mirror of
https://github.com/opentffoundation/opentf.git
synced 2025-12-22 03:07:51 -05:00
95 lines
2.7 KiB
Go
95 lines
2.7 KiB
Go
// Copyright (c) The OpenTofu Authors
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
// Copyright (c) 2023 HashiCorp, Inc.
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
package auth
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
|
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
|
|
"github.com/opentofu/opentofu/internal/httpclient"
|
|
"github.com/opentofu/opentofu/internal/tfdiags"
|
|
)
|
|
|
|
type ClientSecretCredentialAuthConfig struct {
|
|
ClientID string
|
|
ClientIDFilePath string
|
|
ClientSecret string
|
|
ClientSecretFilePath string
|
|
}
|
|
|
|
type clientSecretCredentialAuth struct{}
|
|
|
|
var _ AuthMethod = &clientSecretCredentialAuth{}
|
|
|
|
func (cred *clientSecretCredentialAuth) Name() string {
|
|
return "Client Secret Auth"
|
|
}
|
|
|
|
func (cred *clientSecretCredentialAuth) Construct(ctx context.Context, config *Config) (azcore.TokenCredential, error) {
|
|
client := httpclient.New(ctx)
|
|
clientId, err := consolidateClientId(config)
|
|
if err != nil {
|
|
// This should never happen; this is checked in the Validate function
|
|
return nil, err
|
|
}
|
|
clientSecret, err := consolidateClientSecret(config)
|
|
if err != nil {
|
|
// This should never happen; this is checked in the Validate function
|
|
return nil, err
|
|
}
|
|
|
|
return azidentity.NewClientSecretCredential(
|
|
config.StorageAddresses.TenantID,
|
|
clientId,
|
|
clientSecret,
|
|
&azidentity.ClientSecretCredentialOptions{
|
|
ClientOptions: clientOptions(client, config.CloudConfig),
|
|
},
|
|
)
|
|
}
|
|
|
|
func (cred *clientSecretCredentialAuth) Validate(_ context.Context, config *Config) tfdiags.Diagnostics {
|
|
var diags tfdiags.Diagnostics
|
|
if config.StorageAddresses.TenantID == "" {
|
|
diags = diags.Append(tfdiags.Sourceless(
|
|
tfdiags.Error,
|
|
"Invalid Azure Client Secret Auth",
|
|
"Tenant ID is missing.",
|
|
))
|
|
}
|
|
_, err := consolidateClientId(config)
|
|
if err != nil {
|
|
diags = diags.Append(tfdiags.Sourceless(
|
|
tfdiags.Error,
|
|
"Invalid Azure Client Secret Auth",
|
|
fmt.Sprintf("The Client ID is misconfigured: %s.", tfdiags.FormatError(err)),
|
|
))
|
|
}
|
|
_, err = consolidateClientSecret(config)
|
|
if err != nil {
|
|
diags = diags.Append(tfdiags.Sourceless(
|
|
tfdiags.Error,
|
|
"Invalid Azure Client Secret Auth",
|
|
fmt.Sprintf("The Client Secret is misconfigured: %s.", tfdiags.FormatError(err)),
|
|
))
|
|
}
|
|
return diags
|
|
}
|
|
|
|
func (cred *clientSecretCredentialAuth) AugmentConfig(_ context.Context, config *Config) error {
|
|
return checkNamesForAccessKeyCredentials(config.StorageAddresses)
|
|
}
|
|
|
|
func consolidateClientId(config *Config) (string, error) {
|
|
return consolidateFileAndValue(config.ClientID, config.ClientIDFilePath, "client ID", false)
|
|
}
|
|
|
|
func consolidateClientSecret(config *Config) (string, error) {
|
|
return consolidateFileAndValue(config.ClientSecret, config.ClientSecretFilePath, "client secret", false)
|
|
}
|