-
Notifications
You must be signed in to change notification settings - Fork 276
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
* Add MSAL support * Remove support old TS versions 3.5, 3.6, 3.7
- Loading branch information
1 parent
123cc88
commit fff65b4
Showing
8 changed files
with
256 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
136 changes: 136 additions & 0 deletions
136
libraries/botframework-connector/src/auth/msalAppCredentials.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,136 @@ | ||
| /** | ||
| * @module botframework-connector | ||
| */ | ||
| // Copyright (c) Microsoft Corporation. | ||
| // Licensed under the MIT License. | ||
|
|
||
| import { AppCredentials } from './appCredentials'; | ||
| import { ConfidentialClientApplication, NodeAuthOptions } from '@azure/msal-node'; | ||
| import { TokenResponse } from 'adal-node'; | ||
|
|
||
| export interface Certificate { | ||
| thumbprint: string; | ||
| privateKey: string; | ||
| } | ||
|
|
||
| /** | ||
| * An implementation of AppCredentials that uses @azure/msal-node to fetch tokens. | ||
| */ | ||
| export class MsalAppCredentials extends AppCredentials { | ||
| /** | ||
| * A reference used for Empty auth scenarios | ||
| */ | ||
| static Empty = new MsalAppCredentials(); | ||
|
|
||
| private readonly clientApplication?: ConfidentialClientApplication; | ||
|
|
||
| /** | ||
| * Create an MsalAppCredentials instance using a confidential client application. | ||
| * | ||
| * @param clientApplication An @azure/msal-node ConfidentialClientApplication instance. | ||
| * @param appId The application ID. | ||
| * @param authority The authority to use for fetching tokens | ||
| * @param scope The oauth scope to use when fetching tokens. | ||
| */ | ||
| constructor(clientApplication: ConfidentialClientApplication, appId: string, authority: string, scope: string); | ||
|
|
||
| /** | ||
| * Create an MsalAppCredentials instance using a confidential client application. | ||
| * | ||
| * @param appId The application ID. | ||
| * @param appPassword The application password. | ||
| * @param authority The authority to use for fetching tokens | ||
| * @param scope The oauth scope to use when fetching tokens. | ||
| */ | ||
| constructor(appId: string, appPassword: string, authority: string, scope: string); | ||
|
|
||
| /** | ||
| * Create an MsalAppCredentials instance using a confidential client application. | ||
| * | ||
| * @param appId The application ID. | ||
| * @param certificate The client certificate details. | ||
| * @param authority The authority to use for fetching tokens | ||
| * @param scope The oauth scope to use when fetching tokens. | ||
| */ | ||
| constructor(appId: string, certificate: Certificate, authority: string, scope: string); | ||
|
|
||
| /** | ||
| * @internal | ||
| */ | ||
| constructor(); | ||
|
|
||
| /** | ||
| * @internal | ||
| */ | ||
| constructor( | ||
| maybeClientApplicationOrAppId?: ConfidentialClientApplication | string, | ||
| maybeAppIdOrAppPasswordOrCertificate?: string | Certificate, | ||
| maybeAuthority?: string, | ||
| maybeScope?: string | ||
| ) { | ||
| const appId = | ||
| typeof maybeClientApplicationOrAppId === 'string' | ||
| ? maybeClientApplicationOrAppId | ||
| : typeof maybeAppIdOrAppPasswordOrCertificate === 'string' | ||
| ? maybeAppIdOrAppPasswordOrCertificate | ||
| : undefined; | ||
|
|
||
| super(appId, undefined, maybeScope); | ||
|
|
||
| if (typeof maybeClientApplicationOrAppId !== 'string') { | ||
| this.clientApplication = maybeClientApplicationOrAppId; | ||
| } else { | ||
| const auth: NodeAuthOptions = { | ||
| authority: maybeAuthority, | ||
| clientId: appId, | ||
| }; | ||
|
|
||
| auth.clientCertificate = | ||
| typeof maybeAppIdOrAppPasswordOrCertificate !== 'string' | ||
| ? maybeAppIdOrAppPasswordOrCertificate | ||
| : undefined; | ||
|
|
||
| auth.clientSecret = | ||
| typeof maybeAppIdOrAppPasswordOrCertificate === 'string' | ||
| ? maybeAppIdOrAppPasswordOrCertificate | ||
| : undefined; | ||
|
|
||
| this.clientApplication = new ConfidentialClientApplication({ auth }); | ||
| } | ||
| } | ||
|
|
||
| /** | ||
| * @inheritdoc | ||
| */ | ||
| protected async refreshToken(): Promise<TokenResponse> { | ||
| if (!this.clientApplication) { | ||
| throw new Error('getToken should not be called for empty credentials.'); | ||
| } | ||
|
|
||
| const scopePostfix = '/.default'; | ||
| let scope = this.oAuthScope; | ||
| if (!scope.endsWith(scopePostfix)) { | ||
| scope = `${scope}${scopePostfix}`; | ||
| } | ||
|
|
||
| const token = await this.clientApplication.acquireTokenByClientCredential({ | ||
| scopes: [scope], | ||
| skipCache: true, | ||
| }); | ||
|
|
||
| const { accessToken } = token ?? {}; | ||
| if (typeof accessToken !== 'string') { | ||
| throw new Error('Authentication: No access token received from MSAL.'); | ||
| } | ||
|
|
||
| const expiresIn = (token.expiresOn.getTime() - Date.now()) / 1000; | ||
|
|
||
| return { | ||
| accessToken: token.accessToken, | ||
| expiresOn: token.expiresOn, | ||
| tokenType: token.tokenType, | ||
| expiresIn: expiresIn, | ||
| resource: this.oAuthScope, | ||
| }; | ||
| } | ||
| } |
84 changes: 84 additions & 0 deletions
84
libraries/botframework-connector/src/auth/msalServiceClientCredentialsFactory.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| /** | ||
| * @module botframework-connector | ||
| */ | ||
| // Copyright (c) Microsoft Corporation. | ||
| // Licensed under the MIT License. | ||
|
|
||
| import { ConfidentialClientApplication } from '@azure/msal-node'; | ||
| import { MsalAppCredentials } from './msalAppCredentials'; | ||
| import { ServiceClientCredentials } from '@azure/ms-rest-js'; | ||
| import { ServiceClientCredentialsFactory } from './serviceClientCredentialsFactory'; | ||
| import { AuthenticationConstants } from './authenticationConstants'; | ||
| import { GovernmentConstants } from './governmentConstants'; | ||
|
|
||
| /** | ||
| * An implementation of ServiceClientCredentialsFactory that generates MsalAppCredentials | ||
| */ | ||
| export class MsalServiceClientCredentialsFactory implements ServiceClientCredentialsFactory { | ||
| private readonly appId: string; | ||
|
|
||
| /** | ||
| * Create an MsalServiceClientCredentialsFactory instance using runtime configuration and an | ||
| * `@azure/msal-node` `ConfidentialClientApplication`. | ||
| * | ||
| * @param appId App ID for validation. | ||
| * @param clientApplication An `@azure/msal-node` `ConfidentialClientApplication` instance. | ||
| */ | ||
| constructor(appId: string, private readonly clientApplication: ConfidentialClientApplication) { | ||
| this.appId = appId; | ||
| } | ||
|
|
||
| /** | ||
| * @inheritdoc | ||
| */ | ||
| async isValidAppId(appId: string): Promise<boolean> { | ||
| return appId === this.appId; | ||
| } | ||
|
|
||
| /** | ||
| * @inheritdoc | ||
| */ | ||
| async isAuthenticationDisabled(): Promise<boolean> { | ||
| return !this.appId; | ||
| } | ||
|
|
||
| /** | ||
| * @inheritdoc | ||
| */ | ||
| async createCredentials( | ||
| appId: string, | ||
| audience: string, | ||
| loginEndpoint: string, | ||
| _validateAuthority: boolean | ||
| ): Promise<ServiceClientCredentials> { | ||
| if (await this.isAuthenticationDisabled()) { | ||
| return MsalAppCredentials.Empty; | ||
| } | ||
|
|
||
| if (!(await this.isValidAppId(appId))) { | ||
| throw new Error('Invalid appId.'); | ||
| } | ||
|
|
||
| const normalizedEndpoint = loginEndpoint.toLowerCase(); | ||
|
|
||
| if (normalizedEndpoint.startsWith(AuthenticationConstants.ToChannelFromBotLoginUrlPrefix)) { | ||
| return new MsalAppCredentials( | ||
| this.clientApplication, | ||
| appId, | ||
| undefined, | ||
| audience || AuthenticationConstants.ToBotFromChannelTokenIssuer | ||
| ); | ||
| } | ||
|
|
||
| if (normalizedEndpoint === GovernmentConstants.ToChannelFromBotLoginUrl.toLowerCase()) { | ||
| return new MsalAppCredentials( | ||
| this.clientApplication, | ||
| appId, | ||
| GovernmentConstants.ToChannelFromBotLoginUrl, | ||
| audience || GovernmentConstants.ToChannelFromBotOAuthScope | ||
| ); | ||
| } | ||
|
|
||
| return new MsalAppCredentials(this.clientApplication, appId, loginEndpoint, audience); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters