@microsoft/vscode-azext-azureauth 2.4.0 → 2.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AzureFederatedCredentialsGuide.md +174 -0
- package/README.md +41 -0
- package/out/src/AzureAuthentication.d.ts +8 -1
- package/out/src/AzureDevOpsSubscriptionProvider.d.ts +18 -2
- package/out/src/AzureDevOpsSubscriptionProvider.js +28 -28
- package/out/src/VSCodeAzureSubscriptionProvider.js +4 -1
- package/out/src/signInToTenants.d.ts +6 -0
- package/out/src/signInToTenants.js +57 -0
- package/package.json +1 -1
|
@@ -0,0 +1,174 @@
|
|
|
1
|
+
# Setting up workflow identity federation with Azure DevOps
|
|
2
|
+
|
|
3
|
+
This guide describes how to set up your Azure DevOps (ADO) and Azure environment to leverage [workflow identity federation](https://learn.microsoft.com/entra/workload-id/workload-identity-federation), enabling you to use
|
|
4
|
+
`AzureDevOpsSubscriptionProvider` provided in this section. See the [README](README.md#azure-devops-subscription-provider) for more details.
|
|
5
|
+
|
|
6
|
+
## 1. Create a new service principal
|
|
7
|
+
|
|
8
|
+
Create a new service principal on which you will assign the necessary permissions. In this example, we use an app registration:
|
|
9
|
+
|
|
10
|
+
1. Navigate to the [App Registrations](https://ms.portal.azure.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) page on the Azure portal
|
|
11
|
+
2. Click on `New Registration`
|
|
12
|
+
|
|
13
|
+
|
|
14
|
+
|
|
15
|
+
3. Assign any name
|
|
16
|
+
4. Make sure to select the first option for the account type (`Accounts in this organization directory only (Microsoft only - Single tenant)`)
|
|
17
|
+
5. Leave the Redirect URI and Service Tree ID fields empty
|
|
18
|
+
6. Click on `Register`
|
|
19
|
+
|
|
20
|
+
|
|
21
|
+
|
|
22
|
+
## 2. Create a new Azure DevOps (ADO) Service Connection:
|
|
23
|
+
|
|
24
|
+
Create a new ADO service connection under your organization's project. In this example, we create it under the DevDiv project:
|
|
25
|
+
|
|
26
|
+
1. Navigate to the [organization's (DevDiv) ADO page](https://devdiv.visualstudio.com/DevDiv)
|
|
27
|
+
2. Navigate to the settings page by clicking on the gear icon on the bottom left
|
|
28
|
+
3. Select the ["service connections"](https://devdiv.visualstudio.com/DevDiv/_settings/adminservices) blade from the panel on the left
|
|
29
|
+
|
|
30
|
+
|
|
31
|
+
|
|
32
|
+
4. Create a new service connection by clicking on the `New service connection` button
|
|
33
|
+
|
|
34
|
+
|
|
35
|
+
|
|
36
|
+
5. Select `Azure Resource Manager` as the type
|
|
37
|
+
6. Select `Workload Identity federation (manual)` for the authentication type
|
|
38
|
+
7. Provide a new name for your new service connection
|
|
39
|
+
8. Click on `Next`
|
|
40
|
+
9. This will create a new draft service connection, with the `issuer` and `subject identifier` fields already filled in.
|
|
41
|
+
10. Leave this window open while you finish the next step, which will require those `issuer` and `subject identifier` fields, then you will return to this window to finish creating the service principal
|
|
42
|
+
|
|
43
|
+
|
|
44
|
+
|
|
45
|
+
## 3. Create a federated credential:
|
|
46
|
+
|
|
47
|
+
Create a new "federated credential" on your service principal to connect it to your new service connection:
|
|
48
|
+
|
|
49
|
+
1. Navigate back to the Azure Portal page for your service connection (app registration) from step 1
|
|
50
|
+
2. Navigate to the `Certificates & secrets` blade
|
|
51
|
+
3. Navigate to the `Federated credentials` tab
|
|
52
|
+
4. Click on the `Add credential` button
|
|
53
|
+
|
|
54
|
+
|
|
55
|
+
|
|
56
|
+
5. For the scenario, select `Other issuer`
|
|
57
|
+
6. For the `issuer` and `subject identifier` fields, fill in with the details of your draft service connection from the previous step
|
|
58
|
+
7. Select a new name for your new federated credential
|
|
59
|
+
|
|
60
|
+
|
|
61
|
+
|
|
62
|
+
8. Click on `Add`
|
|
63
|
+
|
|
64
|
+
## 4. (Temporary but required) Grant your service principal reader role on the desired subscription:
|
|
65
|
+
|
|
66
|
+
This step is not required for running your tests, but _is_ required to finish creating the service connection. This should be revoked after successful creation of the service connection and only necessary roles applied to the service principal.
|
|
67
|
+
|
|
68
|
+
1. On the Azure Portal, navigate to the page for the subscription you want the service principal to have access to.
|
|
69
|
+
2. Navigate to the `Access control (IAM)` blade
|
|
70
|
+
|
|
71
|
+
|
|
72
|
+
|
|
73
|
+
3. Navigate to the `Roles` tab
|
|
74
|
+
4. Click on the `+ Add` button, and choose `Add role assignment`
|
|
75
|
+
|
|
76
|
+
|
|
77
|
+
|
|
78
|
+
5. Choose `Reader` and click `Next`
|
|
79
|
+
6. Choose `User, group, or service principal`, then click on `+ Select members`
|
|
80
|
+
|
|
81
|
+
|
|
82
|
+
|
|
83
|
+
7. Select your service principal from step 1
|
|
84
|
+
8. Click on `Review and assign`
|
|
85
|
+
|
|
86
|
+
## 5. Finish creating your service connection:
|
|
87
|
+
|
|
88
|
+
Finish creating the draft service connection you created in step 2.
|
|
89
|
+
|
|
90
|
+
1. Navigate back to your draft service connection from step 2
|
|
91
|
+
2. For Environment, select `Azure Cloud`
|
|
92
|
+
3. For Scope Level, choose `Subscription`
|
|
93
|
+
4. Under `Subscription Id`, and `Subscription Name`, write the subscription ID and name (must provide both) for the desired subscription
|
|
94
|
+
5. For `Service Principal Id`, provide the `Application (client) ID` of your app registration from step 1 (can be found in the `Overview` blade)
|
|
95
|
+
6. For the `Tenant ID`, provide the `Directory (tenant) ID` of your app registration from step 1 (can be found in `Overview` blade)
|
|
96
|
+
7. Click on `Verify and save`
|
|
97
|
+
|
|
98
|
+
## 6. Revoke unnecessary read access and assign only necessary roles
|
|
99
|
+
|
|
100
|
+
Revoke the `Reader` role on the subscription for the service connection after it is created. This is no longer necessary.
|
|
101
|
+
|
|
102
|
+
1. Navigate to `Access control (IAM)` blade.
|
|
103
|
+
2. Under the `Role assignments` tab, find the role assignment corresponding to the App registered on step 1
|
|
104
|
+
3. Click on `Remove` then `Yes`
|
|
105
|
+
4. You can then assign the required roles to specific resources only if required, instead of assigning `Reader` role to the entire subscription.
|
|
106
|
+
|
|
107
|
+
## 7. Create a dummy Key Vault
|
|
108
|
+
|
|
109
|
+
A dummy Key vault step is required to propagate the necessary environment variables in the context of the pipeline.
|
|
110
|
+
|
|
111
|
+
1. Create a new Key Vault resource in the subscription you want to test on
|
|
112
|
+
2. Give it a new name as appropriate. You can keep the default settings
|
|
113
|
+
|
|
114
|
+
|
|
115
|
+
|
|
116
|
+
## 8. Assign your service principal "key vault reader" role on the dummy Key Vault:
|
|
117
|
+
|
|
118
|
+
1. Navigate to `Access control (IAM)` blade on your newly created dummy key vault
|
|
119
|
+
|
|
120
|
+
|
|
121
|
+
|
|
122
|
+
2. Navigate to the `Roles` tab
|
|
123
|
+
3. Click on the `+ Add` button, and choose `Add role assignment`
|
|
124
|
+
|
|
125
|
+
|
|
126
|
+
|
|
127
|
+
4. Choose `Key Vault Reader` (**NOT** `Reader`) and click `Next`
|
|
128
|
+
5. Choose `User, group, or service principal`, then click on `+ Select members`
|
|
129
|
+
|
|
130
|
+
|
|
131
|
+
|
|
132
|
+
6. Select your app registration from step 1
|
|
133
|
+
7. Click on `Review and assign`
|
|
134
|
+
|
|
135
|
+
## 9. Add the dummy Key Vault step in the pipeline
|
|
136
|
+
|
|
137
|
+
To ensure that the appropriate env variables are propagated in the context of running the pipeline, a dummy Key Vault step is required in that pipeline:
|
|
138
|
+
|
|
139
|
+
1. In the desired pipeline's `.yml` file, add a step as below. The `azureSubscription` field should correspond to the name of your service connection from step 2, while the `keyVaultName` field should correspond to the dummy key vault created in step 7:
|
|
140
|
+
|
|
141
|
+
```yml
|
|
142
|
+
# This gives the TestServiceConnection service connection access to this pipeline.
|
|
143
|
+
- task: AzureKeyVault@1
|
|
144
|
+
displayName: 'Authorize TestServiceConnection service connection'
|
|
145
|
+
inputs:
|
|
146
|
+
azureSubscription: 'TestServiceConnection'
|
|
147
|
+
KeyVaultName: 'TestDummyKeyVault'
|
|
148
|
+
```
|
|
149
|
+
|
|
150
|
+
2. In the step which runs your code (e.g., the npm test step), make sure that the `$(System.AccessToken)` variable is manually propagated as a `SYSTEM_ACCESSTOKEN` environment variable. All other required environment variables should be propagated automatically:
|
|
151
|
+
|
|
152
|
+
```yml
|
|
153
|
+
- task: Npm@1
|
|
154
|
+
displayName: "Test"
|
|
155
|
+
inputs:
|
|
156
|
+
command: custom
|
|
157
|
+
customCommand: test
|
|
158
|
+
env:
|
|
159
|
+
SYSTEM_ACCESSTOKEN: $(System.AccessToken)
|
|
160
|
+
```
|
|
161
|
+
|
|
162
|
+
## 10. Pass the appropriate values to identify your service connection:
|
|
163
|
+
|
|
164
|
+
The constructor for `AzureDevOpsSubscriptionProvider` expects three arguments in an initializer object in order to identify your service connection you setup in step 5.
|
|
165
|
+
|
|
166
|
+
These are:
|
|
167
|
+
|
|
168
|
+
- `serviceConnectionId`: The resource ID of the service connection created in step 2, which can be found on the `resourceId` field of the URL at the address bar, when viewing the service connection in the Azure DevOps portal
|
|
169
|
+
- `domain`: The `Tenant ID` field of the service connection properties, which can be accessed by clicking "Edit" on the service connection page
|
|
170
|
+
- `clientId`: The `Service Principal Id` field of the service connection properties, which can be accessed by clicking "Edit" on the service connection page
|
|
171
|
+
|
|
172
|
+
|
|
173
|
+
|
|
174
|
+
Make sure you pass an object containing these variables for the `new AzureDevOpsServiceProvider()` constructor. These values are _not_ secrets, so they can be set as environment variables, assigned as pipeline variables in ADO, accessed and assigned using an Azure Key Vault step, or even manually hardcoded in code (not recommended).
|
package/README.md
CHANGED
|
@@ -100,6 +100,47 @@ export declare function getConfiguredAzureEnv(): azureEnv.Environment & {
|
|
|
100
100
|
export declare function setConfiguredAzureEnv(cloud: string | azureEnv.EnvironmentParameters, target?: vscode.ConfigurationTarget): Promise<void>;
|
|
101
101
|
```
|
|
102
102
|
|
|
103
|
+
## Azure DevOps Subscription Provider
|
|
104
|
+
|
|
105
|
+
The auth package also exports `AzureDevOpsSubscriptionProvider`, a class which implements the `AzureSubscriptionProvider` interface, which authenticates via
|
|
106
|
+
a federated Azure DevOps service connection, using [workflow identity federation](https://learn.microsoft.com/entra/workload-id/workload-identity-federation).
|
|
107
|
+
|
|
108
|
+
This provider only works when running in the context of an Azure DevOps pipeline. It can be used to run end-to-end tests that require authentication to Azure,
|
|
109
|
+
without having to manage any secrets, passwords or connection strings.
|
|
110
|
+
|
|
111
|
+
The constructor expects an initializer object with three values set to identify your ADO service connection to be used for authentication.
|
|
112
|
+
These are:
|
|
113
|
+
|
|
114
|
+
- `serviceConnectionId`: The resource ID of your service connection, which can be found on the `resourceId` field of the URL at the address bar, when viewing the service connection in the Azure DevOps portal
|
|
115
|
+
- `domain`: The `Tenant ID` field of the service connection properties, which can be accessed by clicking "Edit" on the service connection page
|
|
116
|
+
- `clientId`: The `Service Principal Id` field of the service connection properties, which can be accessed by clicking "Edit" on the service connection page
|
|
117
|
+
|
|
118
|
+
Here is an example code of how you might use `AzureDevOpsSubscriptionProvider`:
|
|
119
|
+
|
|
120
|
+
```typescript
|
|
121
|
+
import { AzureDevOpsSubscriptionProviderInitializer, AzureDevOpsSubscriptionProvider } from "@microsoft/vscode-azext-azureauth";
|
|
122
|
+
|
|
123
|
+
const initializer: AzureDevOpsSubscriptionProviderInitializer = {
|
|
124
|
+
serviceConnectionId: "<REPLACE_WITH_SERVICE_CONNECTION_ID>",
|
|
125
|
+
domain: "<REPLACE_WITH_DOMAIN>",
|
|
126
|
+
clientId: "<REPLACE_WITH_CLIENT_ID>",
|
|
127
|
+
}
|
|
128
|
+
|
|
129
|
+
const subscriptionProvider = new AzureDevOpsSubscriptionProvider(initializer);
|
|
130
|
+
|
|
131
|
+
const signedIn = await subscriptionProvider.signIn();
|
|
132
|
+
if (!signedIn) {
|
|
133
|
+
throw new Error("Couldn't sign in");
|
|
134
|
+
}
|
|
135
|
+
|
|
136
|
+
const subscriptions = await subscriptionProvider.getSubscriptions();
|
|
137
|
+
|
|
138
|
+
// logic on the subscriptions object
|
|
139
|
+
```
|
|
140
|
+
|
|
141
|
+
For more detailed steps on how to setup your Azure environment to use workflow identity federation and use this `AzureDevOpsSubscriptionProvider` object effectively,
|
|
142
|
+
as well as the values needed to pass to `new AzureDevOpsSubscriptionProvider()`, please navigate to the workflow identity federation [guide](AzureFederatedCredentialsGuide.md).
|
|
143
|
+
|
|
103
144
|
## Logs
|
|
104
145
|
|
|
105
146
|
View the Microsoft Authentication extension logs by running the `Developer: Show Logs...` command from the VS Code command palette.
|
|
@@ -3,6 +3,13 @@ import type * as vscode from 'vscode';
|
|
|
3
3
|
* Represents a means of obtaining authentication data for an Azure subscription.
|
|
4
4
|
*/
|
|
5
5
|
export interface AzureAuthentication {
|
|
6
|
+
/**
|
|
7
|
+
* Gets a VS Code authentication session for an Azure subscription.
|
|
8
|
+
* Always uses the default scope, `https://management.azure.com/.default/.default.`
|
|
9
|
+
*
|
|
10
|
+
* @returns A VS Code authentication session or undefined, if none could be obtained.
|
|
11
|
+
*/
|
|
12
|
+
getSession(): vscode.ProviderResult<vscode.AuthenticationSession>;
|
|
6
13
|
/**
|
|
7
14
|
* Gets a VS Code authentication session for an Azure subscription.
|
|
8
15
|
*
|
|
@@ -10,5 +17,5 @@ export interface AzureAuthentication {
|
|
|
10
17
|
*
|
|
11
18
|
* @returns A VS Code authentication session or undefined, if none could be obtained.
|
|
12
19
|
*/
|
|
13
|
-
|
|
20
|
+
getSessionWithScopes(scopes: string[]): vscode.ProviderResult<vscode.AuthenticationSession>;
|
|
14
21
|
}
|
|
@@ -2,7 +2,23 @@ import type { TenantIdDescription } from '@azure/arm-resources-subscriptions';
|
|
|
2
2
|
import { Event } from 'vscode';
|
|
3
3
|
import { AzureSubscription } from './AzureSubscription';
|
|
4
4
|
import { AzureSubscriptionProvider } from './AzureSubscriptionProvider';
|
|
5
|
-
export
|
|
5
|
+
export interface AzureDevOpsSubscriptionProviderInitializer {
|
|
6
|
+
/**
|
|
7
|
+
* The resource ID of the Azure DevOps federated service connection,
|
|
8
|
+
* which can be found on the `resourceId` field of the URL at the address bar
|
|
9
|
+
* when viewing the service connection in the Azure DevOps portal
|
|
10
|
+
*/
|
|
11
|
+
serviceConnectionId: string;
|
|
12
|
+
/**
|
|
13
|
+
* The `Tenant ID` field of the service connection properties
|
|
14
|
+
*/
|
|
15
|
+
domain: string;
|
|
16
|
+
/**
|
|
17
|
+
* The `Service Principal Id` field of the service connection properties
|
|
18
|
+
*/
|
|
19
|
+
clientId: string;
|
|
20
|
+
}
|
|
21
|
+
export declare function createAzureDevOpsSubscriptionProviderFactory(initializer: AzureDevOpsSubscriptionProviderInitializer): () => Promise<AzureDevOpsSubscriptionProvider>;
|
|
6
22
|
/**
|
|
7
23
|
* AzureSubscriptionProvider implemented to authenticate via federated DevOps service connection, using workflow identity federation
|
|
8
24
|
* To learn how to configure your DevOps environment to use this provider, refer to the README.md
|
|
@@ -25,7 +41,7 @@ export declare class AzureDevOpsSubscriptionProvider implements AzureSubscriptio
|
|
|
25
41
|
* The `Service Principal Id` field of the service connection properties
|
|
26
42
|
*/
|
|
27
43
|
private _CLIENT_ID;
|
|
28
|
-
constructor();
|
|
44
|
+
constructor({ serviceConnectionId, domain, clientId }: AzureDevOpsSubscriptionProviderInitializer);
|
|
29
45
|
getSubscriptions(_filter: boolean): Promise<AzureSubscription[]>;
|
|
30
46
|
isSignedIn(): Promise<boolean>;
|
|
31
47
|
signIn(): Promise<boolean>;
|
|
@@ -24,9 +24,9 @@ exports.AzureDevOpsSubscriptionProvider = exports.createAzureDevOpsSubscriptionP
|
|
|
24
24
|
const vscode_1 = require("vscode");
|
|
25
25
|
const configuredAzureEnv_1 = require("./utils/configuredAzureEnv");
|
|
26
26
|
let azureDevOpsSubscriptionProvider;
|
|
27
|
-
function createAzureDevOpsSubscriptionProviderFactory() {
|
|
27
|
+
function createAzureDevOpsSubscriptionProviderFactory(initializer) {
|
|
28
28
|
return () => __awaiter(this, void 0, void 0, function* () {
|
|
29
|
-
azureDevOpsSubscriptionProvider !== null && azureDevOpsSubscriptionProvider !== void 0 ? azureDevOpsSubscriptionProvider : (azureDevOpsSubscriptionProvider = new AzureDevOpsSubscriptionProvider());
|
|
29
|
+
azureDevOpsSubscriptionProvider !== null && azureDevOpsSubscriptionProvider !== void 0 ? azureDevOpsSubscriptionProvider : (azureDevOpsSubscriptionProvider = new AzureDevOpsSubscriptionProvider(initializer));
|
|
30
30
|
return azureDevOpsSubscriptionProvider;
|
|
31
31
|
});
|
|
32
32
|
}
|
|
@@ -38,22 +38,20 @@ exports.createAzureDevOpsSubscriptionProviderFactory = createAzureDevOpsSubscrip
|
|
|
38
38
|
* Reference: https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation
|
|
39
39
|
*/
|
|
40
40
|
class AzureDevOpsSubscriptionProvider {
|
|
41
|
-
constructor() {
|
|
41
|
+
constructor({ serviceConnectionId, domain, clientId }) {
|
|
42
42
|
this.onDidSignIn = () => { return new vscode_1.Disposable(() => { }); };
|
|
43
43
|
this.onDidSignOut = () => { return new vscode_1.Disposable(() => { }); };
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
process.env.AzCodeServiceConnectionClientID: ${CLIENT_ID ? "✅" : "❌"}\n
|
|
52
|
-
`);
|
|
44
|
+
if (!serviceConnectionId || !domain || !clientId) {
|
|
45
|
+
throw new Error(`Missing initializer values to identify Azure DevOps federated service connection\n
|
|
46
|
+
Values provided:\n
|
|
47
|
+
serviceConnectionId: ${serviceConnectionId ? "✅" : "❌"}\n
|
|
48
|
+
domain: ${domain ? "✅" : "❌"}\n
|
|
49
|
+
clientId: ${clientId ? "✅" : "❌"}\n
|
|
50
|
+
`);
|
|
53
51
|
}
|
|
54
|
-
this._SERVICE_CONNECTION_ID =
|
|
55
|
-
this._DOMAIN =
|
|
56
|
-
this._CLIENT_ID =
|
|
52
|
+
this._SERVICE_CONNECTION_ID = serviceConnectionId;
|
|
53
|
+
this._DOMAIN = domain;
|
|
54
|
+
this._CLIENT_ID = clientId;
|
|
57
55
|
}
|
|
58
56
|
getSubscriptions(_filter) {
|
|
59
57
|
return __awaiter(this, void 0, void 0, function* () {
|
|
@@ -153,23 +151,25 @@ class AzureDevOpsSubscriptionProvider {
|
|
|
153
151
|
throw new Error('Not signed in');
|
|
154
152
|
}
|
|
155
153
|
const accessToken = ((_b = (yield ((_a = this._tokenCredential) === null || _a === void 0 ? void 0 : _a.getToken("https://management.azure.com/.default")))) === null || _b === void 0 ? void 0 : _b.token) || '';
|
|
154
|
+
const getSession = () => {
|
|
155
|
+
var _a, _b, _c, _d;
|
|
156
|
+
return {
|
|
157
|
+
accessToken,
|
|
158
|
+
id: ((_a = this._tokenCredential) === null || _a === void 0 ? void 0 : _a.tenantId) || '',
|
|
159
|
+
account: {
|
|
160
|
+
id: ((_b = this._tokenCredential) === null || _b === void 0 ? void 0 : _b.tenantId) || '',
|
|
161
|
+
label: ((_c = this._tokenCredential) === null || _c === void 0 ? void 0 : _c.tenantId) || '',
|
|
162
|
+
},
|
|
163
|
+
tenantId: ((_d = this._tokenCredential) === null || _d === void 0 ? void 0 : _d.tenantId) || '',
|
|
164
|
+
scopes: scopes || [],
|
|
165
|
+
};
|
|
166
|
+
};
|
|
156
167
|
return {
|
|
157
168
|
client: new armSubs.SubscriptionClient(this._tokenCredential),
|
|
158
169
|
credential: this._tokenCredential,
|
|
159
170
|
authentication: {
|
|
160
|
-
getSession
|
|
161
|
-
|
|
162
|
-
return {
|
|
163
|
-
accessToken,
|
|
164
|
-
id: ((_a = this._tokenCredential) === null || _a === void 0 ? void 0 : _a.tenantId) || '',
|
|
165
|
-
account: {
|
|
166
|
-
id: ((_b = this._tokenCredential) === null || _b === void 0 ? void 0 : _b.tenantId) || '',
|
|
167
|
-
label: ((_c = this._tokenCredential) === null || _c === void 0 ? void 0 : _c.tenantId) || '',
|
|
168
|
-
},
|
|
169
|
-
tenantId: ((_d = this._tokenCredential) === null || _d === void 0 ? void 0 : _d.tenantId) || '',
|
|
170
|
-
scopes: scopes || [],
|
|
171
|
-
};
|
|
172
|
-
}
|
|
171
|
+
getSession,
|
|
172
|
+
getSessionWithScopes: getSession,
|
|
173
173
|
}
|
|
174
174
|
};
|
|
175
175
|
});
|
|
@@ -287,7 +287,10 @@ class VSCodeAzureSubscriptionProvider extends vscode.Disposable {
|
|
|
287
287
|
client: new armSubs.SubscriptionClient(credential, { endpoint }),
|
|
288
288
|
credential: credential,
|
|
289
289
|
authentication: {
|
|
290
|
-
getSession: () => session
|
|
290
|
+
getSession: () => session,
|
|
291
|
+
getSessionWithScopes: (scopes) => {
|
|
292
|
+
return (0, getSessionFromVSCode_1.getSessionFromVSCode)(scopes, tenantId, { createIfNone: false, silent: true });
|
|
293
|
+
},
|
|
291
294
|
}
|
|
292
295
|
};
|
|
293
296
|
});
|
|
@@ -0,0 +1,6 @@
|
|
|
1
|
+
import type { AzureSubscriptionProvider } from "./AzureSubscriptionProvider";
|
|
2
|
+
/**
|
|
3
|
+
* Prompts user to select from a list of unauthenticated tenants.
|
|
4
|
+
* Once selected, requests a new session from VS Code specifially for this tenant.
|
|
5
|
+
*/
|
|
6
|
+
export declare function signInToTenant(subscriptionProvider: AzureSubscriptionProvider): Promise<void>;
|
|
@@ -0,0 +1,57 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/*---------------------------------------------------------------------------------------------
|
|
3
|
+
* Copyright (c) Microsoft Corporation. All rights reserved.
|
|
4
|
+
* Licensed under the MIT License. See License.txt in the project root for license information.
|
|
5
|
+
*--------------------------------------------------------------------------------------------*/
|
|
6
|
+
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
|
|
7
|
+
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
|
|
8
|
+
return new (P || (P = Promise))(function (resolve, reject) {
|
|
9
|
+
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
|
|
10
|
+
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
|
|
11
|
+
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
|
|
12
|
+
step((generator = generator.apply(thisArg, _arguments || [])).next());
|
|
13
|
+
});
|
|
14
|
+
};
|
|
15
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
16
|
+
exports.signInToTenant = void 0;
|
|
17
|
+
const vscode = require("vscode");
|
|
18
|
+
const getUnauthenticatedTenants_1 = require("./utils/getUnauthenticatedTenants");
|
|
19
|
+
/**
|
|
20
|
+
* Prompts user to select from a list of unauthenticated tenants.
|
|
21
|
+
* Once selected, requests a new session from VS Code specifially for this tenant.
|
|
22
|
+
*/
|
|
23
|
+
function signInToTenant(subscriptionProvider) {
|
|
24
|
+
return __awaiter(this, void 0, void 0, function* () {
|
|
25
|
+
const tenantId = yield pickTenant(subscriptionProvider);
|
|
26
|
+
if (tenantId) {
|
|
27
|
+
yield subscriptionProvider.signIn(tenantId);
|
|
28
|
+
}
|
|
29
|
+
});
|
|
30
|
+
}
|
|
31
|
+
exports.signInToTenant = signInToTenant;
|
|
32
|
+
function pickTenant(subscriptionProvider) {
|
|
33
|
+
return __awaiter(this, void 0, void 0, function* () {
|
|
34
|
+
const pick = yield vscode.window.showQuickPick(getPicks(subscriptionProvider), {
|
|
35
|
+
placeHolder: 'Select Directory to Sign In To',
|
|
36
|
+
matchOnDescription: true,
|
|
37
|
+
ignoreFocusOut: true,
|
|
38
|
+
});
|
|
39
|
+
return pick === null || pick === void 0 ? void 0 : pick.tenant.tenantId;
|
|
40
|
+
});
|
|
41
|
+
}
|
|
42
|
+
function getPicks(subscriptionProvider) {
|
|
43
|
+
return __awaiter(this, void 0, void 0, function* () {
|
|
44
|
+
const unauthenticatedTenants = yield (0, getUnauthenticatedTenants_1.getUnauthenticatedTenants)(subscriptionProvider);
|
|
45
|
+
const picks = unauthenticatedTenants.map(tenant => {
|
|
46
|
+
var _a, _b, _c;
|
|
47
|
+
return ({
|
|
48
|
+
label: (_a = tenant.displayName) !== null && _a !== void 0 ? _a : '',
|
|
49
|
+
description: (_b = tenant.tenantId) !== null && _b !== void 0 ? _b : '',
|
|
50
|
+
detail: (_c = tenant.defaultDomain) !== null && _c !== void 0 ? _c : '',
|
|
51
|
+
tenant,
|
|
52
|
+
});
|
|
53
|
+
});
|
|
54
|
+
return picks;
|
|
55
|
+
});
|
|
56
|
+
}
|
|
57
|
+
//# sourceMappingURL=signInToTenants.js.map
|