-
Notifications
You must be signed in to change notification settings - Fork 184
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support gitlab
as a federated auth source for azd auth login
#3244
Conversation
Unlike GitHub, instead of having to fetch a token via an HTTP endpoint, you can just ask GitLab to inject the token into an env-var. We expect that the user will add the following to their pipeline: ``` id_tokens: AZD_GITLAB_FEDERATED_TOKEN: aud: "api://AzureADTokenExchange" ``` Then, `azd auth login --federated-credential-provider gitlab` should work as expected. Fixes Azure#3242
@MiTschMR, see if this works for you. When I first did the federated credential feature, I think we supported just passing the raw value of the federated token using |
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash:
pwsh:
WindowsPowerShell install
MSI install
Standalone Binary
MSIContainer
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
errors.New("AZD_GITLAB_FEDERATED_TOKEN is not set. It should be a valid GitLab id_token with an " + | ||
" an audience of 'api://AzureADTokenExchange'") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
errors.New("AZD_GITLAB_FEDERATED_TOKEN is not set. It should be a valid GitLab id_token with an " + | |
" an audience of 'api://AzureADTokenExchange'") | |
errors.New("AZD_GITLAB_FEDERATED_TOKEN is not set. It should be a valid GitLab id_token with an " + | |
" audience of 'api://AzureADTokenExchange'") |
} | ||
|
||
return federatedToken, nil | ||
case gitLabFederatedAuth: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I was really curious about what the "standard" is and looked around a little.
I think we can drop all the custom support and instead implement OIDC token support generically, following the footsteps of what's been done in other tools (Pulumi, Terraform) for better compatibility:
ACTIONS_ID_TOKEN_REQUEST_TOKEN
andACTIONS_ID_TOKEN_REQUEST_URL
are automatically detected for GitHubARM_OIDC_REQUEST_TOKEN
andARM_OIDC_REQUEST_TOKEN_URL
for overrideARM_OIDC_TOKEN
for direct token
Be happy to create an issue / make the changes here if you think it's worthwhile.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Love it - feel free to take over the PR.
Hi @ellismg. Thank you for your interest in helping to improve the Azure Developer CLI experience and for your contribution. We've noticed that there hasn't been recent engagement on this pull request. If this is still an active work stream, please let us know by pushing some changes or leaving a comment. Otherwise, we'll close this out in 7 days. |
Hi @ellismg. Thank you for your contribution. Since there hasn't been recent engagement, we're going to close this out. Feel free to respond with a comment containing "/reopen" if you'd like to continue working on these changes. Please be sure to use the command to reopen or remove the "no-recent-activity" label; otherwise, this is likely to be closed again with the next cleanup pass. |
Unlike GitHub, instead of having to fetch a token via an HTTP endpoint, you can just ask GitLab to inject the token into an env-var. We expect that the user will add the following to their pipeline:
Then,
azd auth login --federated-credential-provider gitlab
should work as expected.Fixes #3242