAME` and `LOCATION` are the same as above. Also, ensure that `GROUPNAME` is less than 24 characters long and contains only lowercase letters and numbers. -### Create an Application - -An application represents a way to authorize access to the Azure API. Note that -you will need to specify a URL for your application (this is intended to be -used for OAuth callbacks) but these do not actually need to be valid URLs. - -First pick APPNAME, APPURL and PASSWORD: - -``` shell -APPNAME=packer.test -APPURL=packer.test -PASSWORD=xxx -``` - -Password is your `client_secret` and can be anything you like. I recommend -using `openssl rand -base64 24`. - -``` shell -$ az ad app create \ - --display-name $APPNAME \ - --identifier-uris $APPURL \ - --homepage $APPURL \ - --password $PASSWORD -``` - ### Create a Service Principal -You cannot directly grant permissions to an application. Instead, you create a -service principal and assign permissions to the service principal. To create a -service principal for use with Packer, run the below command specifying the -subscription. This will grant Packer the contributor role to the subscription. +A service principal acts on behalf of an application (Packer) on your Azure +subscription. To create an application and service principal for use with +Packer, run the below command specifying the subscription. This will grant +Packer the contributor role to the subscription. The output of this command is your service principal credentials, save these in a safe place as you will need these to configure Packer. @@ -263,8 +238,13 @@ pre-configured roles via: $ az role definition list --output json | jq ".[] | {name:.roleName, description:.description}" ``` +If you would rather use a certificate to autenticate your service principal, +please follow the [Azure Active Directory documentation](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-certificate-credentials#register-your-certificate-with-azure-ad). + ### Configuring Packer Now (finally) everything has been setup in Azure and our service principal has been created. You can use the output from creating your service principal in -your template. +your template. Use the value from the `appId` field above as a value for +`client_id` in your configuration and set `client_secret` to the `password` +value from above. diff --git a/website/source/docs/builders/azure.html.md b/website/source/docs/builders/azure.html.md index 3ed470369..8caf44848 100644 --- a/website/source/docs/builders/azure.html.md +++ b/website/source/docs/builders/azure.html.md @@ -35,12 +35,15 @@ addition to the options listed here, a [communicator](/docs/templates/communicator.html) can be configured for this builder. -### Required ( unless instance has [managed identities](/docs/builders/azure-setup.html#managed-identities-for-azure-resources) enabled): - -- `client_id` (string) The Active Directory service principal associated with - your builder. - -- `client_secret` (string) The password or secret for your service principal. +### Required options for authentication: +If you're running packer on an Azure VM with a [managed identity](/docs/builders/azure-setup.html#managed-identities-for-azure-resources) +you don't need to specify any additional configuration options. +If you would like to use interactive user authentication, you should specify +`subscription_id` only. Packer will use cached credentials or redirect you +to a website to log in. +If you want to use a [service principal](/docs/builders/azure-setup.html#create-a-service-principal) +you should specify `subscription_id`, `client_id` and one of `client_secret`, +`client_cert_path` or `client_jwt`. - `subscription_id` (string) Subscription under which the build will be performed. **The service principal specified in `client_id` must have full @@ -48,6 +51,19 @@ builder. specified in which case it needs to have owner access to the existing resource group specified in build\_resource\_group\_name parameter.** +- `client_id` (string) The Active Directory service principal associated with + your builder. + +- `client_secret` (string) The password or secret for your service principal. + +- `client_cert_path` (string) The location of a PEM file containing a + certificate and private key for service principal. + +- `client_jwt` (string) The bearer JWT assertion signed using a certificate + associated with your service principal principal. See [Azure Active + Directory docs](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-certificate-credentials) + for more information. + ### Required: - `image_publisher` (string) PublisherName for your base image. See