|
|
@@ -19,6 +19,8 @@ import (
|
|
|
"syscall"
|
|
|
"time"
|
|
|
|
|
|
+ "github.com/docker/api/errdefs"
|
|
|
+
|
|
|
"github.com/Azure/go-autorest/autorest"
|
|
|
"github.com/Azure/go-autorest/autorest/adal"
|
|
|
"github.com/Azure/go-autorest/autorest/azure/cli"
|
|
|
@@ -28,6 +30,10 @@ import (
|
|
|
"github.com/pkg/errors"
|
|
|
)
|
|
|
|
|
|
+func init() {
|
|
|
+ rand.Seed(time.Now().Unix())
|
|
|
+}
|
|
|
+
|
|
|
//go login process, derived from code sample provided by MS at https://github.com/devigned/go-az-cli-stuff
|
|
|
const (
|
|
|
authorizeFormat = "https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?response_type=code&client_id=%s&redirect_uri=%s&state=%s&prompt=select_account&response_mode=query&scope=%s"
|
|
|
@@ -39,7 +45,7 @@ const (
|
|
|
)
|
|
|
|
|
|
type (
|
|
|
- Token struct {
|
|
|
+ azureToken struct {
|
|
|
Type string `json:"token_type"`
|
|
|
Scope string `json:"scope"`
|
|
|
ExpiresIn int `json:"expires_in"`
|
|
|
@@ -49,67 +55,65 @@ type (
|
|
|
Foci string `json:"foci"`
|
|
|
}
|
|
|
|
|
|
- TenantResult struct {
|
|
|
- Value []TenantValue `json:"value"`
|
|
|
+ tenantResult struct {
|
|
|
+ Value []tenantValue `json:"value"`
|
|
|
}
|
|
|
- TenantValue struct {
|
|
|
+ tenantValue struct {
|
|
|
TenantID string `json:"tenantId"`
|
|
|
}
|
|
|
)
|
|
|
|
|
|
-//AzureLogin login through browser
|
|
|
-func Login() error {
|
|
|
+// AzureLoginService Service to log into azure and get authentifier for azure APIs
|
|
|
+type AzureLoginService struct {
|
|
|
+ tokenStore tokenStore
|
|
|
+ apiHelper apiHelper
|
|
|
+}
|
|
|
+
|
|
|
+const tokenFilename = "dockerAccessToken.json"
|
|
|
+
|
|
|
+func getTokenStorePath() string {
|
|
|
+ cliPath, _ := cli.AccessTokensPath()
|
|
|
+ return filepath.Join(filepath.Dir(cliPath), tokenFilename)
|
|
|
+}
|
|
|
+
|
|
|
+// NewAzureLoginService creates a NewAzureLoginService
|
|
|
+func NewAzureLoginService() AzureLoginService {
|
|
|
+ return newAzureLoginServiceFromPath(getTokenStorePath(), azureAPIHelper{})
|
|
|
+}
|
|
|
+
|
|
|
+func newAzureLoginServiceFromPath(tokenStorePath string, helper apiHelper) AzureLoginService {
|
|
|
+ return AzureLoginService{
|
|
|
+ tokenStore: tokenStore{
|
|
|
+ filePath: tokenStorePath,
|
|
|
+ },
|
|
|
+ apiHelper: helper,
|
|
|
+ }
|
|
|
+}
|
|
|
+
|
|
|
+type apiHelper interface {
|
|
|
+ queryToken(data url.Values, tenantID string) (token azureToken, err error)
|
|
|
+}
|
|
|
+
|
|
|
+type azureAPIHelper struct{}
|
|
|
+
|
|
|
+//Login perform azure login through browser
|
|
|
+func (login AzureLoginService) Login() error {
|
|
|
sigs := make(chan os.Signal, 1)
|
|
|
signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)
|
|
|
|
|
|
queryCh := make(chan url.Values, 1)
|
|
|
- queryHandler := func(w http.ResponseWriter, r *http.Request) {
|
|
|
- queryCh <- r.URL.Query()
|
|
|
- _, hasCode := r.URL.Query()["code"]
|
|
|
- if hasCode {
|
|
|
- w.Write([]byte(`
|
|
|
-<!DOCTYPE html>
|
|
|
-<html>
|
|
|
-<head>
|
|
|
- <meta charset="utf-8" />
|
|
|
- <meta http-equiv="refresh" content="10;url=https://docs.microsoft.com/cli/azure/">
|
|
|
- <title>Login successfully</title>
|
|
|
-</head>
|
|
|
-<body>
|
|
|
- <h4>You have logged into Microsoft Azure!</h4>
|
|
|
- <p>You can close this window, or we will redirect you to the <a href="https://docs.microsoft.com/cli/azure/">Azure CLI documents</a> in 10 seconds.</p>
|
|
|
-</body>
|
|
|
-</html>
|
|
|
- `))
|
|
|
- } else {
|
|
|
- w.Write([]byte(`
|
|
|
-<!DOCTYPE html>
|
|
|
-<html>
|
|
|
-<head>
|
|
|
- <meta charset="utf-8" />
|
|
|
- <title>Login failed</title>
|
|
|
-</head>
|
|
|
-<body>
|
|
|
- <h4>Some failures occurred during the authentication</h4>
|
|
|
- <p>You can log an issue at <a href="https://github.com/azure/azure-cli/issues">Azure CLI GitHub Repository</a> and we will assist you in resolving it.</p>
|
|
|
-</body>
|
|
|
-</html>
|
|
|
-`))
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
mux := http.NewServeMux()
|
|
|
- mux.HandleFunc("/", queryHandler)
|
|
|
+ mux.HandleFunc("/", queryHandler(queryCh))
|
|
|
server := &http.Server{Addr: ":8401", Handler: mux}
|
|
|
go func() {
|
|
|
if err := server.ListenAndServe(); err != nil {
|
|
|
- fmt.Println(fmt.Errorf("error starting http server with: %w", err))
|
|
|
- os.Exit(1)
|
|
|
+ queryCh <- url.Values{
|
|
|
+ "error": []string{fmt.Sprintf("error starting http server with: %v", err)},
|
|
|
+ }
|
|
|
}
|
|
|
}()
|
|
|
|
|
|
- state := RandomString("", 10)
|
|
|
- //nonce := RandomString("", 10)
|
|
|
+ state := randomString("", 10)
|
|
|
authURL := fmt.Sprintf(authorizeFormat, clientID, "http://localhost:8401", state, scopes)
|
|
|
openbrowser(authURL)
|
|
|
|
|
|
@@ -117,9 +121,13 @@ func Login() error {
|
|
|
case <-sigs:
|
|
|
return nil
|
|
|
case qsValues := <-queryCh:
|
|
|
+ errorMsg, hasError := qsValues["error"]
|
|
|
+ if hasError {
|
|
|
+ return fmt.Errorf("login failed : %s", errorMsg)
|
|
|
+ }
|
|
|
code, hasCode := qsValues["code"]
|
|
|
if !hasCode {
|
|
|
- return fmt.Errorf("Authentication Error : Login failed")
|
|
|
+ return errdefs.ErrLoginFailed
|
|
|
}
|
|
|
data := url.Values{
|
|
|
"grant_type": []string{"authorization_code"},
|
|
|
@@ -128,7 +136,7 @@ func Login() error {
|
|
|
"scope": []string{scopes},
|
|
|
"redirect_uri": []string{"http://localhost:8401"},
|
|
|
}
|
|
|
- token, err := queryToken(data, "organizations")
|
|
|
+ token, err := login.apiHelper.queryToken(data, "organizations")
|
|
|
if err != nil {
|
|
|
return errors.Wrap(err, "Access token request failed")
|
|
|
}
|
|
|
@@ -141,53 +149,78 @@ func Login() error {
|
|
|
req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.AccessToken))
|
|
|
res, err := http.DefaultClient.Do(req)
|
|
|
if err != nil {
|
|
|
- return errors.Wrap(err, "Authentication Error")
|
|
|
+ return errors.Wrap(err, "login failed")
|
|
|
}
|
|
|
|
|
|
bits, err := ioutil.ReadAll(res.Body)
|
|
|
if err != nil {
|
|
|
- return errors.Wrap(err, "Authentication Error")
|
|
|
+ return errors.Wrap(err, "login failed")
|
|
|
}
|
|
|
|
|
|
if res.StatusCode == 200 {
|
|
|
- var tenantResult TenantResult
|
|
|
+ var tenantResult tenantResult
|
|
|
if err := json.Unmarshal(bits, &tenantResult); err != nil {
|
|
|
- return errors.Wrap(err, "Authentication Error")
|
|
|
+ return errors.Wrap(err, "login failed")
|
|
|
}
|
|
|
tenantID := tenantResult.Value[0].TenantID
|
|
|
- tenantToken, err := refreshToken(token.RefreshToken, tenantID)
|
|
|
+ tenantToken, err := login.refreshToken(token.RefreshToken, tenantID)
|
|
|
if err != nil {
|
|
|
- return errors.Wrap(err, "Authentication Error")
|
|
|
+ return errors.Wrap(err, "login failed")
|
|
|
}
|
|
|
- loginInfo := LoginInfo{TenantID: tenantID, Token: tenantToken}
|
|
|
+ loginInfo := TokenInfo{TenantID: tenantID, Token: tenantToken}
|
|
|
|
|
|
- store := NewTokenStore(getTokenPath())
|
|
|
- err = store.writeLoginInfo(loginInfo)
|
|
|
+ err = login.tokenStore.writeLoginInfo(loginInfo)
|
|
|
|
|
|
if err != nil {
|
|
|
- return errors.Wrap(err, "Authentication Error")
|
|
|
+ return errors.Wrap(err, "login failed")
|
|
|
}
|
|
|
- fmt.Println("Successfully logged in")
|
|
|
+ fmt.Println("Login Succeeded")
|
|
|
|
|
|
return nil
|
|
|
}
|
|
|
|
|
|
bits, err = httputil.DumpResponse(res, true)
|
|
|
if err != nil {
|
|
|
- return errors.Wrap(err, "Authentication Error")
|
|
|
+ return errors.Wrap(err, "login failed")
|
|
|
}
|
|
|
|
|
|
- return fmt.Errorf("Authentication Error: \n" + string(bits))
|
|
|
+ return fmt.Errorf("login failed: \n" + string(bits))
|
|
|
+ }
|
|
|
+}
|
|
|
+
|
|
|
+func queryHandler(queryCh chan url.Values) func(w http.ResponseWriter, r *http.Request) {
|
|
|
+ queryHandler := func(w http.ResponseWriter, r *http.Request) {
|
|
|
+ _, hasCode := r.URL.Query()["code"]
|
|
|
+ if hasCode {
|
|
|
+ _, err := w.Write([]byte(successfullLoginHTML))
|
|
|
+ if err != nil {
|
|
|
+ queryCh <- url.Values{
|
|
|
+ "error": []string{err.Error()},
|
|
|
+ }
|
|
|
+ } else {
|
|
|
+ queryCh <- r.URL.Query()
|
|
|
+ }
|
|
|
+ } else {
|
|
|
+ _, err := w.Write([]byte(loginFailedHTML))
|
|
|
+ if err != nil {
|
|
|
+ queryCh <- url.Values{
|
|
|
+ "error": []string{err.Error()},
|
|
|
+ }
|
|
|
+ } else {
|
|
|
+ queryCh <- r.URL.Query()
|
|
|
+ }
|
|
|
+ }
|
|
|
}
|
|
|
+ return queryHandler
|
|
|
}
|
|
|
|
|
|
-func queryToken(data url.Values, tenantID string) (token Token, err error) {
|
|
|
+func (helper azureAPIHelper) queryToken(data url.Values, tenantID string) (token azureToken, err error) {
|
|
|
res, err := http.Post(fmt.Sprintf(tokenEndpoint, tenantID), "application/x-www-form-urlencoded", strings.NewReader(data.Encode()))
|
|
|
if err != nil {
|
|
|
return token, err
|
|
|
}
|
|
|
if res.StatusCode != 200 {
|
|
|
- return token, err
|
|
|
+ return token, errors.Errorf("error while renewing access token, status : %s", res.Status)
|
|
|
}
|
|
|
bits, err := ioutil.ReadAll(res.Body)
|
|
|
if err != nil {
|
|
|
@@ -199,8 +232,8 @@ func queryToken(data url.Values, tenantID string) (token Token, err error) {
|
|
|
return token, nil
|
|
|
}
|
|
|
|
|
|
-func toOAuthToken(token Token) oauth2.Token {
|
|
|
- expireTime := time.Now().Add(time.Duration(token.ExtExpiresIn) * time.Second)
|
|
|
+func toOAuthToken(token azureToken) oauth2.Token {
|
|
|
+ expireTime := time.Now().Add(time.Duration(token.ExpiresIn) * time.Second)
|
|
|
oauthToken := oauth2.Token{
|
|
|
RefreshToken: token.RefreshToken,
|
|
|
AccessToken: token.AccessToken,
|
|
|
@@ -210,27 +243,18 @@ func toOAuthToken(token Token) oauth2.Token {
|
|
|
return oauthToken
|
|
|
}
|
|
|
|
|
|
-const tokenFilename = "dockerAccessToken.json"
|
|
|
-
|
|
|
-func getTokenPath() string {
|
|
|
- cliPath, _ := cli.AccessTokensPath()
|
|
|
-
|
|
|
- return filepath.Join(filepath.Dir(cliPath), tokenFilename)
|
|
|
-}
|
|
|
-
|
|
|
-func NewAuthorizerFromLogin() (autorest.Authorizer, error) {
|
|
|
- oauthToken, err := GetValidToken()
|
|
|
+// NewAuthorizerFromLogin creates an authorizer based on login access token
|
|
|
+func (login AzureLoginService) NewAuthorizerFromLogin() (autorest.Authorizer, error) {
|
|
|
+ oauthToken, err := login.GetValidToken()
|
|
|
if err != nil {
|
|
|
return nil, err
|
|
|
}
|
|
|
|
|
|
- difference := oauthToken.Expiry.Sub(date.UnixEpoch())
|
|
|
-
|
|
|
token := adal.Token{
|
|
|
AccessToken: oauthToken.AccessToken,
|
|
|
Type: oauthToken.TokenType,
|
|
|
- ExpiresIn: "3600",
|
|
|
- ExpiresOn: json.Number(strconv.Itoa(int(difference.Seconds()))),
|
|
|
+ ExpiresIn: json.Number(strconv.Itoa(int(oauthToken.Expiry.Sub(time.Now()).Seconds()))),
|
|
|
+ ExpiresOn: json.Number(strconv.Itoa(int(oauthToken.Expiry.Sub(date.UnixEpoch()).Seconds()))),
|
|
|
RefreshToken: "",
|
|
|
Resource: "",
|
|
|
}
|
|
|
@@ -238,9 +262,9 @@ func NewAuthorizerFromLogin() (autorest.Authorizer, error) {
|
|
|
return autorest.NewBearerAuthorizer(&token), nil
|
|
|
}
|
|
|
|
|
|
-func GetValidToken() (token oauth2.Token, err error) {
|
|
|
- store := NewTokenStore(getTokenPath())
|
|
|
- loginInfo, err := store.readToken()
|
|
|
+// GetValidToken returns an access token. Refresh token if needed
|
|
|
+func (login AzureLoginService) GetValidToken() (token oauth2.Token, err error) {
|
|
|
+ loginInfo, err := login.tokenStore.readToken()
|
|
|
if err != nil {
|
|
|
return token, err
|
|
|
}
|
|
|
@@ -249,25 +273,25 @@ func GetValidToken() (token oauth2.Token, err error) {
|
|
|
return token, nil
|
|
|
}
|
|
|
tenantID := loginInfo.TenantID
|
|
|
- token, err = refreshToken(token.RefreshToken, tenantID)
|
|
|
+ token, err = login.refreshToken(token.RefreshToken, tenantID)
|
|
|
if err != nil {
|
|
|
- return token, errors.Wrap(err, "Access token request failed. Maybe you need to login to azure again.")
|
|
|
+ return token, errors.Wrap(err, "access token request failed. Maybe you need to login to azure again.")
|
|
|
}
|
|
|
- err = store.writeLoginInfo(LoginInfo{TenantID: tenantID, Token: token})
|
|
|
+ err = login.tokenStore.writeLoginInfo(TokenInfo{TenantID: tenantID, Token: token})
|
|
|
if err != nil {
|
|
|
return token, err
|
|
|
}
|
|
|
return token, nil
|
|
|
}
|
|
|
|
|
|
-func refreshToken(currentRefreshToken string, tenantID string) (oauthToken oauth2.Token, err error) {
|
|
|
+func (login AzureLoginService) refreshToken(currentRefreshToken string, tenantID string) (oauthToken oauth2.Token, err error) {
|
|
|
data := url.Values{
|
|
|
"grant_type": []string{"refresh_token"},
|
|
|
"client_id": []string{clientID},
|
|
|
"scope": []string{scopes},
|
|
|
"refresh_token": []string{currentRefreshToken},
|
|
|
}
|
|
|
- token, err := queryToken(data, tenantID)
|
|
|
+ token, err := login.apiHelper.queryToken(data, tenantID)
|
|
|
if err != nil {
|
|
|
return oauthToken, err
|
|
|
}
|
|
|
@@ -297,15 +321,39 @@ var (
|
|
|
letterRunes = []rune("abcdefghijklmnopqrstuvwxyz123456789")
|
|
|
)
|
|
|
|
|
|
-func init() {
|
|
|
- rand.Seed(time.Now().Unix())
|
|
|
-}
|
|
|
-
|
|
|
-// RandomString generates a random string with prefix
|
|
|
-func RandomString(prefix string, length int) string {
|
|
|
+func randomString(prefix string, length int) string {
|
|
|
b := make([]rune, length)
|
|
|
for i := range b {
|
|
|
b[i] = letterRunes[rand.Intn(len(letterRunes))]
|
|
|
}
|
|
|
return prefix + string(b)
|
|
|
}
|
|
|
+
|
|
|
+const loginFailedHTML = `
|
|
|
+ <!DOCTYPE html>
|
|
|
+ <html>
|
|
|
+ <head>
|
|
|
+ <meta charset="utf-8" />
|
|
|
+ <title>Login failed</title>
|
|
|
+ </head>
|
|
|
+ <body>
|
|
|
+ <h4>Some failures occurred during the authentication</h4>
|
|
|
+ <p>You can log an issue at <a href="https://github.com/azure/azure-cli/issues">Azure CLI GitHub Repository</a> and we will assist you in resolving it.</p>
|
|
|
+ </body>
|
|
|
+ </html>
|
|
|
+ `
|
|
|
+
|
|
|
+const successfullLoginHTML = `
|
|
|
+ <!DOCTYPE html>
|
|
|
+ <html>
|
|
|
+ <head>
|
|
|
+ <meta charset="utf-8" />
|
|
|
+ <meta http-equiv="refresh" content="10;url=https://docs.microsoft.com/cli/azure/">
|
|
|
+ <title>Login successfully</title>
|
|
|
+ </head>
|
|
|
+ <body>
|
|
|
+ <h4>You have logged into Microsoft Azure!</h4>
|
|
|
+ <p>You can close this window, or we will redirect you to the <a href="https://docs.microsoft.com/cli/azure/">Azure CLI documents</a> in 10 seconds.</p>
|
|
|
+ </body>
|
|
|
+ </html>
|
|
|
+ `
|