If the AppSourceContext doesn't contain a clientSecret, then we assume
that federated credentials have been assigned and are available, so we
will try to get an ID_TOKEN and use clientAssertion instead
Same with other Auth Context's - if they contain a clientId and no
clientSecret, we will use clientAssertion instead.
Azure_Credentials also supports app registrations or managed identities
with federated credentials if it contains a clientId without a
clientSecret
Here are the supported formats for the various auth contexts:
## STORAGECONTEXT (for deliver to storage)
**Managed Identity/Federated credential**
`{"storageAccountName":"storageaccountname","clientId":"08b6d80c-68cf-48f9-a5ff-b054326e2ec3","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","containerName":"{project}","blobName":"{version}/{project}-{type}.zip"}`
**App Registration/Federated credential**
`{"storageAccountName":"storageaccountname","clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","containerName":"{project}","blobName":"{version}/{project}-{type}.zip"}`
**App Registration/Client Secret**
`{"storageAccountName":"storageaccountname","clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","clientSecret":"OPXxxxxxxxxxxxxxxxxxxxxxxabge","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","containerName":"{project}","blobName":"{version}/{project}-{type}.zip"}`
**storageAccountName/sastoken**
`{"storageAccountName":"storageaccountname","sastoken":"sv=2022-11-02&ss=b&srt=sco&sp=rwdlaciytf&se=2024-08-06T20:22:08Z&st=2024-04-06T12:22:08Z&spr=https&sig=IZyIf5xxxxxxxxxxxxxxb5I%3D","containerName":"{project}","blobName":"{version}/{project}-{type}.zip"}`
**storageAccountName/storageAccountKey**
`{"storageAccountName":"storageaccountname","storageAccountKey":"JHFZErCyxxxxxxxxxxxxxxxxXQ==","containerName":"{project}","blobName":"{version}/{project}-{type}.zip"}`
## AZURE_CREDENTIALS (connection to Azure for secrets and signing)
**Access Configuration = Azure role-based access control**
```
Access Control:
Action Role
Read secrets Key Vault Secrets User
Sign Apps Key Vault Crypto User + Key Vault Certificate User
```
**Access Configuration = Vault Access Policy**
```
Action Permissions:
Read secrets Secret permissions: Get, List
Sign apps Cryptographic Operations: Sign + Certificate permissions: Get
```
**Managed Identity/Federated credential**
`{"keyVaultName":"BuildVariables","clientId":"55ce849b-c99d-484c-8999-df9f8df958bd","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47"}`
**App Registration/Federated credential**
`{"keyVaultName":"BuildVariables","clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47"}`
**App Registration/Client Secret**
`{"keyVaultName":"BuildVariables","clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","clientSecret":"OPXxxxxxxxxxxxxxxxxxxxxxxabge","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47"}`
## APPSOURCECONTEXT (for deliver to AppSource)
**Managed identity not possible - as this is not an Azure resource**
**App Registration/Federated credential**
`{"clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","Scopes":"https://api.partner.microsoft.com/.default"}`
**App Registration/Client Secret**
`{"clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","clientSecret":"OPXxxxxxxxxxxxxxxxxxxxxxxabge","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","Scopes":"https://api.partner.microsoft.com/.default"}`
## AUTHCONTEXT (for deploy to Business Central)
**Managed identity not possible - as this is not an Azure resource**
**Impersonation/RefreshToken**
`{"TenantID":"69cb4a05-4ea8-482d-9f33-10fb5cf7db05","Scopes":"https://api.businesscentral.dynamics.com/","RefreshToken":"0.AUUAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_s6Eo4YOI","ClientID":"1950a258-227b-4e31-a9cf-717495945fc2"}`
**App Registration/Federated credential**
`{"TenantID":"69cb4a05-4ea8-482d-9f33-10fb5cf7db05","Scopes":"https://api.businesscentral.dynamics.com/","ClientID":"a26651f5-0e90-473c-b4f9-e96119aac8b8"}`
**App Registration/Client Secret**
`{"TenantID":"69cb4a05-4ea8-482d-9f33-10fb5cf7db05","Scopes":"https://api.businesscentral.dynamics.com/","ClientID":"a26651f5-0e90-473c-b4f9-e96119aac8b8","ClientSecret":"OPXxxxxxxxxxxxxxxxxxxxxxxabge"}`
TODOs
- [x] Add documentation in codesigning.md (rbac)
- [x] Add documentation for appSourceContext federated credentials
- [x] Add documentation for other auth contexts
- [x] Add aka.ms/algosecrets#secretname
- [x] Add End 2 End test testing all these auth methods
This PR also switches to always use the Az PowerShell module (instead of
the deprecated AzureRM PowerShell module installed on GitHub Hosted
Windows runners)
Fixes#947
---------
Co-authored-by: freddydk <freddydk@users.noreply.github.com>
Co-authored-by: Maria Zhelezova <43066499+mazhelez@users.noreply.github.com>
Co-authored-by: Alexander Holstrup <117829001+aholstrup1@users.noreply.github.com>
- Remove @microsoft/dynamics-smb-developertools as the group isn't
public
- Remove @freddydk as the account is part of
@microsoft/dynamics-smb-engineering-systems
Freddy Kristiansen
Maria Zhelezova
freddydk