Skip to content

Add endpoints for managed HSM #227

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 19, 2020
Merged

Add endpoints for managed HSM #227

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
04ddeef
managed hsm endpoints
isra-fel Sep 8, 2020
1748fdb
fix
isra-fel Sep 10, 2020
3fa38ea
Merge branch 'master' into yeming/mhsm
isra-fel Oct 19, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 17 additions & 7 deletions src/Authentication.Abstractions/AzureEnvironment.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ namespace Microsoft.Azure.Commands.Common.Authentication.Abstractions
/// A record of metadata necessary to manage assets in a specific azure cloud, including necessary endpoints,
/// location fo service-specific endpoints, and information for bootstrapping authentication
/// </summary>
[Serializable]
[Serializable]
public class AzureEnvironment : IAzureEnvironment, IEquatable<AzureEnvironment>
{
private const string ArmMetadataEnvVariable = "ARM_CLOUD_METADATA_URL";
Expand Down Expand Up @@ -238,7 +238,7 @@ private static async Task<List<ArmMetadata>> InitializeEnvironmentsFromArm(strin
/// <param name="azureEnvironments">Collection of AzureEnvironments</param>
private static void SetExtendedProperties(IDictionary<string, AzureEnvironment> azureEnvironments)
{
if(azureEnvironments.ContainsKey(EnvironmentName.AzureCloud))
if (azureEnvironments.ContainsKey(EnvironmentName.AzureCloud))
{
azureEnvironments[EnvironmentName.AzureCloud].SetProperty(ExtendedEndpoint.OperationalInsightsEndpoint, AzureEnvironmentConstants.AzureOperationalInsightsEndpoint);
azureEnvironments[EnvironmentName.AzureCloud].SetProperty(ExtendedEndpoint.OperationalInsightsEndpointResourceId, AzureEnvironmentConstants.AzureOperationalInsightsEndpointResourceId);
Expand All @@ -248,28 +248,36 @@ private static void SetExtendedProperties(IDictionary<string, AzureEnvironment>
azureEnvironments[EnvironmentName.AzureCloud].SetProperty(ExtendedEndpoint.AzureAttestationServiceEndpointResourceId, AzureEnvironmentConstants.AzureAttestationServiceEndpointResourceId);
azureEnvironments[EnvironmentName.AzureCloud].SetProperty(ExtendedEndpoint.AzureSynapseAnalyticsEndpointSuffix, AzureEnvironmentConstants.AzureSynapseAnalyticsEndpointSuffix);
azureEnvironments[EnvironmentName.AzureCloud].SetProperty(ExtendedEndpoint.AzureSynapseAnalyticsEndpointResourceId, AzureEnvironmentConstants.AzureSynapseAnalyticsEndpointResourceId);
azureEnvironments[EnvironmentName.AzureCloud].SetProperty(ExtendedEndpoint.ManagedHsmServiceEndpointResourceId, AzureEnvironmentConstants.AzureManagedHsmServiceEndpointResourceId);
azureEnvironments[EnvironmentName.AzureCloud].SetProperty(ExtendedEndpoint.ManagedHsmServiceEndpointSuffix, AzureEnvironmentConstants.AzureManagedHsmDnsSuffix);
}

if(azureEnvironments.ContainsKey(EnvironmentName.AzureChinaCloud))
if (azureEnvironments.ContainsKey(EnvironmentName.AzureChinaCloud))
{
azureEnvironments[EnvironmentName.AzureChinaCloud].SetProperty(ExtendedEndpoint.AnalysisServicesEndpointSuffix, AzureEnvironmentConstants.ChinaAnalysisServicesEndpointSuffix);
azureEnvironments[EnvironmentName.AzureChinaCloud].SetProperty(ExtendedEndpoint.AnalysisServicesEndpointResourceId, AzureEnvironmentConstants.ChinaAnalysisServicesEndpointResourceId);
azureEnvironments[EnvironmentName.AzureChinaCloud].SetProperty(ExtendedEndpoint.AzureSynapseAnalyticsEndpointSuffix, AzureEnvironmentConstants.ChinaSynapseAnalyticsEndpointSuffix);
azureEnvironments[EnvironmentName.AzureChinaCloud].SetProperty(ExtendedEndpoint.AzureSynapseAnalyticsEndpointResourceId, AzureEnvironmentConstants.ChinaSynapseAnalyticsEndpointResourceId);
azureEnvironments[EnvironmentName.AzureChinaCloud].SetProperty(ExtendedEndpoint.ManagedHsmServiceEndpointResourceId, AzureEnvironmentConstants.ChineManagedHsmServiceEndpointResourceId);
azureEnvironments[EnvironmentName.AzureChinaCloud].SetProperty(ExtendedEndpoint.ManagedHsmServiceEndpointSuffix, AzureEnvironmentConstants.ChinaManagedHsmDnsSuffix);
}

if(azureEnvironments.ContainsKey(EnvironmentName.AzureUSGovernment))
if (azureEnvironments.ContainsKey(EnvironmentName.AzureUSGovernment))
{
azureEnvironments[EnvironmentName.AzureUSGovernment].SetProperty(ExtendedEndpoint.OperationalInsightsEndpoint, AzureEnvironmentConstants.USGovernmentOperationalInsightsEndpoint);
azureEnvironments[EnvironmentName.AzureUSGovernment].SetProperty(ExtendedEndpoint.OperationalInsightsEndpointResourceId, AzureEnvironmentConstants.USGovernmentOperationalInsightsEndpointResourceId);
azureEnvironments[EnvironmentName.AzureUSGovernment].SetProperty(ExtendedEndpoint.AnalysisServicesEndpointSuffix, AzureEnvironmentConstants.USGovernmentAnalysisServicesEndpointSuffix);
azureEnvironments[EnvironmentName.AzureUSGovernment].SetProperty(ExtendedEndpoint.AnalysisServicesEndpointResourceId, AzureEnvironmentConstants.USGovernmentAnalysisServicesEndpointResourceId);
azureEnvironments[EnvironmentName.AzureUSGovernment].SetProperty(ExtendedEndpoint.ManagedHsmServiceEndpointResourceId, AzureEnvironmentConstants.USGovernmeneManagedHsmServiceEndpointResourceId);
azureEnvironments[EnvironmentName.AzureUSGovernment].SetProperty(ExtendedEndpoint.ManagedHsmServiceEndpointSuffix, AzureEnvironmentConstants.USGovernmentManagedHsmDnsSuffix);
}

if(azureEnvironments.ContainsKey(EnvironmentName.AzureGermanCloud))
if (azureEnvironments.ContainsKey(EnvironmentName.AzureGermanCloud))
{
azureEnvironments[EnvironmentName.AzureGermanCloud].SetProperty(ExtendedEndpoint.AnalysisServicesEndpointSuffix, AzureEnvironmentConstants.GermanAnalysisServicesEndpointSuffix);
azureEnvironments[EnvironmentName.AzureGermanCloud].SetProperty(ExtendedEndpoint.AnalysisServicesEndpointResourceId, AzureEnvironmentConstants.GermanAnalysisServicesEndpointResourceId);
azureEnvironments[EnvironmentName.AzureGermanCloud].SetProperty(ExtendedEndpoint.ManagedHsmServiceEndpointResourceId, AzureEnvironmentConstants.GermanAzureManagedHsmServiceEndpointResourceId);
azureEnvironments[EnvironmentName.AzureGermanCloud].SetProperty(ExtendedEndpoint.ManagedHsmServiceEndpointSuffix, AzureEnvironmentConstants.GermanManagedHsmDnsSuffix);
}
}

Expand Down Expand Up @@ -305,11 +313,11 @@ private static AzureEnvironment MapArmToAzureEnvironment(ArmMetadata armMetadata
ContainerRegistryEndpointSuffix = armMetadata.Suffixes.AcrLoginServer
};

// There are mismatches between metadata built in Azure PowerShell/CLI and from ARM endpoint.
// There are mismatches between metadata built in Azure PowerShell/CLI and from ARM endpoint.
// Considering compatibility, below hard coded logic accommodates those mismatches
// SqlDatabaseDnsSuffix requires value leading with period
// ServiceManagementUrl as audience needs to end with slash
if(azureEnvironment.SqlDatabaseDnsSuffix != null && !azureEnvironment.SqlDatabaseDnsSuffix.StartsWith("."))
if (azureEnvironment.SqlDatabaseDnsSuffix != null && !azureEnvironment.SqlDatabaseDnsSuffix.StartsWith("."))
{
azureEnvironment.SqlDatabaseDnsSuffix = "." + azureEnvironment.SqlDatabaseDnsSuffix;
}
Expand Down Expand Up @@ -635,6 +643,8 @@ public static class ExtendedEndpoint
{
public const string OperationalInsightsEndpointResourceId = "OperationalInsightsEndpointResourceId",
OperationalInsightsEndpoint = "OperationalInsightsEndpoint",
ManagedHsmServiceEndpointSuffix = "ManagedHsmServiceEndpointSuffix",
ManagedHsmServiceEndpointResourceId = "ManagedHsmServiceEndpointResourceId",
AnalysisServicesEndpointSuffix = "AzureAnalysisServicesEndpointSuffix",
AnalysisServicesEndpointResourceId = "AnalysisServicesEndpointResourceId",
AzureAttestationServiceEndpointSuffix = "AzureAttestationServiceEndpointSuffix",
Expand Down
16 changes: 16 additions & 0 deletions src/Authentication.Abstractions/AzureEnvironmentConstants.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,14 @@ public static class AzureEnvironmentConstants
public const string USGovernmentKeyVaultDnsSuffix = "vault.usgovcloudapi.net";
public const string GermanKeyVaultDnsSuffix = "vault.microsoftazure.de";

/// <summary>
/// The domain name suffix for azure keyvault managed hsms
/// </summary>
public const string AzureManagedHsmDnsSuffix = "managedhsm.azure.net";
public const string ChinaManagedHsmDnsSuffix = "managedhsm.azure.cn";
public const string USGovernmentManagedHsmDnsSuffix = "managedhsm.usgovcloudapi.net";
public const string GermanManagedHsmDnsSuffix = "managedhsm.microsoftazure.de";

/// <summary>
/// The token audience for authorizing KeyVault requests
/// </summary>
Expand All @@ -120,6 +128,14 @@ public static class AzureEnvironmentConstants
public const string USGovernmentKeyVaultServiceEndpointResourceId = "https://vault.usgovcloudapi.net";
public const string GermanAzureKeyVaultServiceEndpointResourceId = "https://vault.microsoftazure.de";

/// <summary>
/// The token audience for authorizing managed hsm requests
/// </summary>
public const string AzureManagedHsmServiceEndpointResourceId = "https://managedhsm.azure.net";
public const string ChineManagedHsmServiceEndpointResourceId = "https://managedhsm.azure.cn";
public const string USGovernmeneManagedHsmServiceEndpointResourceId = "https://managedhsm.usgovcloudapi.net";
public const string GermanAzureManagedHsmServiceEndpointResourceId = "https://managedhsm.microsoftazure.de";

/// <summary>
/// The token audience for Log Analytics Queries
/// </summary>
Expand Down
10 changes: 10 additions & 0 deletions src/Authentication.Abstractions/Extensions/AzureEnvironmentExtensions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,6 +289,12 @@ public static void SetEndpoint(this IAzureEnvironment environment, string endpoi
case AzureEnvironment.ExtendedEndpoint.AzureSynapseAnalyticsEndpointResourceId:
environment.SetProperty(AzureEnvironment.ExtendedEndpoint.AzureSynapseAnalyticsEndpointResourceId, propertyValue);
break;
case AzureEnvironment.ExtendedEndpoint.ManagedHsmServiceEndpointSuffix:
environment.SetProperty(AzureEnvironment.ExtendedEndpoint.ManagedHsmServiceEndpointSuffix, propertyValue);
break;
case AzureEnvironment.ExtendedEndpoint.ManagedHsmServiceEndpointResourceId:
environment.SetProperty(AzureEnvironment.ExtendedEndpoint.ManagedHsmServiceEndpointResourceId, propertyValue);
break;
}
}
}
Expand Down Expand Up @@ -332,6 +338,10 @@ public static string GetTokenAudience(this IAzureEnvironment environment, string
case AzureEnvironment.ExtendedEndpoint.AzureSynapseAnalyticsEndpointResourceId:
resource = AzureEnvironment.ExtendedEndpoint.AzureSynapseAnalyticsEndpointResourceId;
break;
case AzureEnvironment.ExtendedEndpoint.ManagedHsmServiceEndpointSuffix:
case AzureEnvironment.ExtendedEndpoint.ManagedHsmServiceEndpointResourceId:
resource = AzureEnvironment.ExtendedEndpoint.ManagedHsmServiceEndpointResourceId;
break;
default:
resource = AzureEnvironment.Endpoint.ActiveDirectoryServiceEndpointResourceId;
break;
Expand Down