Search in sources :

Example 1 with AzureCredentials

use of com.microsoft.azure.util.AzureCredentials in project azure-credentials-plugin by jenkinsci.

the class KeyVaultIntegrationTestBase method setUp.

@Before
public void setUp() throws InterruptedException {
    // Create Azure KeyVault
    final AzureResourceManager azureClient = IntegrationTestBase.getAzureClient();
    vaultName = "tst-vault-" + TestEnvironment.GenerateRandomString(5);
    final Vault vault = azureClient.vaults().define(vaultName).withRegion(testEnv.region).withNewResourceGroup(testEnv.resourceGroup).defineAccessPolicy().forServicePrincipal(testEnv.clientId).allowSecretAllPermissions().attach().create();
    vaultUri = vault.vaultUri();
    waitForKeyVaultAvailable();
    // Create Jenkins Azure Credentials
    final AzureCredentials credentials = new AzureCredentials(CredentialsScope.SYSTEM, jenkinsAzureCredentialsId, "", testEnv.subscriptionId, testEnv.clientId, Secret.fromString(testEnv.clientSecret));
    credentials.setTenant(testEnv.tenantId);
    final CredentialsStore store = CredentialsProvider.lookupStores(j.jenkins).iterator().next();
    try {
        store.addCredentials(Domain.global(), credentials);
    } catch (IOException e) {
        Assert.fail(e.getMessage());
    }
}
Also used : AzureCredentials(com.microsoft.azure.util.AzureCredentials) CredentialsStore(com.cloudbees.plugins.credentials.CredentialsStore) Vault(com.azure.resourcemanager.keyvault.models.Vault) IOException(java.io.IOException) AzureResourceManager(com.azure.resourcemanager.AzureResourceManager) Before(org.junit.Before)

Example 2 with AzureCredentials

use of com.microsoft.azure.util.AzureCredentials in project azure-keyvault-plugin by jenkinsci.

the class AzureKeyVaultGlobalConfigurationSystemPropertySPTest method testValuesSet.

@Test
public void testValuesSet() {
    AzureKeyVaultGlobalConfiguration configuration = AzureKeyVaultGlobalConfiguration.get();
    assertThat(configuration.getCredentialID(), is(AzureKeyVaultGlobalConfiguration.GENERATED_ID));
    assertThat(configuration.getKeyVaultURL(), is("https://mine.vault.azure.net"));
    Credentials credentials = SystemCredentialsProvider.getInstance().getCredentials().get(0);
    assertThat(credentials, instanceOf(AzureCredentials.class));
    AzureCredentials azureCredentials = (AzureCredentials) credentials;
    assertThat(azureCredentials.getClientId(), is("1234"));
    assertThat(azureCredentials.getPlainClientSecret(), is("1255534"));
    assertThat(azureCredentials.getSubscriptionId(), is("5678"));
    assertThat(azureCredentials.getTenant(), is("tenant_id"));
    // Test updating value
    System.setProperty("jenkins.azure-keyvault.url", "https://mine2.vault.azure.net");
    System.setProperty("jenkins.azure-keyvault.sp.client_id", "5678");
    System.setProperty("jenkins.azure-keyvault.sp.client_secret", "99999");
    System.setProperty("jenkins.azure-keyvault.sp.subscription_id", "9999");
    System.setProperty("jenkins.azure-keyvault.sp.tenant_id", "11111");
    configuration = AzureKeyVaultGlobalConfiguration.get();
    assertThat(configuration.getCredentialID(), is(AzureKeyVaultGlobalConfiguration.GENERATED_ID));
    assertThat(configuration.getKeyVaultURL(), is("https://mine2.vault.azure.net"));
    List<Credentials> credentialsList = SystemCredentialsProvider.getInstance().getCredentials();
    assertThat(credentialsList.size(), is(1));
    AzureCredentials azureCredentialsUpdated = (AzureCredentials) credentialsList.get(0);
    assertThat(azureCredentialsUpdated.getClientId(), is("5678"));
    assertThat(azureCredentialsUpdated.getPlainClientSecret(), is("99999"));
    assertThat(azureCredentialsUpdated.getSubscriptionId(), is("9999"));
    assertThat(azureCredentialsUpdated.getTenant(), is("11111"));
}
Also used : AzureCredentials(com.microsoft.azure.util.AzureCredentials) Credentials(com.cloudbees.plugins.credentials.Credentials) AzureCredentials(com.microsoft.azure.util.AzureCredentials) AzureImdsCredentials(com.microsoft.azure.util.AzureImdsCredentials) Test(org.junit.Test)

Example 3 with AzureCredentials

use of com.microsoft.azure.util.AzureCredentials in project azure-keyvault-plugin by jenkinsci.

the class AzureKeyVaultGlobalConfigurationSystemPropertySPTest method testChangingFromSptoUami.

@Test
public void testChangingFromSptoUami() {
    AzureKeyVaultGlobalConfiguration configuration = AzureKeyVaultGlobalConfiguration.get();
    assertThat(configuration.getCredentialID(), is(AzureKeyVaultGlobalConfiguration.GENERATED_ID));
    assertThat(configuration.getKeyVaultURL(), is("https://mine.vault.azure.net"));
    Credentials credentials = SystemCredentialsProvider.getInstance().getCredentials().get(0);
    assertThat(credentials, instanceOf(AzureCredentials.class));
    AzureCredentials azureCredentials = (AzureCredentials) credentials;
    assertThat(azureCredentials.getClientId(), is("1234"));
    assertThat(azureCredentials.getPlainClientSecret(), is("1255534"));
    assertThat(azureCredentials.getSubscriptionId(), is("5678"));
    assertThat(azureCredentials.getTenant(), is("tenant_id"));
    System.setProperty("jenkins.azure-keyvault.uami.enabled", "true");
    assertThat(configuration.getCredentialID(), is(AzureKeyVaultGlobalConfiguration.GENERATED_ID));
    credentials = SystemCredentialsProvider.getInstance().getCredentials().get(0);
    assertThat(credentials, instanceOf(AzureImdsCredentials.class));
}
Also used : AzureCredentials(com.microsoft.azure.util.AzureCredentials) AzureImdsCredentials(com.microsoft.azure.util.AzureImdsCredentials) Credentials(com.cloudbees.plugins.credentials.Credentials) AzureCredentials(com.microsoft.azure.util.AzureCredentials) AzureImdsCredentials(com.microsoft.azure.util.AzureImdsCredentials) Test(org.junit.Test)

Example 4 with AzureCredentials

use of com.microsoft.azure.util.AzureCredentials in project azure-keyvault-plugin by jenkinsci.

the class AzureKeyVaultGlobalConfiguration method resolveCredentialIdFromEnvironment.

private Optional<String> resolveCredentialIdFromEnvironment() {
    // directly lookup the credential so that we don't get a stackoverflow due to credential provider
    Optional<Credentials> optionalCredentials = SystemCredentialsProvider.getInstance().getCredentials().stream().filter(credentials -> (credentials instanceof AzureCredentials || credentials instanceof AzureImdsCredentials) && ((IdCredentials) credentials).getId().equals(GENERATED_ID)).findAny();
    String uami = getPropertyByEnvOrSystemProperty("AZURE_KEYVAULT_UAMI_ENABLED", "jenkins.azure-keyvault.uami.enabled").orElse("false");
    AzureBaseCredentials credentials;
    if (uami.equals("true")) {
        if (optionalCredentials.isPresent() && optionalCredentials.get() instanceof AzureImdsCredentials) {
            // don't overwrite the credential if it matches what we currently have so as we don't save to disk all the time
            return Optional.empty();
        }
        credentials = new AzureImdsCredentials(CredentialsScope.GLOBAL, GENERATED_ID, GENERATED_DESCRIPTION);
        storeCredential(credentials);
        return Optional.of(credentials.getId());
    }
    String clientId = getPropertyByEnvOrSystemProperty("AZURE_KEYVAULT_SP_CLIENT_ID", "jenkins.azure-keyvault.sp.client_id").orElse("false");
    if (clientId.equals("false")) {
        return Optional.empty();
    }
    String clientSecret = getPropertyByEnvOrSystemProperty("AZURE_KEYVAULT_SP_CLIENT_SECRET", "jenkins.azure-keyvault.sp.client_secret").orElseThrow(IllegalArgumentException::new);
    String subscriptionId = getPropertyByEnvOrSystemProperty("AZURE_KEYVAULT_SP_SUBSCRIPTION_ID", "jenkins.azure-keyvault.sp.subscription_id").orElseThrow(IllegalArgumentException::new);
    String tenantId = getPropertyByEnvOrSystemProperty("AZURE_KEYVAULT_SP_TENANT_ID", "jenkins.azure-keyvault.sp.tenant_id").orElseThrow(IllegalArgumentException::new);
    if (optionalCredentials.isPresent() && optionalCredentials.get() instanceof AzureCredentials && azureCredentialIsEqual((AzureCredentials) optionalCredentials.get(), clientId, clientSecret, subscriptionId, tenantId)) {
        // don't overwrite the credential if it matches what we currently have so as we don't save to disk all the time
        return Optional.empty();
    }
    AzureCredentials azureCredentials = new AzureCredentials(CredentialsScope.GLOBAL, GENERATED_ID, GENERATED_DESCRIPTION, subscriptionId, clientId, clientSecret);
    azureCredentials.setTenant(tenantId);
    storeCredential(azureCredentials);
    return Optional.of(azureCredentials.getId());
}
Also used : Credentials(com.cloudbees.plugins.credentials.Credentials) IdCredentials(com.cloudbees.plugins.credentials.common.IdCredentials) SystemCredentialsProvider(com.cloudbees.plugins.credentials.SystemCredentialsProvider) QueryParameter(org.kohsuke.stapler.QueryParameter) AzureBaseCredentials(com.microsoft.azure.util.AzureBaseCredentials) SecretClientCache(com.microsoft.jenkins.keyvault.SecretClientCache) StringUtils(org.apache.commons.lang3.StringUtils) Symbol(org.jenkinsci.Symbol) Level(java.util.logging.Level) AncestorInPath(org.kohsuke.stapler.AncestorInPath) Item(hudson.model.Item) Extension(hudson.Extension) SecretClient(com.azure.security.keyvault.secrets.SecretClient) CredentialsScope(com.cloudbees.plugins.credentials.CredentialsScope) GlobalConfiguration(jenkins.model.GlobalConfiguration) ListBoxModel(hudson.util.ListBoxModel) FormValidation(hudson.util.FormValidation) Jenkins(jenkins.model.Jenkins) DataBoundSetter(org.kohsuke.stapler.DataBoundSetter) IOException(java.io.IOException) Logger(java.util.logging.Logger) AzureCredentials(com.microsoft.azure.util.AzureCredentials) POST(org.kohsuke.stapler.verb.POST) AzureImdsCredentials(com.microsoft.azure.util.AzureImdsCredentials) Optional(java.util.Optional) ExtensionList(hudson.ExtensionList) AzureCredentials(com.microsoft.azure.util.AzureCredentials) IdCredentials(com.cloudbees.plugins.credentials.common.IdCredentials) AzureBaseCredentials(com.microsoft.azure.util.AzureBaseCredentials) AzureImdsCredentials(com.microsoft.azure.util.AzureImdsCredentials) Credentials(com.cloudbees.plugins.credentials.Credentials) IdCredentials(com.cloudbees.plugins.credentials.common.IdCredentials) AzureBaseCredentials(com.microsoft.azure.util.AzureBaseCredentials) AzureCredentials(com.microsoft.azure.util.AzureCredentials) AzureImdsCredentials(com.microsoft.azure.util.AzureImdsCredentials)

Example 5 with AzureCredentials

use of com.microsoft.azure.util.AzureCredentials in project azure-keyvault-plugin by jenkinsci.

the class AzureKeyVaultCredentialRetriever method getCredentialById.

@CheckForNull
public static TokenCredential getCredentialById(String credentialID, Run<?, ?> build) {
    TokenCredential credential;
    AzureBaseCredentials cred = CredentialsProvider.findCredentialById(credentialID, AzureBaseCredentials.class, build);
    if (cred == null) {
        throw new AzureKeyVaultException(String.format("Credential: %s was not found", credentialID));
    }
    if (cred instanceof AzureCredentials) {
        LOGGER.log(Level.FINE, format("Fetched %s as AzureCredentials", credentialID));
        CredentialsProvider.track(build, cred);
        AzureCredentials azureCredentials = (AzureCredentials) cred;
        credential = new ClientSecretCredentialBuilder().clientId(azureCredentials.getClientId()).clientSecret(azureCredentials.getPlainClientSecret()).httpClient(HttpClientRetriever.get()).tenantId(azureCredentials.getTenant()).build();
    } else if (cred instanceof AzureImdsCredentials) {
        credential = new ManagedIdentityCredentialBuilder().build();
    } else {
        throw new AzureKeyVaultException("Could not determine the type for Secret id " + credentialID + " only 'Azure Service Principal' and 'Azure Managed Identity' are supported");
    }
    return credential;
}
Also used : AzureCredentials(com.microsoft.azure.util.AzureCredentials) ClientSecretCredentialBuilder(com.azure.identity.ClientSecretCredentialBuilder) AzureBaseCredentials(com.microsoft.azure.util.AzureBaseCredentials) AzureImdsCredentials(com.microsoft.azure.util.AzureImdsCredentials) TokenCredential(com.azure.core.credential.TokenCredential) ManagedIdentityCredentialBuilder(com.azure.identity.ManagedIdentityCredentialBuilder) CheckForNull(javax.annotation.CheckForNull)

Aggregations

AzureCredentials (com.microsoft.azure.util.AzureCredentials)7 Credentials (com.cloudbees.plugins.credentials.Credentials)5 AzureImdsCredentials (com.microsoft.azure.util.AzureImdsCredentials)4 Test (org.junit.Test)3 AzureBaseCredentials (com.microsoft.azure.util.AzureBaseCredentials)2 IOException (java.io.IOException)2 TokenCredential (com.azure.core.credential.TokenCredential)1 ClientSecretCredentialBuilder (com.azure.identity.ClientSecretCredentialBuilder)1 ManagedIdentityCredentialBuilder (com.azure.identity.ManagedIdentityCredentialBuilder)1 AzureResourceManager (com.azure.resourcemanager.AzureResourceManager)1 Vault (com.azure.resourcemanager.keyvault.models.Vault)1 SecretClient (com.azure.security.keyvault.secrets.SecretClient)1 CredentialsScope (com.cloudbees.plugins.credentials.CredentialsScope)1 CredentialsStore (com.cloudbees.plugins.credentials.CredentialsStore)1 SystemCredentialsProvider (com.cloudbees.plugins.credentials.SystemCredentialsProvider)1 IdCredentials (com.cloudbees.plugins.credentials.common.IdCredentials)1 StandardUsernamePasswordCredentials (com.cloudbees.plugins.credentials.common.StandardUsernamePasswordCredentials)1 Domain (com.cloudbees.plugins.credentials.domains.Domain)1 SecretClientCache (com.microsoft.jenkins.keyvault.SecretClientCache)1 Extension (hudson.Extension)1