Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OIDC support for sovereign clouds #258

Closed
wants to merge 3 commits into from
Closed

OIDC support for sovereign clouds #258

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f41168a
OIDC support for sovereign clouds
arnoldna Oct 27, 2022
0b22af4
Merge branch 'master' into master
arnoldna Dec 6, 2022
1f9ed8b
Merge branch 'Azure:master' into master
arnoldna Mar 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion lib/main.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,20 @@ function main() {
var tenantId = core.getInput('tenant-id', { required: false });
var subscriptionId = core.getInput('subscription-id', { required: false });
var resourceManagerEndpointUrl = "https://management.azure.com/";
switch(environment){
case 'azurecloud':
resourceManagerEndpointUrl = "https://management.azure.com/";
break;
case 'azureusgovernment':
resourceManagerEndpointUrl = "https://management.usgovcloudapi.net/";
break;
case 'azurechinacloud':
resourceManagerEndpointUrl = "https://management.chinacloudapi.cn/";
break;
default:
resourceManagerEndpointUrl = "https://management.azure.com/";
break;
}
var enableOIDC = true;
var federatedToken = null;
// If any of the individual credentials (clent_id, tenat_id, subscription_id) is present.
Expand Down Expand Up @@ -137,7 +151,7 @@ function main() {
let audience = core.getInput('audience', { required: false });
federatedToken = yield core.getIDToken(audience);
if (!!federatedToken) {
if (environment != "azurecloud")
if (environment != "azurecloud" || "azureusgovernment" || "azurechinacloud")
throw new Error(`Your current environment - "${environment}" is not supported for OIDC login.`);
let [issuer, subjectClaim] = yield jwtParser(federatedToken);
console.log("Federated token details: \n issuer - " + issuer + " \n subject claim - " + subjectClaim);
Expand Down
16 changes: 15 additions & 1 deletion src/main.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,20 @@ async function main() {
var tenantId = core.getInput('tenant-id', { required: false });
var subscriptionId = core.getInput('subscription-id', { required: false });
var resourceManagerEndpointUrl = "https://management.azure.com/";
switch(environment){
case 'azurecloud':
resourceManagerEndpointUrl = "https://management.azure.com/";
break;
case 'azureusgovernment':
resourceManagerEndpointUrl = "https://management.usgovcloudapi.net/";
break;
case 'azurechinacloud':
resourceManagerEndpointUrl = "https://management.chinacloudapi.cn/";
break;
default:
resourceManagerEndpointUrl = "https://management.azure.com/";
break;
}
Comment on lines +74 to +87
Copy link
Member

@jiasli jiasli May 25, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

resourceManagerEndpointUrl is in the output of az ad sp create-for-rbac --sdk-auth and az cloud list/show, so it shouldn't be hard-coded.

> az ad sp create-for-rbac --sdk-auth
{
  "clientId": "...",
  "clientSecret": "...",
  "subscriptionId": "...",
  "tenantId": "...",
  "activeDirectoryEndpointUrl": "https://login.microsoftonline.com",
  "resourceManagerEndpointUrl": "https://management.azure.com/",
  "activeDirectoryGraphResourceId": "https://graph.windows.net/",
  "sqlManagementEndpointUrl": "https://management.core.windows.net:8443/",
  "galleryEndpointUrl": "https://gallery.azure.com/",
  "managementEndpointUrl": "https://management.core.windows.net/"
}

var enableOIDC = true;
var federatedToken = null;

Expand Down Expand Up @@ -115,7 +129,7 @@ async function main() {
let audience = core.getInput('audience', { required: false });
federatedToken = await core.getIDToken(audience);
if (!!federatedToken) {
if (environment != "azurecloud")
if (environment != "azurecloud" || "azureusgovernment" || "azurechinacloud")
throw new Error(`Your current environment - "${environment}" is not supported for OIDC login.`);
let [issuer, subjectClaim] = await jwtParser(federatedToken);
console.log("Federated token details: \n issuer - " + issuer + " \n subject claim - " + subjectClaim);
Expand Down