Migrate Identity Live tests deployment to Fed Auth.

eng/pipelines/templates/jobs/live.tests.yml

@@ -24,6 +24,7 @@ parameters:
   UseHttpFaultInjector: false
   OSName:
   UseFederatedAuth: false
+  PersistOidcToken: false
   VersionOverride: $(VersionOverride)
 
 jobs:
@@ -114,6 +115,7 @@ jobs:
               SubscriptionConfiguration: $(SubscriptionConfiguration)
               ArmTemplateParameters: $(ArmTemplateParameters)
               UseFederatedAuth: ${{ parameters.UseFederatedAuth }}
+              PersistOidcToken: ${{ parameters.PersistOidcToken }}
               ServiceConnection: ${{ parameters.CloudConfig.ServiceConnection }}
               SubscriptionConfigurationFilePaths: ${{ parameters.CloudConfig.SubscriptionConfigurationFilePaths }}
               EnvVars:

eng/pipelines/templates/stages/archetype-sdk-tests-isolated.yml

@@ -115,6 +115,9 @@ parameters:
 - name: AdditionalSparseCheckoutPaths
   type: object
   default: []
+- name: PersistOidcToken
+  type: boolean
+  default: false
 
 stages:
 - ${{ each cloud in parameters.CloudConfig }}:
@@ -165,6 +168,7 @@ stages:
               TestOptions: ${{ parameters.TestOptions }}
               UseHttpFaultInjector: ${{ parameters.UseHttpFaultInjector }}
               UseFederatedAuth: ${{ parameters.UseFederatedAuth }}
+              PersistOidcToken: ${{ parameters.PersistOidcToken }}
 
             MatrixConfigs:
               # Enumerate platforms and additional platforms based on supported clouds (sparse platform<-->cloud matrix).

eng/pipelines/templates/stages/archetype-sdk-tests.yml

@@ -106,6 +106,9 @@ parameters:
   - name: UseFederatedAuth
     type: boolean
     default: true
+  - name: PersistOidcToken
+    type: boolean
+    default: false
 
 extends:
   template: /eng/pipelines/templates/stages/1es-redirect.yml

sdk/identity/azure-identity/src/test/java/LiveManagedIdentityTests.java

@@ -2,21 +2,25 @@
 // Licensed under the MIT License.
 
 import com.azure.core.credential.AccessToken;
+import com.azure.core.credential.TokenCredential;
 import com.azure.core.credential.TokenRequestContext;
 import com.azure.core.http.HttpClient;
 import com.azure.core.http.HttpMethod;
 import com.azure.core.http.HttpRequest;
 import com.azure.core.http.HttpResponse;
+import com.azure.core.test.InterceptorManager;
 import com.azure.core.test.TestProxyTestBase;
+import com.azure.core.test.utils.MockTokenCredential;
 import com.azure.core.util.Configuration;
+import com.azure.core.util.CoreUtils;
 import com.azure.core.util.logging.ClientLogger;
 import com.azure.core.util.logging.LogLevel;
-import com.azure.identity.ClientSecretCredential;
-import com.azure.identity.ClientSecretCredentialBuilder;
+import com.azure.identity.*;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Timeout;
 import org.junit.jupiter.api.condition.EnabledIfEnvironmentVariable;
 import org.junit.jupiter.api.condition.EnabledIfSystemProperty;
+import reactor.core.scheduler.Schedulers;
 
 import java.io.BufferedReader;
 import java.io.IOException;
@@ -69,9 +73,13 @@ public void testManagedIdentityAksDeployment() {
         //Setup Env
         Configuration configuration = Configuration.getGlobalConfiguration().clone();
 
-        String spClientId = configuration.get("IDENTITY_CLIENT_ID");
-        String secret = configuration.get("IDENTITY_CLIENT_SECRET");
-        String tenantId = configuration.get("IDENTITY_TENANT_ID");
+        String systemAccessToken = configuration.get("SYSTEM_ACCESSTOKEN");
+
+        String spClientId = configuration.get("AZURESUBSCRIPTION_CLIENT_ID");
+//        String oidc = configuration.get("AZ_OIDC_TOKEN");
+        String oidc = configuration.get("ARM_OIDC_TOKEN");
+//        String oidc = configuration.get("SYSTEM_ACCESSTOKEN");
+        String tenantId = configuration.get("AZURESUBSCRIPTION_TENANT_ID");
         String resourceGroup = configuration.get("IDENTITY_RESOURCE_GROUP");
         String aksCluster = configuration.get("IDENTITY_AKS_CLUSTER_NAME");
         String subscriptionId = configuration.get("IDENTITY_SUBSCRIPTION_ID");
@@ -81,7 +89,7 @@ public void testManagedIdentityAksDeployment() {
         String azPath = runCommand(pathCommand, "az").trim();
         String kubectlPath = runCommand(pathCommand, "kubectl").trim();
 
-        runCommand(azPath, "login", "--service-principal", "-u", spClientId, "-p", secret, "--tenant", tenantId);
+        runCommand(azPath, "login", "--federated-token", oidc,  "--service-principal", "-u", spClientId, "--tenant", tenantId);
         runCommand(azPath, "account", "set", "--subscription", subscriptionId);
         runCommand(azPath, "aks", "get-credentials", "--resource-group", resourceGroup, "--name", aksCluster,
             "--overwrite-existing");
@@ -105,9 +113,10 @@ public void testManagedIdentityVmDeployment() {
         //Setup Env
         Configuration configuration = Configuration.getGlobalConfiguration().clone();
 
-        String spClientId = configuration.get("IDENTITY_CLIENT_ID");
-        String secret = configuration.get("IDENTITY_CLIENT_SECRET");
-        String tenantId = configuration.get("IDENTITY_TENANT_ID");
+        String spClientId = configuration.get("AZURESUBSCRIPTION_CLIENT_ID");
+//        String oidc = configuration.get("SYSTEM_ACCESSTOKEN");
+        String oidc = configuration.get("ARM_OIDC_TOKEN");
+        String tenantId = configuration.get("AZURESUBSCRIPTION_TENANT_ID");
         String resourceGroup = configuration.get("IDENTITY_RESOURCE_GROUP");
         String subscriptionId = configuration.get("IDENTITY_SUBSCRIPTION_ID");
         String vmName = configuration.get("IDENTITY_VM_NAME");
@@ -118,7 +127,7 @@ public void testManagedIdentityVmDeployment() {
         String azPath = runCommand(isWindows ? "where" : "which", "az").trim();
         azPath = isWindows ? extractAzCmdPath(azPath) : azPath;
 
-        runCommand(azPath, "login", "--service-principal", "-u", spClientId, "-p", secret, "--tenant", tenantId);
+        runCommand(azPath, "login", "--federated-token", oidc,  "--service-principal", "-u", spClientId, "--tenant", tenantId);
         runCommand(azPath, "account", "set", "--subscription", subscriptionId);
 
         String storageKey = runCommand(azPath, "storage", "account", "keys", "list", "--account-name",

sdk/identity/ci.yml

@@ -73,12 +73,45 @@ extends:
     LiveTestStages:
       - template: /eng/pipelines/templates/stages/archetype-sdk-tests-isolated.yml
         parameters:
+          PreSteps:
+            - task: AzureCLI@2
+              displayName: Refreh OIDC token
+              env:
+                ARM_OIDC_TOKEN: $(ARM_OIDC_TOKEN)
+              inputs:
+                azureSubscription: azure-sdk-tests-public
+                addSpnToEnvironment: true
+                scriptLocation: inlineScript
+                scriptType: pscore
+                inlineScript: |
+                  Write-Host "##vso[task.setvariable variable=ARM_OIDC_TOKEN;issecret=true]$($env:idToken)"
+#            - task: AzureCLI@2
+#              displayName: "Refresh OIDC Token"
+#              inputs:
+#                azureSubscription: azure-sdk-tests-public
+#                scriptType: pscore
+#                scriptLocation: inlineScript
+#                addSpnToEnvironment: true
+#                inlineScript: |
+#                  Write-Host "Logging in to Azure with service principal..."
+#                  az login --service-principal -u $env:ARM_CLIENT_ID --federated-token $env:ARM_OIDC_TOKEN --tenant $env:ARM_TENANT_ID
+#                  Write-Host "Fetching a new federated token for Azure Resource Manager..."
+#                  $newToken = az account get-access-token --resource "api://AzureADTokenExchange" --query accessToken -o tsv
+#                  # Set the new token as a pipeline variable
+#                  Write-Host "##vso[task.setvariable variable=ARM_OIDC_TOKEN_TEST]$newToken"
+#              env:
+#                ARM_OIDC_TOKEN: $(ARM_OIDC_TOKEN)
+#                ARM_CLIENT_ID: $(AZURESUBSCRIPTION_CLIENT_ID)
+#                ARM_TENANT_ID: $(AZURESUBSCRIPTION_TENANT_ID)
+          PersistOidcToken: true
+          Location: 'westus2'
           CalledFromClient: true
           ServiceDirectory: identity
           SupportedClouds: 'Public,UsGov,China'
-          UseFederatedAuth: false
           EnvVars:
-            SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+            AZ_TENANT_ID: $(IDENTITY_TENANT_ID)
+            AZ_CLIENT_ID: $(IDENTITY_CLIENT_ID)
+            AZ_OIDC_TOKEN: $(ARM_OIDC_TOKEN)
           CloudConfig:
             Public:
               SubscriptionConfigurations:

sdk/identity/test-resources-post.ps1

@@ -42,10 +42,6 @@ $azBuildToolsRootPom = "$PSScriptRoot/../../eng/code-quality-reports/pom.xml" |
 $funcAppRoot = "$PSScriptRoot/live-test-apps/identity-test-function" | Resolve-Path
 $funcAppPom = "$funcAppRoot/pom.xml" | Resolve-Path
 
-az login --service-principal -u $(getVariable('IDENTITY_CLIENT_ID')) -p $(getVariable('IDENTITY_CLIENT_SECRET')) --tenant $(getVariable('IDENTITY_TENANT_ID'))
-az account set --subscription $(getVariable('IDENTITY_SUBSCRIPTION_ID'))
-
-
 mvn -ntp clean install -DskipTests "-Drevapi.skip=true" "-Dcheckstyle.skip=true" "-Dcodesnippet.skip=true" "-Dspotbugs.skip=true" "-Dmaven.javadoc.skip=true" "-Dspotless.check.skip=true" "-Dspotless.apply.skip=true" "-Djacoco.skip=true" -f $azBuildToolsRootPom | Write-Host
 mvn -ntp clean install -DskipTests "-Drevapi.skip=true" "-Dcheckstyle.skip=true" "-Dcodesnippet.skip=true" "-Dspotbugs.skip=true" "-Dmaven.javadoc.skip=true" "-Dspotless.check.skip=true" "-Dspotless.apply.skip=true" "-Djacoco.skip=true" -f "$azSerRootPom/azure-json/pom.xml" | Write-Host
 mvn -ntp clean install -DskipTests "-Drevapi.skip=true" "-Dcheckstyle.skip=true" "-Dcodesnippet.skip=true" "-Dspotbugs.skip=true" "-Dmaven.javadoc.skip=true" "-Dspotless.check.skip=true" "-Dspotless.apply.skip=true" "-Djacoco.skip=true" -f "$azSerRootPom/azure-xml/pom.xml" | Write-Host
@@ -61,7 +57,6 @@ mvn -ntp clean install -DskipTests "-Drevapi.skip=true" "-Dcheckstyle.skip=true"
 mvn -ntp clean install -DskipTests "-Drevapi.skip=true" "-Dcheckstyle.skip=true" "-Dcodesnippet.skip=true" "-Dspotbugs.skip=true" "-Dmaven.javadoc.skip=true" "-Dspotless.check.skip=true" "-Dspotless.apply.skip=true" "-Djacoco.skip=true" -f "$azStorageRootPom/azure-storage-internal-avro/pom.xml" | Write-Host
 mvn -ntp clean install -DskipTests "-Drevapi.skip=true" "-Dcheckstyle.skip=true" "-Dcodesnippet.skip=true" "-Dspotbugs.skip=true" "-Dmaven.javadoc.skip=true" "-Dspotless.check.skip=true" "-Dspotless.apply.skip=true" "-Djacoco.skip=true" -f "$azStorageRootPom/azure-storage-blob/pom.xml" | Write-Host
 
-
 mvn -ntp clean install -DskipTests -f $webappRootPom | Write-Host
 az webapp deploy --resource-group $(getVariable('IDENTITY_RESOURCE_GROUP')) --name $(getVariable('IDENTITY_WEBAPP_NAME')) --src-path "$webappRoot/target/identity-test-webapp-1.0.0-beta.1.jar" --type jar
 

sdk/identity/test-resources-pre.ps1

@@ -13,7 +13,15 @@ param (
 
     [Parameter(ParameterSetName = 'Provisioner', Mandatory = $true)]
     [ValidateNotNullOrEmpty()]
-    [string] $TenantId
+    [string] $TenantId,
+
+    [Parameter(Mandatory = $true)]
+    [ValidateNotNullOrEmpty()]
+    [string] $SubscriptionId,
+
+    [Parameter(Mandatory = $true)]
+    [ValidateNotNullOrEmpty()]
+    [string] $Environment
 )
 
 $az_version = az version
@@ -27,7 +35,9 @@ $sshKey = Get-Content $PSScriptRoot/sshKey.pub
 $templateFileParameters['sshPubKey'] = $sshKey
 
 # Get the max version that is not preview and then get the name of the patch version with the max value
-az login --service-principal -u $TestApplicationId -p $TestApplicationSecret --tenant $TenantId
+az cloud set --name $Environment
+az login --service-principal -u $TestApplicationId --tenant $TenantId --allow-no-subscriptions --federated-token $env:ARM_OIDC_TOKEN
+az account set --subscription $SubscriptionId
 $versions = az aks get-versions -l westus -o json | ConvertFrom-Json
 Write-Host "AKS versions: $($versions | ConvertTo-Json -Depth 100)"
 $patchVersions = $versions.values | Where-Object { $_.isPreview -eq $null } | Select-Object -ExpandProperty patchVersions