116 строки
4.1 KiB
Go
116 строки
4.1 KiB
Go
//go:build go1.18 && (darwin || linux || windows)
|
|
|
|
// Copyright (c) Microsoft Corporation. All rights reserved.
|
|
// Licensed under the MIT License.
|
|
|
|
// the test in this file must be defined in azidentity_test because it imports azidentity/cache
|
|
|
|
package azidentity_test
|
|
|
|
import (
|
|
"context"
|
|
"os"
|
|
"runtime"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
|
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
|
|
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
|
|
"github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache"
|
|
"github.com/Azure/azure-sdk-for-go/sdk/internal/recording"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
var ctx = context.Background()
|
|
|
|
func TestPersistentCacheLive(t *testing.T) {
|
|
if recording.GetRecordMode() != recording.LiveMode {
|
|
t.Skip("this test runs only in live mode")
|
|
}
|
|
if runtime.GOOS == "darwin" && os.Getenv("AZIDENTITY_RUN_MANUAL_TESTS") == "" {
|
|
t.Skip("set AZIDENTITY_RUN_MANUAL_TESTS to run this test on macOS")
|
|
}
|
|
armURL := os.Getenv("RESOURCE_MANAGER_URL")
|
|
if armURL == "" {
|
|
t.Skip("set RESOURCE_MANAGER_URL to run this test")
|
|
}
|
|
tro := policy.TokenRequestOptions{Scopes: []string{armURL + "/.default"}}
|
|
for _, test := range []struct {
|
|
credential func(*testing.T, azidentity.AuthenticationRecord, azidentity.Cache) (azcore.TokenCredential, error)
|
|
name string
|
|
}{
|
|
{
|
|
credential: func(t *testing.T, _ azidentity.AuthenticationRecord, c azidentity.Cache) (azcore.TokenCredential, error) {
|
|
t.Skip("https://github.com/Azure/azure-sdk-for-go/issues/22879")
|
|
clientID := os.Getenv("IDENTITY_SP_CLIENT_ID")
|
|
secret := os.Getenv("IDENTITY_SP_CLIENT_SECRET")
|
|
tenantID := os.Getenv("IDENTITY_SP_TENANT_ID")
|
|
if clientID == "" || secret == "" || tenantID == "" {
|
|
t.Skip("set IDENTITY_SP_* with service principal configuration to run this test")
|
|
}
|
|
return azidentity.NewClientSecretCredential(tenantID, clientID, secret,
|
|
&azidentity.ClientSecretCredentialOptions{Cache: c},
|
|
)
|
|
},
|
|
name: "confidential",
|
|
},
|
|
{
|
|
credential: func(t *testing.T, r azidentity.AuthenticationRecord, c azidentity.Cache) (azcore.TokenCredential, error) {
|
|
clientID := "04b07795-8ddb-461a-bbee-02f9e1bf7b46"
|
|
password := os.Getenv("AZURE_IDENTITY_TEST_PASSWORD")
|
|
tenantID := os.Getenv("AZURE_IDENTITY_TEST_TENANTID")
|
|
username := os.Getenv("AZURE_IDENTITY_TEST_USERNAME")
|
|
if password == "" || tenantID == "" || username == "" {
|
|
t.Skip("set AZURE_IDENTITY_TEST_* with user configuration to run this test")
|
|
}
|
|
return azidentity.NewUsernamePasswordCredential(tenantID, clientID, username, password,
|
|
&azidentity.UsernamePasswordCredentialOptions{
|
|
AuthenticationRecord: r,
|
|
Cache: c,
|
|
},
|
|
)
|
|
},
|
|
name: "public",
|
|
},
|
|
} {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
c, err := cache.New(&cache.Options{Name: strings.ReplaceAll(t.Name(), "/", "_")})
|
|
require.NoError(t, err)
|
|
|
|
rec := azidentity.AuthenticationRecord{}
|
|
cred, err := test.credential(t, rec, c)
|
|
require.NoError(t, err)
|
|
if test.name == "public" {
|
|
type authenticater interface {
|
|
Authenticate(context.Context, *policy.TokenRequestOptions) (azidentity.AuthenticationRecord, error)
|
|
}
|
|
a, ok := cred.(authenticater)
|
|
require.True(t, ok, "test bug: public credential must implement Authenticate")
|
|
rec, err = a.Authenticate(ctx, &tro)
|
|
require.NoError(t, err)
|
|
}
|
|
tk, err := cred.GetToken(ctx, tro)
|
|
require.NoError(t, err)
|
|
|
|
cred2, err := test.credential(t, rec, c)
|
|
require.NoError(t, err)
|
|
tk2, err := cred2.GetToken(ctx, tro)
|
|
require.NoError(t, err)
|
|
// require.Equal is more to the point but prints a value i.e. logs a token when expected != actual
|
|
require.True(t, tk.Token == tk2.Token, "expected a cached token")
|
|
|
|
caeTRO := tro
|
|
caeTRO.EnableCAE = true
|
|
tk3, err := cred.GetToken(ctx, caeTRO)
|
|
require.NoError(t, err)
|
|
require.False(t, tk.Token == tk3.Token, "expected a new token because the cached one isn't a CAE token")
|
|
|
|
tk4, err := cred2.GetToken(ctx, caeTRO)
|
|
require.NoError(t, err)
|
|
require.True(t, tk3.Token == tk4.Token, "expected a cached token")
|
|
require.False(t, tk.Token == tk4.Token, "expected a CAE token")
|
|
})
|
|
}
|
|
}
|