ExternalVendorCode/onefuzz
1
0
Fork 0
mirror of https://github.com/microsoft/onefuzz.git synced 2025-06-16 20:08:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix authentication with client secret (#1300)

Browse Source 
* Fix authenticatio
This commit is contained in:
Cheick Keita
2021-09-29 15:56:32 -07:00
committed by GitHub
parent fb29d8946a
commit ddd82f9931
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/cli/onefuzz/backend.py
View File

@ -178,11 +178,14 @@ class Backend:
endpoint = urlparse(self.config.endpoint).netloc.split(".")[0] endpoint = urlparse(self.config.endpoint).netloc.split(".")[0]
scopes = [ scopes = [
f"api://{self.config.tenant_domain}/{endpoint}/.default", f"api://{self.config.tenant_domain}/{endpoint}/.default",
f"https://{self.config.tenant_domain}/{endpoint}/.default", f"https://{self.config.tenant_domain}/{endpoint}/.default", # before 3.0.0 release
] ]
else: else:
netloc = urlparse(self.config.endpoint).netloc netloc = urlparse(self.config.endpoint).netloc
scopes = [f"api://{netloc}/.default", f"https://{netloc}/.default"] scopes = [
f"api://{netloc}/.default",
f"https://{netloc}/.default", # before 3.0.0 release
]
if self.config.client_secret: if self.config.client_secret:
return self.client_secret(scopes) return self.client_secret(scopes)
@ -197,13 +200,16 @@ class Backend:
token_cache=self.token_cache, token_cache=self.token_cache,
) )
# try each scope until we successfully get an access token
for scope in scopes: for scope in scopes:
result = self.app.acquire_token_for_client(scopes=[scope]) result = self.app.acquire_token_for_client(scopes=[scope])
if "error" not in result:
break
# AADSTS500011: The resource principal named ... was not found in the tenant named ... # AADSTS500011: The resource principal named ... was not found in the tenant named ...
# This error is caused by a by mismatch between the identifierUr and the scope provided in the request. # This error is caused by a by mismatch between the identifierUr and the scope provided in the request.
if "error" in result and "AADSTS500011" in result["error_description"]: if "AADSTS500011" in result["error_description"]:
LOGGER.warning(f"failed to get access token with scope {scope}") LOGGER.warning(f"failed to get access token with scope {scope}")
continue
if "error" in result: if "error" in result:
raise Exception( raise Exception(