Integrate AzArtifacts Credential Provider #1765
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
alerickson
changed the title
…mment out cred provider tests
|
/azp run PowerShell.PSResourceGet |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
Just wondering, what is the state of this PR? Is it abandoned, or can I expect PSResourceGet to get support for AzDO auth in the near future? :) |
…ns are specified in RequiredModules section Fixes bug with generated nuspec dependency version range when RequiredVersion,MaxiumumVersion and ModuleVersion are specified in RequiredModules section
…d-Archive calls to that path will fail
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run PowerShell.PSResourceGet |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run PowerShell.PSResourceGet |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run PowerShell.PSResourceGet |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run PowerShell.PSResourceGet |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run PowerShell.PSResourceGet |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run PowerShell.PSResourceGet |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run PowerShell.PSResourceGet |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run PowerShell.PSResourceGet |
|
Azure Pipelines successfully started running 1 pipeline(s). |
alerickson
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
PR Summary
This PR integrates the Azure Artifacts Credential Provider into PSResourceGet.
Information on the cred provider and how to install, discover, and use the cred provider is located here: https://github.com/NuGet/Home/wiki/NuGet-cross-plat-authentication-plugin#plugin-installation-and-discovery.
Please use this link for setting up and configuring the cred provider for PSResourceGet as well. Also see: https://github.com/microsoft/artifacts-credprovider for using environment variables with the Credential Provider.
This PR adds a new dynamic parameter to
Register-PSResourceRepositoryandSet-PSResourceRepositorycalled-CredentialProvider, which is an enum with valuesNoneandAzArtifacts. The parameter only works with repositories that are notContainerRegistryrepositories. This is because the credential provider only works with Azure Artifact feeds, however Azure Artifact feeds can have any uri. Instead of only allowing the parameter to be used with Azure Artifact feeds, we are not allowing use for feeds in which we know we cannot use the credential provider for.PSResourceGet will automatically set the value
CredentialProvidertoAzArtifactsif it recognizes that the repository is definitely an Azure Artifacts feed. This is done by checking to see if the uri containspkgs.dev.azure.comorpkgs.visualstudio.com. This check is done when registering a new repository or when PSResourceGet reads repositories from thePSResourceRepository.xmlfile.PSResourceGet looks for the credential provider any time network credentials are set. The new priority ordering for credentials is:
1. Credentials passed in via parameter
-Credential.2. Credentials retrieved via the AzArtifacts Credential Provider.
3. Credentials retrieved from SecretManagement.
The Credential Provider can be bypassed by setting the
-CredentialProviderparameter toNone.If the
CredentialProviderproperty is set toAzArtifactsfor a repository, PSResourceGet will attempt to find the Credential Provider file on the machine in the following order:1. Checking the environment variable
NUGET_PLUGIN_PATHS2. Checking the default locations:
$env:UserProfile\.nuget\plugins3. Checking the fixed location where Visual Studio is installed:
common7\IDE\CommonExtensions\Microsoft\NuGetMore information on this discovery process can be found in the link above.
Once the Credential Provider is found, PSResourceGet calls the provider with the following arguments:
CredentialProvider.Microsoft.exe -Uri <uri> -NonInteractive -IsRetry -F JsonOr
dotnet CredentialProvider.Microsoft.dll -Uri <uri> -NonInteractive -IsRetry -F JsonRight now, this means that for Unix machines, there is a dependency on the dotnet cli to call the Credential Provider.
Once credentials are retrieved, they are used to make the network call, as is done when using the
-Credentialparameter or SecretManagement.PR Context
Resolves #1658
Resolves #1601
Resolves #1511
PR Checklist
.h,.cpp,.cs,.ps1and.psm1files have the correct copyright headerWIP:or[ WIP ]to the beginning of the title (theWIPbot will keep its status check atPendingwhile the prefix is present) and remove the prefix when the PR is ready.