feat: Adding OpenID Connect (OIDC) implementation for Service Connections. #520
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
npm run format
for formatting the code before submitting the pull request.This PR builds on top of the existing work by @davidcorrigan714 done in PR #495 by adding support for OpenID Connect into the Azure DevOps extension and fixes issue #494.
As part of the PR, me and my team (@davidwinslowtech @HenrikStanley and @NimaZahedi) have implemented the following:
In regards to testing, it is not feasible for us to create tests for this feature as it relies on calling the IdTokens which can only be done from the Azure DevOps pipeline as the IdToken has to be obtained from an Azure DevOps build context as part of how the security and authentication flow works. If tests for this is required we would suggest that the JFrog maintainers creates integration tests for this in their Azure DevOps pipeline setup.
Since these tokens are only available in a built context, a known limitation is also that the Task Preview feature you get when editing tasks inside of the Azure DevOps pipeline editor, cannot authenticate to the JFrog instance from that environment and get a list of available repositories etc, as the token is only valid in the context of a pipeline run.
We have done fairly extensive manual testing of the feature.