Skip to content

Commit b2f0b99

Browse files
vandanakvsvandanakvs
authored
Merge pull request #24 from microsoft/users/prnikumb/unifiedfic
Security Code Bug: Change DefaultAzureCredential to ManagedIdentity
2 parents 50c17f8 + 1ee0b63 commit b2f0b99

17 files changed

Lines changed: 106 additions & 36 deletions

‎src/service/Microsoft.UnifiedRedisPlatform.Service/Core/Application/Microsoft.UnifiedPlatform.Service.Application.csproj‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,9 @@
55
</PropertyGroup>
66

77
<ItemGroup>
8+
<PackageReference Include="Azure.Identity" Version="1.14.0" />
89
<PackageReference Include="CQRS.Mediatr.Lite" Version="1.0.0" />
10+
<PackageReference Include="Microsoft.Identity.Client" Version="4.72.1" />
911
<PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
1012
</ItemGroup>
1113

‎src/service/Microsoft.UnifiedRedisPlatform.Service/Infrastructure/Authentication/AadAuthenticator.cs‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,13 @@ public class AadAuthenticator : IAuthenticator
1919
private readonly string _clientId;
2020
private readonly ConcurrentDictionary<string, IConfidentialClientApplication> confidentialApps = new ConcurrentDictionary<string, IConfidentialClientApplication>();
2121
private readonly string _certificateThumprint;
22-
public AadAuthenticator(string authority, string clientId, string certificateThumbprint)
22+
private readonly string _userAssignedClientId;
23+
public AadAuthenticator(string authority, string clientId, string certificateThumbprint,string userAssignedClientId)
2324
{
2425
_authority = authority;
2526
_clientId = clientId;
2627
_certificateThumprint = certificateThumbprint;
28+
_userAssignedClientId= userAssignedClientId;
2729
}
2830

2931
public async Task<string> GenerateToken(string resourceId, Dictionary<string, string> additionalClaims)
@@ -51,11 +53,12 @@ private IConfidentialClientApplication GetOrCreateConfidentialApp(string authori
5153
confidentialApps.TryAdd(confidentialAppCacheKey, confidentialClientApplication);
5254
return confidentialClientApplication;
5355
#else
54-
56+
var managedIdentityId = ManagedIdentityId.FromUserAssignedClientId(_userAssignedClientId);
57+
var credential = new ManagedIdentityCredential(managedIdentityId);
5558
IConfidentialClientApplication clientApplicationWithMI = ConfidentialClientApplicationBuilder.Create(clientId).WithAuthority(new Uri(authority))
5659
.WithClientAssertion((AssertionRequestOptions options) =>
5760
{
58-
var accessToken = new DefaultAzureCredential().GetToken(new TokenRequestContext(new string[] { $"api://AzureADTokenExchange/.default" }), CancellationToken.None);
61+
var accessToken = credential.GetToken(new TokenRequestContext(new string[] { $"api://AzureADTokenExchange/.default" }), CancellationToken.None);
5962
return Task.FromResult(accessToken.Token);
6063
}).Build();
6164
confidentialApps.TryAdd(confidentialAppCacheKey, clientApplicationWithMI);

‎src/service/Microsoft.UnifiedRedisPlatform.Service/Infrastructure/Authentication/Microsoft.UnifiedPlatform.Service.Authentication.csproj‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@
66

77
<ItemGroup>
88
<PackageReference Include="Microsoft.AspNetCore.Http" Version="2.2.2" />
9-
<PackageReference Include="Azure.Identity" Version="1.11.3" />
10-
<PackageReference Include="Microsoft.Identity.Client" Version="4.60.3" />
9+
<PackageReference Include="Azure.Identity" Version="1.14.0" />
10+
<PackageReference Include="Microsoft.Identity.Client" Version="4.72.1" />
1111
<PackageReference Include="Microsoft.Identity.Web" Version="2.18.1" />
1212
<PackageReference Include="Microsoft.IdentityModel.Tokens" Version="6.35.0" />
1313
<PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="6.35.0" />

‎src/service/Microsoft.UnifiedRedisPlatform.Service/Infrastructure/Configuration/Microsoft.UnifiedPlatform.Service.Configuration.csproj‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,9 @@
55
</PropertyGroup>
66

77
<ItemGroup>
8+
<PackageReference Include="Azure.Identity" Version="1.14.0" />
89
<PackageReference Include="Microsoft.Extensions.Configuration" Version="3.1.8" />
10+
<PackageReference Include="Microsoft.Identity.Client" Version="4.72.1" />
911
<PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
1012
</ItemGroup>
1113

‎src/service/Microsoft.UnifiedRedisPlatform.Service/Infrastructure/Redis/Microsoft.UnifiedPlatform.Service.Redis.csproj‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66

77
<ItemGroup>
88
<PackageReference Include="AppInsights.EnterpriseTelemetry" Version="1.0.2" />
9+
<PackageReference Include="Azure.Identity" Version="1.14.0" />
10+
<PackageReference Include="Microsoft.Identity.Client" Version="4.72.1" />
911
<PackageReference Include="StackExchange.Redis" Version="2.0.601" />
1012

1113
</ItemGroup>

‎src/service/Microsoft.UnifiedRedisPlatform.Service/Infrastructure/Secrets/KeyVaultProvider.cs‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
using Azure;
2+
using Azure.Core;
23
using Azure.Identity;
34
using Azure.Security.KeyVault.Secrets;
45
using Microsoft.UnifiedPlatform.Service.Common.AppExceptions;
@@ -8,11 +9,12 @@
89
using System;
910
using System.Net;
1011
using System.Threading.Tasks;
12+
using ManagedIdentityId = Azure.Identity.ManagedIdentityId;
1113

1214
/// <summary>
1315
/// Provides application secrets from Azure Key Vault
1416
/// </summary>
15-
public class KeyVaultProvider: ISecretsProvider
17+
public class KeyVaultProvider : ISecretsProvider
1618
{
1719
public const string KEY_VAULT_URI_FORMAT = "https://{0}.vault.azure.net";
1820

@@ -24,11 +26,19 @@ public class KeyVaultProvider: ISecretsProvider
2426
/// </summary>
2527
/// <param name="configuration" cref="KeyvaultConfiguration">Configuration for connecting to Azure Key Vault</param>
2628
/// <param name="cacheService" cref="ICacheService">Service for caching data</param>
27-
public KeyVaultProvider(string keyVaultName, ICacheService cacheService)
29+
public KeyVaultProvider(string keyVaultName, string userAssignedClientId, ICacheService cacheService)
2830
{
2931
var keyVaultUri = string.Format(KEY_VAULT_URI_FORMAT, keyVaultName);
3032
_cacheService = cacheService;
31-
var credential = new DefaultAzureCredential();
33+
34+
TokenCredential credential;
35+
#if DEBUG
36+
credential = new VisualStudioCredential();
37+
#else
38+
var managedIdentityId = ManagedIdentityId.FromUserAssignedClientId(userAssignedClientId);
39+
credential = new ManagedIdentityCredential(managedIdentityId);
40+
#endif
41+
3242
var secretClient = new SecretClient(new Uri(keyVaultUri), credential);
3343

3444
_keyVaultClientWrapper = new KeyVaultClientWrapper(keyVaultUri, secretClient);

‎src/service/Microsoft.UnifiedRedisPlatform.Service/Infrastructure/Secrets/Microsoft.UnifiedPlatform.Service.Secrets.csproj‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,10 @@
55
</PropertyGroup>
66

77
<ItemGroup>
8-
<PackageReference Include="Azure.Identity" Version="1.11.3" />
8+
<PackageReference Include="Azure.Identity" Version="1.14.0" />
99
<PackageReference Include="Azure.Security.KeyVault.Secrets" Version="4.6.0" />
1010
<PackageReference Include="Microsoft.Azure.Services.AppAuthentication" Version="1.6.0" />
11+
<PackageReference Include="Microsoft.Identity.Client" Version="4.72.1" />
1112
</ItemGroup>
1213

1314
<ItemGroup>

‎src/service/Microsoft.UnifiedRedisPlatform.Service/Infrastructure/Storage/Microsoft.UnifiedPlatform.Storage.csproj‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,10 @@
66

77
<ItemGroup>
88
<PackageReference Include="Azure.Data.Tables" Version="12.8.3" />
9+
<PackageReference Include="Azure.Identity" Version="1.14.0" />
910
<PackageReference Include="Azure.Storage.Blobs" Version="12.20.0" />
1011
<PackageReference Include="Microsoft.Azure.WebJobs.Extensions.Storage" Version="5.3.0" />
12+
<PackageReference Include="Microsoft.Identity.Client" Version="4.72.1" />
1113
</ItemGroup>
1214

1315
<ItemGroup>

‎src/service/Microsoft.UnifiedRedisPlatform.Service/Library/AzureRegion/AzureRegionUtility.cs‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
using GeoCoordinatePortable;
44
using Microsoft.AzureRegion.Models;
55
using Microsoft.Identity.Client;
6-
using Microsoft.Identity.Web;
76
using Newtonsoft.Json;
87
using System;
98
using System.Collections.Concurrent;
@@ -31,6 +30,7 @@ public class AzureRegionUtility : IAzureRegionUtility
3130
private static DateTime _cachedUntil = DateTime.UtcNow;
3231
private readonly ConcurrentDictionary<string, IConfidentialClientApplication> confidentialApps = new ConcurrentDictionary<string, IConfidentialClientApplication>();
3332
private readonly string CertificateThumbprint;
33+
private readonly string UserAssignedClientId;
3434

3535
public AzureRegionUtility(string certificateThumbprint)
3636
: this(azureSubscriptionId: "05a315f7-744f-4692-b9dd-1aed7c6cee64",
@@ -39,16 +39,17 @@ public AzureRegionUtility(string certificateThumbprint)
3939
aadAuthority: "https://login.microsoftonline.com/microsoft.onmicrosoft.com",
4040
aadClientId: "1601a33e-356e-4570-8325-eefe6116eadb",
4141
cacheDurationInMins: 43200,
42-
certificateThumbprint: certificateThumbprint
42+
certificateThumbprint: certificateThumbprint,
43+
userAssignedClientId: "ddcbb4aa-01a9-46aa-8c11-03e1b789d9cd"
4344
)
4445
{ }
4546

46-
public AzureRegionUtility(string azureSubscriptionId, string azureManagementEndpoint, string azureAadResourceId, string aadAuthority, string aadClientId, int cacheDurationInMins, string certificateThumbprint)
47-
: this(azureSubscriptionId, azureManagementEndpoint, azureAadResourceId, aadAuthority, aadClientId, cacheDurationInMins, certificateThumbprint, new HttpClientFactory())
47+
public AzureRegionUtility(string azureSubscriptionId, string azureManagementEndpoint, string azureAadResourceId, string aadAuthority, string aadClientId, int cacheDurationInMins, string certificateThumbprint, string userAssignedClientId)
48+
: this(azureSubscriptionId, azureManagementEndpoint, azureAadResourceId, aadAuthority, aadClientId, cacheDurationInMins, certificateThumbprint, userAssignedClientId, new HttpClientFactory())
4849
{
4950
}
5051

51-
internal AzureRegionUtility(string azureSubscriptionId, string azureManagementEndpoint, string azureAadResourceId, string aadAuthority, string aadClientId, int cacheDurationInMins, string certificateThumbprint, IHttpClientFactory clientFactory)
52+
internal AzureRegionUtility(string azureSubscriptionId, string azureManagementEndpoint, string azureAadResourceId, string aadAuthority, string aadClientId, int cacheDurationInMins, string certificateThumbprint, string userAssignedClientId, IHttpClientFactory clientFactory)
5253
{
5354
AzureSubscriptionId = azureSubscriptionId;
5455
AzureManagementEndpoint = azureManagementEndpoint;
@@ -57,6 +58,7 @@ internal AzureRegionUtility(string azureSubscriptionId, string azureManagementEn
5758
AadClientId = aadClientId;
5859
CacheDurationInMins = cacheDurationInMins;
5960
CertificateThumbprint = certificateThumbprint;
61+
UserAssignedClientId = userAssignedClientId;
6062
_httpClientFactory = clientFactory;
6163
}
6264

@@ -138,7 +140,7 @@ private async Task<string> GenerateAuthToken()
138140
{
139141
try
140142
{
141-
IConfidentialClientApplication app = GetOrCreateConfidentialApp(AadAuthority, AadClientId);
143+
IConfidentialClientApplication app = GetOrCreateConfidentialApp(AadAuthority, AadClientId, UserAssignedClientId);
142144

143145
var authResult = await app.AcquireTokenForClient(new[] { $"{AzureManagementAadResourceId}/.default" }).ExecuteAsync();
144146
return authResult.AccessToken;
@@ -149,7 +151,7 @@ private async Task<string> GenerateAuthToken()
149151
}
150152
}
151153

152-
private IConfidentialClientApplication GetOrCreateConfidentialApp(string authority, string clientId)
154+
private IConfidentialClientApplication GetOrCreateConfidentialApp(string authority, string clientId, string userAssignedClientId)
153155
{
154156
try
155157
{
@@ -169,10 +171,13 @@ private IConfidentialClientApplication GetOrCreateConfidentialApp(string authori
169171
return confidentialClientApplication;
170172
#else
171173

174+
var managedIdentityId = ManagedIdentityId.FromUserAssignedClientId(userAssignedClientId);
175+
var credential = new ManagedIdentityCredential(managedIdentityId);
176+
172177
IConfidentialClientApplication clientApplicationWithMI = ConfidentialClientApplicationBuilder.Create(clientId).WithAuthority(new Uri(authority))
173178
.WithClientAssertion((AssertionRequestOptions options) =>
174179
{
175-
var accessToken = new DefaultAzureCredential().GetToken(new TokenRequestContext(new string[] { $"api://AzureADTokenExchange/.default" }), CancellationToken.None);
180+
var accessToken = credential.GetToken(new TokenRequestContext(new string[] { $"api://AzureADTokenExchange/.default" }), CancellationToken.None);
176181
return Task.FromResult(accessToken.Token);
177182
}).Build();
178183
confidentialApps.TryAdd(confidentialAppCacheKey, clientApplicationWithMI);

‎src/service/Microsoft.UnifiedRedisPlatform.Service/Library/AzureRegion/Microsoft.AzureRegion.csproj‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,13 @@
55
</PropertyGroup>
66

77
<ItemGroup>
8+
<PackageReference Include="Azure.Identity" Version="1.14.0" />
89
<PackageReference Include="GeoCoordinate.NetCore" Version="1.0.0.1" />
9-
<PackageReference Include="Microsoft.Identity.Client" Version="4.60.3" />
10+
<PackageReference Include="Microsoft.Identity.Client" Version="4.72.1" />
1011
<PackageReference Include="Microsoft.Identity.Web" Version="2.18.1" />
12+
<PackageReference Include="Microsoft.IdentityModel.Tokens" Version="8.9.0" />
1113
<PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
14+
<PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.9.0" />
1215
</ItemGroup>
1316

1417
</Project>

0 commit comments

Comments
 (0)