11import * as taskLib from 'azure-pipelines-task-lib/task' ;
22import * as fs from 'fs' ;
33import * as path from 'path' ;
4+ import { getSystemAccessToken } from 'azure-pipelines-tasks-artifacts-common/webapi' ;
5+ import { getHandlerFromToken , WebApi } from "azure-devops-node-api" ;
6+ import { ITaskApi } from "azure-devops-node-api/TaskApi" ;
47
5- export async function getVaultCredentials ( ) : Promise < { [ key : string ] : string } > {
8+ export async function getVaultCredentials ( ) : Promise < [ { [ key : string ] : string } , String ] > {
69 let connectedService = taskLib . getInput ( "azurekvServiceConection" , true ) ;
710 if ( ! connectedService ) {
811 console . log ( taskLib . loc ( 'NoServiceConnection' ) ) ;
9- return { } ;
12+ return [ { } , "" ] ;
1013 }
14+
1115 var authScheme = taskLib . getEndpointAuthorizationScheme ( connectedService , true ) ;
1216 if ( ! authScheme ) {
1317 console . log ( taskLib . loc ( 'NoAuthScheme' ) ) ;
14- return { } ;
18+ return [ { } , "" ] ;
1519 }
1620
1721 let envVariables = { } ;
22+ let credentialType = "" ;
1823 switch ( authScheme . toLocaleLowerCase ( ) ) {
1924 case "managedserviceidentity" :
2025 // azure key vault plugin will automatially try managed idenitty
21- console . log ( taskLib . loc ( 'UseManagedIdentity' ) ) ;
26+ console . log ( taskLib . loc ( 'UseAuthenticationMethod' , 'Managed Identity' ) ) ;
27+ credentialType = "managedid" ;
2228 break ;
2329 case "serviceprincipal" :
30+ console . log ( taskLib . loc ( 'UseAuthenticationMethod' , 'Service Principal' ) ) ;
2431 let authType = taskLib . getEndpointAuthorizationParameter ( connectedService , 'authenticationType' , true ) ;
2532 let cliPassword : string | undefined = "" ;
2633 var servicePrincipalId = taskLib . getEndpointAuthorizationParameter ( connectedService , "serviceprincipalid" , false ) ;
2734 var tenantId = taskLib . getEndpointAuthorizationParameter ( connectedService , "tenantid" , false ) ;
28-
2935 if ( authType == "spnCertificate" ) {
3036 taskLib . debug ( 'certificate based endpoint' ) ;
3137 let certificateContent = taskLib . getEndpointAuthorizationParameter ( connectedService , "servicePrincipalCertificate" , false ) ?? '' ;
@@ -50,9 +56,76 @@ export async function getVaultCredentials(): Promise<{ [key: string]: string }>
5056 "AZURE_CLIENT_SECRET" : cliPassword ,
5157 }
5258 }
59+ credentialType = "environment"
60+ break ;
61+ case "workloadidentityfederation" :
62+ console . log ( taskLib . loc ( 'UseAuthenticationMethod' , 'Workload Identity Federation' ) ) ;
63+ var servicePrincipalId = taskLib . getEndpointAuthorizationParameter ( connectedService , "serviceprincipalid" , false ) ;
64+ var tenantId = taskLib . getEndpointAuthorizationParameter ( connectedService , "tenantid" , false ) ;
65+ const federatedToken = await getWorkloadIdToken ( connectedService ) ;
66+ const extractPath = taskLib . getVariable ( 'Agent.TempDirectory' ) ;
67+ if ( ! extractPath ) {
68+ throw new Error ( taskLib . loc ( 'TempDirectoryNotSet' ) ) ;
69+ }
70+
71+ const tokenFile = path . join ( extractPath , 'oidcToken' ) ;
72+ fs . writeFileSync ( tokenFile , federatedToken ) ;
73+ envVariables = {
74+ "AZURE_TENANT_ID" : tenantId ,
75+ "AZURE_CLIENT_ID" : servicePrincipalId ,
76+ "AZURE_FEDERATED_TOKEN_FILE" : tokenFile ,
77+ }
78+ credentialType = "workloadid"
5379 break ;
5480 default :
5581 throw new Error ( taskLib . loc ( 'UnsupportedAuthScheme' , authScheme ) ) ;
5682 }
57- return envVariables ;
83+
84+ return [ envVariables , credentialType ] ;
5885}
86+
87+ async function getWorkloadIdToken ( connectedService : string ) : Promise < string > {
88+ const jobId = taskLib . getVariable ( "System.JobId" ) ;
89+ if ( ! jobId ) {
90+ throw new Error ( taskLib . loc ( 'FailedToGetWorkloadIdToken' , 'JobId not set' ) ) ;
91+ }
92+
93+ const planId = taskLib . getVariable ( "System.PlanId" ) ;
94+ if ( ! planId ) {
95+ throw new Error ( taskLib . loc ( 'FailedToGetWorkloadIdToken' , 'PlanId not set' ) ) ;
96+ }
97+
98+ const projectId = taskLib . getVariable ( "System.TeamProjectId" ) ;
99+ if ( ! projectId ) {
100+ throw new Error ( taskLib . loc ( 'FailedToGetWorkloadIdToken' , 'ProjectId not set' ) ) ;
101+ }
102+
103+ const hub = taskLib . getVariable ( "System.HostType" ) ;
104+ if ( ! hub ) {
105+ throw new Error ( taskLib . loc ( 'FailedToGetWorkloadIdToken' , 'Hub not set' ) ) ;
106+ }
107+
108+ const uri = taskLib . getVariable ( "System.CollectionUri" ) ;
109+ if ( ! uri ) {
110+ throw new Error ( taskLib . loc ( 'FailedToGetWorkloadIdToken' , 'CollectionUri not set' ) ) ;
111+ }
112+
113+ const token = getSystemAccessToken ( ) ;
114+ if ( ! token ) {
115+ throw new Error ( taskLib . loc ( 'FailedToGetWorkloadIdToken' , 'Token not set' ) ) ;
116+ }
117+
118+ const authHandler = getHandlerFromToken ( token ) ;
119+ const connection = new WebApi ( uri , authHandler ) ;
120+ const api : ITaskApi = await connection . getTaskApi ( ) ;
121+ const response = await api . createOidcToken ( { } , projectId , hub , planId , jobId , connectedService ) ;
122+ if ( response == null ) {
123+ throw new Error ( taskLib . loc ( 'FailedToGetWorkloadIdToken' , 'Response is null' ) ) ;
124+ }
125+
126+ if ( ! response . oidcToken ) {
127+ throw new Error ( taskLib . loc ( 'FailedToGetWorkloadIdToken' , 'Token not set' ) ) ;
128+ }
129+
130+ return response . oidcToken ;
131+ }
0 commit comments