AL-Go/CODEOWNERS

# These owners will be the default owners for everything in the repo.
* @microsoft/d365-bc-engineering-systems
Federated credentials (#1094) If the AppSourceContext doesn't contain a clientSecret, then we assume that federated credentials have been assigned and are available, so we will try to get an ID_TOKEN and use clientAssertion instead Same with other Auth Context's - if they contain a clientId and no clientSecret, we will use clientAssertion instead. Azure_Credentials also supports app registrations or managed identities with federated credentials if it contains a clientId without a clientSecret Here are the supported formats for the various auth contexts: ## STORAGECONTEXT (for deliver to storage) Managed Identity/Federated credential `{"storageAccountName":"storageaccountname","clientId":"08b6d80c-68cf-48f9-a5ff-b054326e2ec3","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","containerName":"{project}","blobName":"{version}/{project}-{type}.zip"}` App Registration/Federated credential `{"storageAccountName":"storageaccountname","clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","containerName":"{project}","blobName":"{version}/{project}-{type}.zip"}` App Registration/Client Secret `{"storageAccountName":"storageaccountname","clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","clientSecret":"OPXxxxxxxxxxxxxxxxxxxxxxxabge","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","containerName":"{project}","blobName":"{version}/{project}-{type}.zip"}` storageAccountName/sastoken `{"storageAccountName":"storageaccountname","sastoken":"sv=2022-11-02&ss=b&srt=sco&sp=rwdlaciytf&se=2024-08-06T20:22:08Z&st=2024-04-06T12:22:08Z&spr=https&sig=IZyIf5xxxxxxxxxxxxxxb5I%3D","containerName":"{project}","blobName":"{version}/{project}-{type}.zip"}` storageAccountName/storageAccountKey `{"storageAccountName":"storageaccountname","storageAccountKey":"JHFZErCyxxxxxxxxxxxxxxxxXQ==","containerName":"{project}","blobName":"{version}/{project}-{type}.zip"}` ## AZURE_CREDENTIALS (connection to Azure for secrets and signing) Access Configuration = Azure role-based access control ``` Access Control: Action Role Read secrets Key Vault Secrets User Sign Apps Key Vault Crypto User + Key Vault Certificate User ``` Access Configuration = Vault Access Policy ``` Action Permissions: Read secrets Secret permissions: Get, List Sign apps Cryptographic Operations: Sign + Certificate permissions: Get ``` Managed Identity/Federated credential `{"keyVaultName":"BuildVariables","clientId":"55ce849b-c99d-484c-8999-df9f8df958bd","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47"}` App Registration/Federated credential `{"keyVaultName":"BuildVariables","clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47"}` App Registration/Client Secret `{"keyVaultName":"BuildVariables","clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","clientSecret":"OPXxxxxxxxxxxxxxxxxxxxxxxabge","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47"}` ## APPSOURCECONTEXT (for deliver to AppSource) Managed identity not possible - as this is not an Azure resource App Registration/Federated credential `{"clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","Scopes":"https://api.partner.microsoft.com/.default"}` App Registration/Client Secret `{"clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","clientSecret":"OPXxxxxxxxxxxxxxxxxxxxxxxabge","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","Scopes":"https://api.partner.microsoft.com/.default"}` ## AUTHCONTEXT (for deploy to Business Central) Managed identity not possible - as this is not an Azure resource Impersonation/RefreshToken `{"TenantID":"69cb4a05-4ea8-482d-9f33-10fb5cf7db05","Scopes":"https://api.businesscentral.dynamics.com/","RefreshToken":"0.AUUAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_s6Eo4YOI","ClientID":"1950a258-227b-4e31-a9cf-717495945fc2"}` App Registration/Federated credential `{"TenantID":"69cb4a05-4ea8-482d-9f33-10fb5cf7db05","Scopes":"https://api.businesscentral.dynamics.com/","ClientID":"a26651f5-0e90-473c-b4f9-e96119aac8b8"}` App Registration/Client Secret `{"TenantID":"69cb4a05-4ea8-482d-9f33-10fb5cf7db05","Scopes":"https://api.businesscentral.dynamics.com/","ClientID":"a26651f5-0e90-473c-b4f9-e96119aac8b8","ClientSecret":"OPXxxxxxxxxxxxxxxxxxxxxxxabge"}` TODOs - [x] Add documentation in codesigning.md (rbac) - [x] Add documentation for appSourceContext federated credentials - [x] Add documentation for other auth contexts - [x] Add aka.ms/algosecrets#secretname - [x] Add End 2 End test testing all these auth methods This PR also switches to always use the Az PowerShell module (instead of the deprecated AzureRM PowerShell module installed on GitHub Hosted Windows runners) Fixes #947 --------- Co-authored-by: freddydk <freddydk@users.noreply.github.com> Co-authored-by: Maria Zhelezova <43066499+mazhelez@users.noreply.github.com> Co-authored-by: Alexander Holstrup <117829001+aholstrup1@users.noreply.github.com> 2024-06-25 16:47:20 +03:00			`# These owners will be the default owners for everything in the repo.`
			`* @microsoft/d365-bc-engineering-systems`