Skip to content

Commit dbc12ec

Browse files
timovvtimovv
authored
[keyvault] CAE support (#31140)
### Packages impacted by this PR - `@azure/keyvault-common` - Downstream Key Vault packages ### Issues associated with this PR - Private ### Describe the problem that is addressed by this PR In future, the Key Vault service will be adding support for Continuous Access Evaluation (CAE). This PR adds the necessary support to the SDK's challenge-based authentication policy to enable this feature. After the initial challenge, with CAE enabled, any future request may result in a 401 response, even if the access token used is valid. This PR adds a new policy that handles this CAE challenge alongside the normal challenge. The new policy replaces the existing use of Core's `bearerTokenAuthenticationPolicy`, which is no longer suitable for this use case since it cannot handle a CAE challenge that comes immediately after a regular challenge. ### Are there test cases added in this PR? _(If not, why?)_ Yes, added test cases with mock requests and responses to cover a number of different scenarios, ensuring the policy is doing the right thing. I also manually tested against a test resource provided by the Key Vault team which returns a CAE challenge in response to any authorized request to the vault, and got the expected result (a normal challenge handled successfully, followed by a CAE challenge handled successfully, followed by another CAE challenge which the policy does not handle). ### Provide a list of related PRs _(if any)_ - Java PR for same feature: Azure/azure-sdk-for-java#41814
1 parent 3a0deb8 commit dbc12ec

37 files changed

+760
-448
lines changed

‎sdk/keyvault/keyvault-admin/CHANGELOG.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
# Release History
22

3-
## 4.5.1 (Unreleased)
3+
## 4.6.0 (Unreleased)
44

55
### Features Added
66

7+
- Add support for Continuous Access Evaluation (CAE). [#31140](https://github.com/Azure/azure-sdk-for-js/pull/31140)
8+
79
### Breaking Changes
810

911
### Bugs Fixed

‎sdk/keyvault/keyvault-admin/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "@azure/keyvault-admin",
33
"sdk-type": "client",
44
"author": "Microsoft Corporation",
5-
"version": "4.5.1",
5+
"version": "4.6.0",
66
"license": "MIT",
77
"description": "Isomorphic client library for Azure KeyVault's administrative functions.",
88
"homepage": "https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/keyvault/keyvault-admin/README.md",
@@ -99,7 +99,7 @@
9999
"@azure/core-rest-pipeline": "^1.1.0",
100100
"@azure/core-tracing": "^1.0.0",
101101
"@azure/core-util": "^1.0.0",
102-
"@azure/keyvault-common": "^1.0.0",
102+
"@azure/keyvault-common": "^2.0.0",
103103
"@azure/logger": "^1.0.0",
104104
"tslib": "^2.2.0"
105105
},

‎sdk/keyvault/keyvault-admin/src/accessControlClient.ts‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,7 @@ import { LATEST_API_VERSION } from "./constants.js";
2323
import { PagedAsyncIterableIterator } from "@azure/core-paging";
2424
import { RoleAssignmentsListForScopeOptionalParams } from "./generated/models/index.js";
2525
import { TokenCredential } from "@azure/core-auth";
26-
import { bearerTokenAuthenticationPolicy } from "@azure/core-rest-pipeline";
27-
import { createKeyVaultChallengeCallbacks } from "@azure/keyvault-common";
26+
import { keyVaultAuthenticationPolicy } from "@azure/keyvault-common";
2827
import { logger } from "./log.js";
2928
import { mappings } from "./mappings.js";
3029
import { tracingClient } from "./tracing.js";
@@ -87,15 +86,11 @@ export class KeyVaultAccessControlClient {
8786

8887
this.client = new KeyVaultClient(serviceVersion, clientOptions);
8988

90-
this.client.pipeline.addPolicy(
91-
bearerTokenAuthenticationPolicy({
92-
credential,
93-
// The scopes will be populated in the challenge callbacks based on the WWW-authenticate header
94-
// returned by the challenge, so pass an empty array as a placeholder.
95-
scopes: [],
96-
challengeCallbacks: createKeyVaultChallengeCallbacks(options),
97-
}),
98-
);
89+
// The authentication policy must come after the deserialization policy since the deserialization policy
90+
// converts 401 responses to an Error, and we don't want to deal with that.
91+
this.client.pipeline.addPolicy(keyVaultAuthenticationPolicy(credential, clientOptions), {
92+
afterPolicies: ["deserializationPolicy"],
93+
});
9994
}
10095

10196
/**

‎sdk/keyvault/keyvault-admin/src/backupClient.ts‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,7 @@ import { KeyVaultSelectiveKeyRestorePoller } from "./lro/selectiveKeyRestore/pol
2121
import { LATEST_API_VERSION } from "./constants.js";
2222
import { PollerLike } from "@azure/core-lro";
2323
import { TokenCredential } from "@azure/core-auth";
24-
import { bearerTokenAuthenticationPolicy } from "@azure/core-rest-pipeline";
25-
import { createKeyVaultChallengeCallbacks } from "@azure/keyvault-common";
24+
import { keyVaultAuthenticationPolicy } from "@azure/keyvault-common";
2625
import { logger } from "./log.js";
2726
import { mappings } from "./mappings.js";
2827

@@ -89,15 +88,11 @@ export class KeyVaultBackupClient {
8988
};
9089

9190
this.client = new KeyVaultClient(apiVersion, clientOptions);
92-
this.client.pipeline.addPolicy(
93-
bearerTokenAuthenticationPolicy({
94-
credential,
95-
// The scopes will be populated in the challenge callbacks based on the WWW-authenticate header
96-
// returned by the challenge, so pass an empty array as a placeholder.
97-
scopes: [],
98-
challengeCallbacks: createKeyVaultChallengeCallbacks(options),
99-
}),
100-
);
91+
// The authentication policy must come after the deserialization policy since the deserialization policy
92+
// converts 401 responses to an Error, and we don't want to deal with that.
93+
this.client.pipeline.addPolicy(keyVaultAuthenticationPolicy(credential, clientOptions), {
94+
afterPolicies: ["deserializationPolicy"],
95+
});
10196
}
10297

10398
/**

‎sdk/keyvault/keyvault-admin/src/constants.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
/**
55
* Current version of the Key Vault Admin SDK.
66
*/
7-
export const SDK_VERSION: string = "4.5.1";
7+
export const SDK_VERSION: string = "4.6.0";
88

99
/**
1010
* The latest supported Key Vault service API version.

‎sdk/keyvault/keyvault-admin/src/generated/keyVaultClientContext.ts‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎sdk/keyvault/keyvault-admin/src/settingsClient.ts‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,7 @@
22
// Licensed under the MIT License.
33

44
import { TokenCredential } from "@azure/core-auth";
5-
import { bearerTokenAuthenticationPolicy } from "@azure/core-rest-pipeline";
6-
import { createKeyVaultChallengeCallbacks } from "@azure/keyvault-common";
5+
import { keyVaultAuthenticationPolicy } from "@azure/keyvault-common";
76
import { LATEST_API_VERSION } from "./constants.js";
87
import { KeyVaultClient, Setting as GeneratedSetting } from "./generated/index.js";
98
import { logger } from "./log.js";
@@ -92,13 +91,12 @@ export class KeyVaultSettingsClient {
9291
};
9392

9493
this.client = new KeyVaultClient(apiVersion, clientOptions);
95-
this.client.pipeline.addPolicy(
96-
bearerTokenAuthenticationPolicy({
97-
credential,
98-
scopes: [],
99-
challengeCallbacks: createKeyVaultChallengeCallbacks(options),
100-
}),
101-
);
94+
95+
// The authentication policy must come after the deserialization policy since the deserialization policy
96+
// converts 401 responses to an Error, and we don't want to deal with that.
97+
this.client.pipeline.addPolicy(keyVaultAuthenticationPolicy(credential, clientOptions), {
98+
afterPolicies: ["deserializationPolicy"],
99+
});
102100
}
103101

104102
/**

‎sdk/keyvault/keyvault-admin/swagger/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ input-file:
1616
- https://raw.githubusercontent.com/Azure/azure-rest-api-specs/7452e1cc7db72fbc6cd9539b390d8b8e5c2a1864/specification/keyvault/data-plane/Microsoft.KeyVault/stable/7.5/settings.json
1717
output-folder: ../
1818
source-code-folder-path: ./src/generated
19-
package-version: 4.5.1
19+
package-version: 4.6.0
2020
use-extension:
2121
"@autorest/typescript": "6.0.0-beta.15"
2222
```

‎sdk/keyvault/keyvault-certificates/CHANGELOG.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
# Release History
22

3-
## 4.8.1 (Unreleased)
3+
## 4.9.0 (Unreleased)
44

55
### Features Added
66

7+
- Add support for Continuous Access Evaluation (CAE). [#31140](https://github.com/Azure/azure-sdk-for-js/pull/31140)
8+
79
### Breaking Changes
810

911
### Bugs Fixed

‎sdk/keyvault/keyvault-certificates/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "@azure/keyvault-certificates",
33
"sdk-type": "client",
44
"author": "Microsoft Corporation",
5-
"version": "4.8.1",
5+
"version": "4.9.0",
66
"license": "MIT",
77
"description": "Isomorphic client library for Azure KeyVault's certificates.",
88
"homepage": "https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/keyvault/keyvault-certificates/README.md",
@@ -103,7 +103,7 @@
103103
"@azure/core-rest-pipeline": "^1.8.0",
104104
"@azure/core-tracing": "^1.0.0",
105105
"@azure/core-util": "^1.6.1",
106-
"@azure/keyvault-common": "^1.0.0",
106+
"@azure/keyvault-common": "^2.0.0",
107107
"@azure/logger": "^1.0.0",
108108
"tslib": "^2.2.0"
109109
},

0 commit comments

Comments
 (0)