Open up token audience for authentication #8

alexeldeib · 2018-08-24T18:48:24Z

No description provided.

amarzavery · 2018-08-24T20:43:53Z

lib/login.ts

-    // We dont need to get the subscriptionList if the tokenAudience is graph as graph clients are tenant based.
-    if (!(options.tokenAudience && options.tokenAudience === TokenAudience.graph)) {
+    // We only need to get the subscriptionList if the tokenAudience is for a management client.
+    if (options.tokenAudience && options.tokenAudience === options.environment.activeDirectoryResourceId) {


This check also needs to happen for interactive login. I think we missed adding it over there while doing the initial port from ms-rest-azure.

After building the tenantList, we get subscriptions from different tenants. This exercise populates the token cache with tokens across all the tenants. However, this exercise should only be done for managementPlane token audience (whether logging in via username/password, service/principal or interactive).

So the check happening over here in the old runtime needs to happen in this project over here as well. Basically pass an empty list of tenants to getSubscriptionFromTenants if the tokenAudience is not a managementplane token audience.

ignore this comment. I just saw that you have taken care of this below.

alexeldeib · 2018-08-24T21:07:42Z

lib/login.ts

@@ -455,7 +455,7 @@ export async function withInteractiveWithAuthResponse(options?: InteractiveLogin
        if (error) {
          return reject(error);
        }
-        interactiveOptions.username = tokenResponse.userId;
+        interactiveOptions.userName = tokenResponse.userId;


@amarzavery @RikkiGibson FYI, I think this fixes interactive login. ADAL couldn't match the token in the cache because it used [email protected] as cache key, while the token had been acquired correctly with the user's email.

Agreed. Thanks for fixing this. This is absolutely correct.

This is the most JavaScript bug ever.

amarzavery · 2018-08-24T21:19:09Z

While looking at that source code in the old runtime over here, I found that we pass the tokenAudience if provided otherwise environment.activeDirectoryResourceId as the resource to acquireTokenWithDeviceCode and acquireUserCode. I did not see that part being ported over.
Another issue that is tangential to the problem you are solving was reported in ms-rest-azure. adal-node would intermittently send an error autorization_pending and the work around was to trap that error, wait for sometime and try again till the error goes away. This was fixed over here in ms-rest-azure. Is it possible for you to patch this as well, while you are improving the interactive login auth experience in this library. It would greatly benefit everyone and all issues pertaining to auth will be resolved. If you think, it will take too much time, then that is totally fine as well.

Thanks a ton for taking time and sending a PR 👍 .

RikkiGibson · 2018-08-24T21:19:56Z

THANK YOU @alexeldeib!

amarzavery · 2018-08-24T21:28:18Z

typings/lib/credentials/tokenCredentialsBase.d.ts

@@ -31,7 +30,7 @@ export declare abstract class TokenCredentialsBase {
    tokenCache: any;
    protected readonly isGraphContext: boolean;
    protected readonly authContext: any;
-    constructor(clientId: string, domain: string, tokenAudience?: TokenAudience | undefined, environment?: {
+    constructor(clientId: string, domain: string, tokenAudience?: string | undefined, environment?: {


This should still be TokenAudience | undefined. Since over here we have the TokenAudience type defined.

Moreover, we should keep the code backwards compatible. ms-rest-azure supported "graph" | "batch" | undefined. Can you please add support for batch as well?

I think this change should also happen in ms-rest-azure-env

The compiler is being smart and simplifying the union type of string with string automatically to remove the enum. I fiddled around with ways to trick the compiler (union type of string with enum of string, etc) but didn't get much.

I can manually fix the typings to use TokenAudience, it will cause drift in the future for generation. Just a thought for reference.

I'll add batch too.

amarzavery · 2018-08-24T21:31:18Z

lib/credentials/tokenCredentialsBase.ts

@@ -31,7 +31,7 @@ export abstract class TokenCredentialsBase {
      throw new Error("domain must be a non empty string.");
    }

-    if (this.tokenAudience === TokenAudience.graph) {
+    if (this.tokenAudience === "graph") {
      this.isGraphContext = true;


Since we only supported graph, this property isGraphContext made sense. I believe don't need this anymore.

amarzavery · 2018-08-24T21:35:23Z

lib/credentials/tokenCredentialsBase.ts

      ? this.environment.activeDirectoryGraphResourceId
      : this.environment.activeDirectoryResourceId;

+    if (this.tokenAudience) {
+      resource =  this.tokenAudience;
+    }


This would be much simpler now

protected getActiveDirectoryResourceId(): string { let resource = this.environment.activeDirectoryResourceId; if (this.tokenAudience) { resource = this.tokenAudience; if (this.tokenAudience === "graph") { resource = this.environment.activeDirectoryGraphResourceId; } else if (this.tokenAudience === "graph") { resource = this.environment.batchResourceId; } } return resource; }

amarzavery · 2018-08-24T21:53:11Z

I see. Then just having graph | batch | string | undefined would work

alexeldeib · 2018-08-24T22:30:56Z

Actually, I think something weirder is happening. The compiler uses TokenAudience on the non-abstract implementations of TokenCredentialsBase, but it doesn't want to use accept TokenAudience type on the abstract base class?

Might be something weird on my machine/locally; happy to leave it whichever way you prefer, since it doesn't seem like there's an inherent issue.

amarzavery · 2018-08-24T22:32:49Z

lib/credentials/applicationTokenCredentials.ts

@@ -16,8 +16,8 @@ export class ApplicationTokenCredentials extends TokenCredentialsBase {
   * @param {string} clientId The active directory application client id.
   * @param {string} domain The domain or tenant id containing this application.
   * @param {string} secret The authentication secret for the application.
-   * @param {string} [tokenAudience] The audience for which the token is requested. Valid value is "graph". If tokenAudience is provided
-   * then domain should also be provided its value should not be the default "common" tenant. It must be a string (preferrably in a guid format).
+   * @param {string} [tokenAudience] The audience for which the token is requested. Valid values are 'graph' or any other resource like 'https://vault.azure.com/'.


graph or batch or ...

amarzavery · 2018-08-24T22:33:00Z

lib/credentials/deviceTokenCredentials.ts

-   * @param {string} [tokenAudience] The audience for which the token is requested. Valid value is "graph". If tokenAudience is provided
-   * then domain should also be provided and its value should not be the default "common" tenant. It must be a string (preferrably in a guid format).
+   * @param {string} [tokenAudience] The audience for which the token is requested. Valid values are 'graph' or any other resource like 'https://vault.azure.com/'.
+   * If tokenAudience is 'graph' then domain should also be provided and its value should not be the default 'common' tenant. It must be a string (preferrably in a guid format).


same as above.

amarzavery · 2018-08-24T22:33:40Z

lib/credentials/tokenCredentialsBase.ts

+      resource = this.tokenAudience;
+      if (this.tokenAudience === "graph") {
+        resource = this.environment.activeDirectoryGraphResourceId;
+      } else if (this.tokenAudience === "graph") {


=== "batch"

I think I messed it up while providing the code snippet

I fixed it, and then re copied it wrong 😄

alexeldeib · 2018-08-24T22:40:11Z

lib/login.ts

-  const getUserCode = new Promise<any>((resolve, reject) => {
-    return authContext.acquireUserCode(interactiveOptions.environment.activeDirectoryResourceId, interactiveOptions.clientId, interactiveOptions.language, (err: Error, userCodeRes: any) => {
+
+  function tryAcquireToken(interactiveOptions: InteractiveLoginOptions, resolve: any, reject: any) {


@amarzavery This is about as close as I could get to the other implementation, but I haven't hit the mentioned issue or have a repro, so PSA that this is untested from me.

Cool. No worries. Looking at the changes it looks good to me.

amarzavery · 2018-08-24T22:48:00Z

Referencing this PR Azure/ms-rest-azure-env#2 as it is related to this change.
@alexeldeib - Please update the min version for ms-rest-azure-env dependency to "^0.1.1"

…t missed

amarzavery · 2018-08-25T00:19:09Z

Just published ms-rest-azure-env: "0.1.1" with support for batchResourceId.

amarzavery · 2018-08-25T00:19:56Z

@alexeldeib - BIG BIG thank you for helping us improve the quality of ms-rest-nodeauth. Merging this PR.

alexeldeib · 2018-08-25T01:08:21Z

@amarzavery thanks in return for the quick turnaround! Glad I could contribute 😄

alexeldeib added 4 commits August 23, 2018 18:59

attempt a fix at node auth

f0d64de

fix base class function

ceb1188

fix login.js

fd59a0d

Remove static array of management plane ops.

6153d3a

jhendrixMSFT added the in progress label Aug 24, 2018

alexeldeib mentioned this pull request Aug 24, 2018

Port over auth related changes done in ms-rest-azure #5

Closed

amarzavery reviewed Aug 24, 2018

View reviewed changes

fix interactive login

af44747

alexeldeib commented Aug 24, 2018

View reviewed changes

Update parameter comments for token audience to reflect accepting URLs

fe03b46

amarzavery reviewed Aug 24, 2018

View reviewed changes

add batch, remove graph context, add interactive login token audiences

3618e51

amarzavery approved these changes Aug 24, 2018

View reviewed changes

add more batch files

0b1c9cc

amarzavery reviewed Aug 24, 2018

View reviewed changes

revert bad authConstant change

df2dec9

amarzavery reviewed Aug 24, 2018

View reviewed changes

fix comments, graph -> batch

6bd8f01

alexeldeib commented Aug 24, 2018

View reviewed changes

bump ms-rest-azure-env to 0.1.1, add comment fixes that apparently go…

3102fbd

…t missed

amarzavery merged commit 8b25859 into Azure:master Aug 25, 2018

jhendrixMSFT removed the in progress label Aug 25, 2018

kpajdzik mentioned this pull request Aug 27, 2018

Fix ms-rest-nodeauth interactiveLogin Azure/ms-rest-js#156

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Open up token audience for authentication #8

Open up token audience for authentication #8

alexeldeib commented Aug 24, 2018

amarzavery Aug 24, 2018 •

edited

Loading

amarzavery Aug 24, 2018

alexeldeib Aug 24, 2018

amarzavery Aug 24, 2018

RikkiGibson Aug 24, 2018

amarzavery commented Aug 24, 2018 •

edited

Loading

RikkiGibson commented Aug 24, 2018

amarzavery Aug 24, 2018

alexeldeib Aug 24, 2018

amarzavery Aug 24, 2018

amarzavery Aug 24, 2018

amarzavery commented Aug 24, 2018

alexeldeib commented Aug 24, 2018

amarzavery Aug 24, 2018

amarzavery Aug 24, 2018

amarzavery Aug 24, 2018

amarzavery Aug 24, 2018

alexeldeib Aug 24, 2018

alexeldeib Aug 24, 2018

amarzavery Aug 24, 2018

amarzavery commented Aug 24, 2018

amarzavery commented Aug 25, 2018

amarzavery commented Aug 25, 2018

alexeldeib commented Aug 25, 2018

Open up token audience for authentication #8

Open up token audience for authentication #8

Conversation

alexeldeib commented Aug 24, 2018

amarzavery Aug 24, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

amarzavery commented Aug 24, 2018 • edited Loading

RikkiGibson commented Aug 24, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

amarzavery commented Aug 24, 2018

alexeldeib commented Aug 24, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

amarzavery commented Aug 24, 2018

amarzavery commented Aug 25, 2018

amarzavery commented Aug 25, 2018

alexeldeib commented Aug 25, 2018

amarzavery Aug 24, 2018 •

edited

Loading

amarzavery commented Aug 24, 2018 •

edited

Loading