OCPBUGS-7860: azure: session: fix unclear auth error messages #6901
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,6 +2,7 @@ package azure | |
|
|
||
| import ( | ||
| "encoding/json" | ||
| "io/fs" | ||
| "os" | ||
| "path/filepath" | ||
| "strings" | ||
|
|
@@ -13,7 +14,6 @@ import ( | |
| "github.com/Azure/azure-sdk-for-go/sdk/azidentity" | ||
| "github.com/Azure/go-autorest/autorest" | ||
| azureenv "github.com/Azure/go-autorest/autorest/azure" | ||
| "github.com/jongio/azidext/go/azidext" | ||
| azurekiota "github.com/microsoft/kiota-authentication-azure-go" | ||
| "github.com/pkg/errors" | ||
|
|
@@ -43,8 +43,8 @@ type Credentials struct { | |
| ClientID string `json:"clientId,omitempty"` | ||
| ClientSecret string `json:"clientSecret,omitempty"` | ||
| TenantID string `json:"tenantId,omitempty"` | ||
| ClientCertificatePath string `json:"clientCertificate,omitempty"` | ||
| ClientCertificatePassword string `json:"clientCertificatePassword,omitempty"` | ||
| } | ||
|
|
||
| // GetSession returns an azure session by using credentials found in ~/.azure/osServicePrincipal.json | ||
|
|
@@ -90,13 +90,14 @@ func GetSessionWithCredentials(cloudName azure.CloudEnvironment, armEndpoint str | |
| } | ||
|
|
||
| if credentials == nil { | ||
| credentials, err = credentialsFromFileOrUser() | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| } | ||
| var cred azcore.TokenCredential | ||
| if credentials.ClientCertificatePath != "" { | ||
| logrus.Warnf("Using client certs to authenticate. Please be warned cluster does not support certs and only the installer does.") | ||
|
||
| cred, err = newTokenCredentialFromCertificates(credentials, cloudConfig) | ||
| } else { | ||
| cred, err = newTokenCredentialFromCredentials(credentials, cloudConfig) | ||
|
|
@@ -110,37 +111,41 @@ func GetSessionWithCredentials(cloudName azure.CloudEnvironment, armEndpoint str | |
| // credentialsFromFileOrUser returns credentials found | ||
| // in ~/.azure/osServicePrincipal.json and, if no creds are found, | ||
| // asks for them and stores them on disk in a config file | ||
| func credentialsFromFileOrUser() (*Credentials, error) { | ||
| authFilePath := defaultAuthFilePath | ||
| if f := os.Getenv(azureAuthEnv); len(f) > 0 { | ||
| authFilePath = f | ||
| } | ||
|
|
||
| var authFile Credentials | ||
|
|
||
| contents, err := os.ReadFile(authFilePath) | ||
| if err != nil { | ||
| // If the file with creds was not found, ask user for auth info | ||
| if errors.Is(err, fs.ErrNotExist) { | ||
| logrus.Infof("Asking user to provide authentication info") | ||
| credentials, cerr := askForCredentials() | ||
| if cerr != nil { | ||
| return nil, errors.Wrap(cerr, "failed to retrieve credentials from user") | ||
| } | ||
| logrus.Infof("Saving user credentials to %q", authFilePath) | ||
| if cerr = saveCredentials(*credentials, authFilePath); cerr != nil { | ||
| return nil, errors.Wrap(cerr, "failed to save credentials") | ||
| } | ||
| authFile = *credentials | ||
| } else { | ||
| // File was found but we failed to read it, just error out and let the user handle it | ||
| return nil, err | ||
| } | ||
| } else { | ||
| err = json.Unmarshal(contents, &authFile) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| } | ||
|
|
||
| if err := checkCredentials(authFile); err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| if _, has := onceLoggers[authFilePath]; !has { | ||
|
|
@@ -150,40 +155,23 @@ func credentialsFromFileOrUser(cloudEnv *azureenv.Environment) (*Credentials, er | |
| logrus.Infof("Credentials loaded from file %q", authFilePath) | ||
| }) | ||
|
|
||
| return &authFile, nil | ||
| } | ||
|
|
||
| func checkCredentials(creds Credentials) error { | ||
| if creds.SubscriptionID == "" { | ||
| return errors.New("could not retrieve subscriptionId from auth file") | ||
| } | ||
| if creds.ClientID == "" { | ||
| return errors.New("could not retrieve clientId from auth file") | ||
| } | ||
| if creds.TenantID == "" { | ||
| return errors.New("could not retrieve tenantId from auth file") | ||
| } | ||
| if creds.ClientSecret == "" && creds.ClientCertificatePath == "" { | ||
| return errors.New("could not retrieve either client secret or client certs from auth file") | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func askForCredentials() (*Credentials, error) { | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.