Skip to content

Azure DevOps token source and validator #54667

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
strideynet merged 19 commits into from
May 13, 2025
Merged

Azure DevOps token source and validator #54667

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
2a7082c
Initial impl of token source
strideynet May 9, 2025
53aa49b
Add initial token validator implementation
strideynet May 9, 2025
153af66
add join attrs for azure devops
strideynet May 9, 2025
06df84e
Switch to Zitadel OIDC
strideynet May 9, 2025
61f07d4
Embed zoidc.TokenClaims into main IDTokenClaims struct
strideynet May 9, 2025
2928832
Add notes on caching
strideynet May 9, 2025
92378ab
Expand concept of token validator
strideynet May 9, 2025
f4cae2d
Start hacking on test suite
strideynet May 9, 2025
7e49082
JoinAttrs method
strideynet May 12, 2025
bce72e8
Fix TestIDTokenValidator_Validate suite
strideynet May 12, 2025
de729a0
Update OIDC doc to match real one
strideynet May 12, 2025
226e2a6
Add TestIDTokenSource
strideynet May 12, 2025
abf8a7e
go mod tidy
strideynet May 12, 2025
038813a
rearrange go.mod
strideynet May 12, 2025
66bc978
fix query params
strideynet May 12, 2025
bc7846d
RepositoryReference -> RepositoryRef
strideynet May 13, 2025
5c8c74b
Switch to azuredevops
strideynet May 13, 2025
d3d314f
Adjust struct init
strideynet May 13, 2025
75be296
Update lib/azuredevops/token_validator.go
strideynet May 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
242 changes: 228 additions & 14 deletions api/gen/proto/go/teleport/workloadidentity/v1/join_attrs.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

36 changes: 36 additions & 0 deletions api/proto/teleport/workloadidentity/v1/join_attrs.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,8 @@ message JoinAttrs {
JoinAttrsKubernetes kubernetes = 12;
// Attributes that are specific to the Oracle (`oracle`) join method.
JoinAttrsOracle oracle = 13;
// Attributes that are specific to the Azure Devops (`azure_devops`) join method.
JoinAttrsAzureDevops azure_devops = 14;
}

// The collection of attributes that result from the join process but are not
Expand Down Expand Up @@ -322,3 +324,37 @@ message JoinAttrsOracle {
// The ID of the instance.
string instance_id = 3;
}

// Attributes that are specific to the Azure Devops (`azure_devops`) join method.
message JoinAttrsAzureDevops {
// Attributes specific to joins that occur with the pipeline ID token.
JoinAttrsAzureDevopsPipeline pipeline = 1;
}

// Attributes that are specific to the Azure DevOps join method when the
// pipeline ID token is used for authentication
message JoinAttrsAzureDevopsPipeline {
// The `sub` claim of the Azure DevOps pipeline ID token that was used to join.
string sub = 1;
// The name of the organization that the pipeline is running within.
string organization_name = 2;
// The name of the project that the pipeline is running within.
string project_name = 3;
// The name of the pipeline that is running.
string pipeline_name = 4;
// The ID of the organization that the pipeline is running within.
string organization_id = 5;
// The ID of the project that the pipeline is running within.
string project_id = 6;
// The ID of the pipeline that is running.
string definition_id = 7;
// The ID of the repository that the pipeline is running within.
string repository_id = 8;
// The version of the repository that the pipeline is running against.
// For Git this will be the commit SHA.
string repository_version = 9;
// The ref of the repository that the pipeline is running against.
string repository_ref = 10;
// The ID of the run that is being executed.
string run_id = 11;
}
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,7 @@ require (
github.com/ghodss/yaml v1.0.0
github.com/go-git/go-git/v5 v5.16.0
github.com/go-jose/go-jose/v3 v3.0.4
github.com/go-jose/go-jose/v4 v4.0.5
Copy link
Copy Markdown
Contributor

@rosstimothy rosstimothy May 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we be thinking about moving all uses of go-jose/v3 to go-jose/v4?

Copy link
Copy Markdown
Contributor Author

@strideynet strideynet May 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I used go-jose v4 in the tests here since that is what was being used indirectly by the Zitadel OIDC package.

As for if we ought to migrate more fully - it looks like v4 mostly included breaking changes to make it harder to footgun common JWT vulnerabilities (https://github.com/go-jose/go-jose/releases/tag/v4.0.0) - most of these should be pretty easy to adopt. I don't think there's any rush though since they seem to be still releasing new patches for v3.

github.com/go-ldap/ldap/v3 v3.4.11
github.com/go-logr/logr v1.4.2
github.com/go-mysql-org/go-mysql v1.9.1 // replaced
Expand Down Expand Up @@ -359,7 +360,6 @@ require (
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
github.com/go-git/go-billy/v5 v5.6.2 // indirect
github.com/go-gorp/gorp/v3 v3.1.0 // indirect
github.com/go-jose/go-jose/v4 v4.0.5 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-ole/go-ole v1.2.6 // indirect
github.com/go-openapi/analysis v0.23.0 // indirect
Expand Down
Loading
Loading