Skip to content

Commit

Permalink
Merge pull request #1365 from arsnyder16/master
Browse files Browse the repository at this point in the history 
feat: add azure-active-directory-default as an authentication option
  • Loading branch information
@MichaelSun90
MichaelSun90 authored Mar 9, 2022
2 parents 98f8f48 + aba9ba2 commit 4261073
Show file tree
Hide file tree
Showing 2 changed files with 44 additions and 11 deletions.
53 changes: 43 additions & 10 deletions src/connection.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import { createSecureContext, SecureContext, SecureContextOptions } from 'tls';
import { Readable } from 'stream';

import {
DefaultAzureCredential,
ClientSecretCredential,
ManagedIdentityCredential,
TokenCredential,
Expand Down Expand Up @@ -230,15 +231,29 @@ interface AzureActiveDirectoryMsiVmAuthentication {
type: 'azure-active-directory-msi-vm';
options: {
/**
* If you user want to connect to an Azure app service using a specific client account
* they need to provide `clientId` asscoiate to their created idnetity.
* If you want to connect using a specific client account
* they need to provide `clientId` associated to their created identity.
*
* This is optional for retrieve token from azure web app service
* This is optional for retrieve a token
*/
clientId?: string;
};
}

interface AzureActiveDirectoryDefaultAuthentication {
type: 'azure-active-directory-default';
options: {
/**
* If you want to connect using a specific client account
* they need to provide `clientId` associated to their created identity.
*
* This is optional for retrieving a token
*/
clientId?: string;
};
}


interface AzureActiveDirectoryAccessTokenAuthentication {
type: 'azure-active-directory-access-token';
options: {
Expand Down Expand Up @@ -333,7 +348,7 @@ interface ErrorWithCode extends Error {

interface InternalConnectionConfig {
server: string;
authentication: DefaultAuthentication | NtlmAuthentication | AzureActiveDirectoryPasswordAuthentication | AzureActiveDirectoryMsiAppServiceAuthentication | AzureActiveDirectoryMsiVmAuthentication | AzureActiveDirectoryAccessTokenAuthentication | AzureActiveDirectoryServicePrincipalSecret;
authentication: DefaultAuthentication | NtlmAuthentication | AzureActiveDirectoryPasswordAuthentication | AzureActiveDirectoryMsiAppServiceAuthentication | AzureActiveDirectoryMsiVmAuthentication | AzureActiveDirectoryAccessTokenAuthentication | AzureActiveDirectoryServicePrincipalSecret | AzureActiveDirectoryDefaultAuthentication;
options: InternalConnectionOptions;
}

Expand Down Expand Up @@ -421,7 +436,8 @@ type Authentication = DefaultAuthentication |
AzureActiveDirectoryMsiAppServiceAuthentication |
AzureActiveDirectoryMsiVmAuthentication |
AzureActiveDirectoryAccessTokenAuthentication |
AzureActiveDirectoryServicePrincipalSecret;
AzureActiveDirectoryServicePrincipalSecret |
AzureActiveDirectoryDefaultAuthentication;

type AuthenticationType = Authentication['type'];

Expand Down Expand Up @@ -472,6 +488,7 @@ interface AuthenticationOptions {
* Type of the authentication method, valid types are `default`, `ntlm`,
* `azure-active-directory-password`, `azure-active-directory-access-token`,
* `azure-active-directory-msi-vm`, `azure-active-directory-msi-app-service`,
* `azure-active-directory-default`
* or `azure-active-directory-service-principal-secret`
*/
type?: AuthenticationType;
Expand All @@ -485,6 +502,7 @@ interface AuthenticationOptions {
* * `azure-active-directory-msi-vm` : [[AzureActiveDirectoryMsiVmAuthentication.options]]
* * `azure-active-directory-msi-app-service` : [[AzureActiveDirectoryMsiAppServiceAuthentication.options]]
* * `azure-active-directory-service-principal-secret` : [[AzureActiveDirectoryServicePrincipalSecret.options]]
* * `azure-active-directory-default` : [[AzureActiveDirectoryDefaultAuthentication.options]]
*/
options?: any;
}
Expand Down Expand Up @@ -1063,8 +1081,8 @@ class Connection extends EventEmitter {
throw new TypeError('The "config.authentication.type" property must be of type string.');
}

if (type !== 'default' && type !== 'ntlm' && type !== 'azure-active-directory-password' && type !== 'azure-active-directory-access-token' && type !== 'azure-active-directory-msi-vm' && type !== 'azure-active-directory-msi-app-service' && type !== 'azure-active-directory-service-principal-secret') {
throw new TypeError('The "type" property must one of "default", "ntlm", "azure-active-directory-password", "azure-active-directory-access-token", "azure-active-directory-msi-vm" or "azure-active-directory-msi-app-service" or "azure-active-directory-service-principal-secret".');
if (type !== 'default' && type !== 'ntlm' && type !== 'azure-active-directory-password' && type !== 'azure-active-directory-access-token' && type !== 'azure-active-directory-msi-vm' && type !== 'azure-active-directory-msi-app-service' && type !== 'azure-active-directory-service-principal-secret' && type !== 'azure-active-directory-default') {
throw new TypeError('The "type" property must one of "default", "ntlm", "azure-active-directory-password", "azure-active-directory-access-token", "azure-active-directory-default", "azure-active-directory-msi-vm" or "azure-active-directory-msi-app-service" or "azure-active-directory-service-principal-secret".');
}

if (typeof options !== 'object' || options === null) {
Expand Down Expand Up @@ -1148,6 +1166,16 @@ class Connection extends EventEmitter {
clientId: options.clientId
}
};
} else if (type === 'azure-active-directory-default') {
if (options.clientId !== undefined && typeof options.clientId !== 'string') {
throw new TypeError('The "config.authentication.options.clientId" property must be of type string.');
}
authentication = {
type: 'azure-active-directory-default',
options: {
clientId: options.clientId
}
};
} else if (type === 'azure-active-directory-msi-app-service') {
if (options.clientId !== undefined && typeof options.clientId !== 'string') {
throw new TypeError('The "config.authentication.options.clientId" property must be of type string.');
Expand Down Expand Up @@ -2295,6 +2323,7 @@ class Connection extends EventEmitter {
break;

case 'azure-active-directory-msi-vm':
case 'azure-active-directory-default':
case 'azure-active-directory-msi-app-service':
case 'azure-active-directory-service-principal-secret':
payload.fedAuth = {
Expand Down Expand Up @@ -3276,8 +3305,7 @@ Connection.prototype.STATE = {
this.sendLogin7Packet();

const { authentication } = this.config;

if (authentication.type === 'azure-active-directory-password' || authentication.type === 'azure-active-directory-msi-vm' || authentication.type === 'azure-active-directory-msi-app-service' || authentication.type === 'azure-active-directory-service-principal-secret') {
if (authentication.type === 'azure-active-directory-password' || authentication.type === 'azure-active-directory-msi-vm' || authentication.type === 'azure-active-directory-msi-app-service' || authentication.type === 'azure-active-directory-service-principal-secret' || authentication.type === 'azure-active-directory-default') {
this.transitionTo(this.STATE.SENT_LOGIN7_WITH_FEDAUTH);
} else if (authentication.type === 'ntlm') {
this.transitionTo(this.STATE.SENT_LOGIN7_WITH_NTLM);
Expand Down Expand Up @@ -3440,7 +3468,7 @@ Connection.prototype.STATE = {
const fedAuthInfoToken = handler.fedAuthInfoToken;

if (fedAuthInfoToken && fedAuthInfoToken.stsurl && fedAuthInfoToken.spn) {
const authentication = this.config.authentication as AzureActiveDirectoryPasswordAuthentication | AzureActiveDirectoryMsiVmAuthentication | AzureActiveDirectoryMsiAppServiceAuthentication | AzureActiveDirectoryServicePrincipalSecret;
const authentication = this.config.authentication as AzureActiveDirectoryPasswordAuthentication | AzureActiveDirectoryMsiVmAuthentication | AzureActiveDirectoryMsiAppServiceAuthentication | AzureActiveDirectoryServicePrincipalSecret | AzureActiveDirectoryDefaultAuthentication;
const tokenScope = new URL('/.default', fedAuthInfoToken.spn).toString();

const getToken = (callback: (error: Error | null, token?: string) => void) => {
Expand All @@ -3463,6 +3491,11 @@ Connection.prototype.STATE = {
const msiArgs = authentication.options.clientId ? [ authentication.options.clientId, {} ] : [ {} ];
const credentials = new ManagedIdentityCredential(...msiArgs);

getTokenFromCredentials(credentials);
} else if (authentication.type === 'azure-active-directory-default') {
const args = authentication.options.clientId ? { managedIdentityClientId: authentication.options.clientId } : {};
const credentials = new DefaultAzureCredential(args);

getTokenFromCredentials(credentials);
} else if (authentication.type === 'azure-active-directory-service-principal-secret') {
const credentials = new ClientSecretCredential(
Expand Down
2 changes: 1 addition & 1 deletion src/token/handler.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -303,7 +303,7 @@ export class Login7TokenHandler extends TokenHandler {
onFeatureExtAck(token: FeatureExtAckToken) {
const { authentication } = this.connection.config;

if (authentication.type === 'azure-active-directory-password' || authentication.type === 'azure-active-directory-access-token' || authentication.type === 'azure-active-directory-msi-vm' || authentication.type === 'azure-active-directory-msi-app-service' || authentication.type === 'azure-active-directory-service-principal-secret') {
if (authentication.type === 'azure-active-directory-password' || authentication.type === 'azure-active-directory-access-token' || authentication.type === 'azure-active-directory-msi-vm' || authentication.type === 'azure-active-directory-msi-app-service' || authentication.type === 'azure-active-directory-service-principal-secret' || authentication.type === 'azure-active-directory-default') {
if (token.fedAuth === undefined) {
this.connection.loginError = new ConnectionError('Did not receive Active Directory authentication acknowledgement');
} else if (token.fedAuth.length !== 0) {
Expand Down

0 comments on commit 4261073

Please sign in to comment.