Skip to content

Commit bc1fac3

Browse files
msJinLeimsJinLei
msJinLei
authored and
msJinLei
committed
Enable AzKeyStore with keyring in Linux (#20296)
* Enable AzKeystore with keyring in Linux * Update common library version. * Upgraded reference of azure-powershell-common to 1.3.67-preview Co-authored-by: Vincent Dai <[email protected]> Co-authored-by: NanxiangLiu <[email protected]> Fix AzKeystore bugs Fix the issue that secret cannot be retrived in headless linux Use the seperated file names for protected and unprotected AzKeystore Optimize the warning message for customers
1 parent e4591aa commit bc1fac3

File tree

13 files changed

+78
-44
lines changed

13 files changed

+78
-44
lines changed

‎src/Accounts/Accounts.Test/AutosaveTests.cs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ public AutosaveTests(ITestOutputHelper output)
4141
XunitTracingInterceptor.AddToContext(new XunitTracingInterceptor(output));
4242
commandRuntimeMock = new MockCommandRuntime();
4343
dataStore = new MemoryDataStore();
44+
ResetState();
4445
keyStore = SetMockedAzKeyStore();
4546
}
4647

@@ -50,7 +51,7 @@ private AzKeyStore SetMockedAzKeyStore()
5051
storageMocker.Setup(f => f.Create()).Returns(storageMocker.Object);
5152
storageMocker.Setup(f => f.ReadData()).Returns(new byte[0]);
5253
storageMocker.Setup(f => f.WriteData(It.IsAny<byte[]>())).Callback((byte[] s) => {});
53-
var keyStore = new AzKeyStore(AzureSession.Instance.ARMProfileDirectory, "keystore.cache", false, false, storageMocker.Object);
54+
var keyStore = new AzKeyStore(AzureSession.Instance.ARMProfileDirectory, "azkeystore", false, false, storageMocker.Object);
5455
AzKeyStore.RegisterJsonConverter(typeof(ServicePrincipalKey), typeof(ServicePrincipalKey).Name);
5556
AzKeyStore.RegisterJsonConverter(typeof(SecureString), typeof(SecureString).Name, new SecureStringConverter());
5657
return keyStore;

‎src/Accounts/Accounts.Test/ProfileCmdletTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ private AzKeyStore SetMockedAzKeyStore()
5555
storageMocker.Setup(f => f.Create()).Returns(storageMocker.Object);
5656
storageMocker.Setup(f => f.ReadData()).Returns(new byte[0]);
5757
storageMocker.Setup(f => f.WriteData(It.IsAny<byte[]>())).Callback((byte[] s) => { });
58-
var keyStore = new AzKeyStore(AzureSession.Instance.ARMProfileDirectory, "keystore.cache", false, false, storageMocker.Object);
58+
var keyStore = new AzKeyStore(AzureSession.Instance.ARMProfileDirectory, "azkeystore", false, false, storageMocker.Object);
5959
return keyStore;
6060
}
6161

‎src/Accounts/Accounts/Account/ConnectAzureRmAccount.cs

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -426,6 +426,10 @@ public override void ExecuteCmdlet()
426426
if (CertificatePassword != null)
427427
{
428428
keyStore?.SaveKey(new ServicePrincipalKey(AzureAccount.Property.CertificatePassword, azureAccount.Id, Tenant), CertificatePassword);
429+
if (GetContextModificationScope() == ContextModificationScope.CurrentUser && !keyStore.IsProtected)
430+
{
431+
WriteWarning(string.Format(Resources.ServicePrincipalWarning, keyStore.FileName, keyStore.Directory));
432+
}
429433
}
430434
}
431435

@@ -449,11 +453,9 @@ public override void ExecuteCmdlet()
449453
{
450454
keyStore?.SaveKey(new ServicePrincipalKey(AzureAccount.Property.ServicePrincipalSecret
451455
,azureAccount.Id, Tenant), password);
452-
if (GetContextModificationScope() == ContextModificationScope.CurrentUser)
456+
if (GetContextModificationScope() == ContextModificationScope.CurrentUser && !keyStore.IsProtected)
453457
{
454-
var file = AzureSession.Instance.ARMProfileFile;
455-
var directory = AzureSession.Instance.ARMProfileDirectory;
456-
WriteWarning(string.Format(Resources.ServicePrincipalWarning, file, directory));
458+
WriteWarning(string.Format(Resources.ServicePrincipalWarning, keyStore.FileName, keyStore.Directory));
457459
}
458460
}
459461
if (azureAccount.Type == "ClientAssertion" && FederatedToken != null)
@@ -711,8 +713,8 @@ public void OnImport()
711713
}
712714

713715
AzKeyStore keyStore = null;
714-
//AzureSession.Instance.KeyStoreFile
715-
keyStore = new AzKeyStore(AzureSession.Instance.ARMProfileDirectory, "keystore.cache", false, autoSaveEnabled);
716+
keyStore = new AzKeyStore(AzureSession.Instance.ARMProfileDirectory, AzureSession.Instance.KeyStoreFile, false, autoSaveEnabled);
717+
AzureSession.Instance.KeyStoreFile = keyStore.FileName;
716718
AzKeyStore.RegisterJsonConverter(typeof(ServicePrincipalKey), typeof(ServicePrincipalKey).Name);
717719
AzKeyStore.RegisterJsonConverter(typeof(SecureString), typeof(SecureString).Name, new SecureStringConverter());
718720
AzureSession.Instance.RegisterComponent(AzKeyStore.Name, () => keyStore);

‎src/Accounts/Accounts/ChangeLog.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
- It also fixed the incorrectly short lifespan of tokens.
2525
* Upgraded target framework of Microsoft.Identity.Client to net461 [#20189]
2626
* Stored `ServicePrincipalSecret` and `CertificatePassword` into `AzKeyStore`.
27-
* Updated the reference of Azure PowerShell Common to 1.3.65-preview.
27+
* Updated the reference of Azure PowerShell Common to 1.3.67-preview.
2828

2929
## Version 2.10.3
3030
* Updated `Get-AzSubscription` to retrieve subscription by Id rather than listed all the subscriptions from server if subscription Id is provided. [#19115]

‎src/Accounts/Accounts/Properties/Resources.Designer.cs

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/Accounts/Accounts/Properties/Resources.resx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -424,7 +424,7 @@
424424
<value>Unable to set profile because environment variable '${0}' is null.</value>
425425
</data>
426426
<data name="ServicePrincipalWarning" xml:space="preserve">
427-
<value>The provided service principal secret will be included in the '{0}' file found in the user profile ( {1} ). Please ensure that this directory has appropriate protections.</value>
427+
<value>The provided service principal secret or certifcate password will be included in the '{0}' file found in the user profile ( {1} ). Please ensure that this directory has appropriate protections.</value>
428428
</data>
429429
<data name="ClientAssertionWarning" xml:space="preserve">
430430
<value>The provided client id and assertion will be included in the '{0}' file found in the user profile ( {1} ). Please ensure that this directory has appropriate protections.</value>

‎src/Accounts/Authentication.Test/AzKeyStorageTest.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ public class AzKeyStorageTest
3030
private Mock<IStorage> storageMocker = null;
3131
private List<byte> storageChecker = null;
3232
private string dummpyPath = "/home/dummy/.Azure";
33-
private string keyStoreFileName = "keystore.cache";
33+
private string keyStoreFileName = "azkeystore";
3434

3535
public AzKeyStorageTest()
3636
{

‎src/Accounts/Authentication/AzureSessionInitializer.cs

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -160,8 +160,7 @@ static ContextAutosaveSettings InitializeSessionSettings(IDataStore store, strin
160160
ContextDirectory = profileDirectory,
161161
Mode = ContextSaveMode.Process,
162162
CacheFile = "msal.cache",
163-
ContextFile = "AzureRmContext.json",
164-
KeyStoreFile = "keystore.cache"
163+
ContextFile = "AzureRmContext.json"
165164
};
166165

167166
var settingsPath = Path.Combine(profileDirectory, settingsFile);
@@ -177,7 +176,6 @@ static ContextAutosaveSettings InitializeSessionSettings(IDataStore store, strin
177176
result.ContextDirectory = migrated ? profileDirectory : settings.ContextDirectory ?? result.ContextDirectory;
178177
result.Mode = settings.Mode;
179178
result.ContextFile = settings.ContextFile ?? result.ContextFile;
180-
result.KeyStoreFile = settings.KeyStoreFile ?? result.KeyStoreFile;
181179
result.Settings = settings.Settings;
182180
bool updateSettings = false;
183181
if (!settings.Settings.ContainsKey("InstallationId"))
@@ -270,6 +268,7 @@ static IAzureSession CreateInstance(IDataStore dataStore = null, Action<string>
270268
session.ARMProfileFile = autoSave.ContextFile;
271269
session.TokenCacheDirectory = autoSave.CacheDirectory;
272270
session.TokenCacheFile = autoSave.CacheFile;
271+
session.KeyStoreFile = "azkeystore";
273272
autoSave.Settings.TryGetValue("InstallationId", out string installationId);
274273
session.ExtendedProperties.Add("InstallationId", installationId);
275274
InitializeConfigs(session, profilePath, writeWarning);

‎src/Accounts/Authentication/ContextAutosaveSettings.cs

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -51,12 +51,6 @@ public class ContextAutosaveSettings : IExtensibleSettings
5151
/// </summary>
5252
public string CacheFile { get; set; }
5353

54-
/// <summary>
55-
/// The name of the keystore file
56-
/// </summary>
57-
public string KeyStoreFile { get; set; }
58-
59-
6054
/// <summary>
6155
/// Extensible settings for autosave
6256
/// </summary>

‎src/Accounts/Authentication/KeyStore/AzKeyStore.cs

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,21 @@ public IStorage Storage
7171
set => _storage = value;
7272
}
7373

74+
public bool IsProtected
75+
{
76+
get => Storage.IsProtected;
77+
}
78+
79+
public string FileName
80+
{
81+
get => Storage.FileName;
82+
}
83+
84+
public string Directory
85+
{
86+
get => Storage.Directory;
87+
}
88+
7489
public AzKeyStore()
7590
{
7691

‎src/Accounts/Authentication/KeyStore/IStorage.cs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,5 +28,13 @@ public interface IStorage
2828
void WriteData(byte[] data);
2929

3030
Exception GetLastError();
31+
32+
string FileName { get; set; }
33+
string Directory { get; set; }
34+
35+
bool IsProtected
36+
{
37+
get;
38+
}
3139
}
3240
}

‎src/Accounts/Authentication/KeyStore/StorageWrapper.cs

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
using Microsoft.Azure.Commands.Common.Authentication.Properties;
1515
using Microsoft.Identity.Client.Extensions.Msal;
1616
using System;
17+
using System.Collections.Generic;
1718
using System.Threading;
1819

1920
namespace Microsoft.Azure.Commands.ResourceManager.Common
@@ -29,6 +30,13 @@ class StorageWrapper : IStorage
2930

3031
private Storage _storage = null;
3132

33+
private bool isProtected;
34+
public bool IsProtected
35+
{
36+
get => isProtected;
37+
private set => isProtected = value;
38+
}
39+
3240
static ReaderWriterLockSlim storageLock = new ReaderWriterLockSlim(LockRecursionPolicy.SupportsRecursion);
3341

3442
public StorageWrapper()
@@ -43,25 +51,32 @@ public IStorage Create()
4351
{
4452
throw new InvalidOperationException(Resources.StorageLockConflicts);
4553
}
54+
string tempFileName = null;
4655
try
4756
{
48-
storageProperties = new StorageCreationPropertiesBuilder(FileName, Directory)
57+
tempFileName = $"{FileName}.cache";
58+
storageProperties = new StorageCreationPropertiesBuilder(tempFileName, Directory)
4959
.WithMacKeyChain(KeyChainServiceName + ".other_secrets", FileName)
50-
.WithLinuxUnprotectedFile();
60+
.WithLinuxKeyring(FileName, "default", "AzKeyStoreCache",
61+
new KeyValuePair<string, string>("AzureClientID", "Microsoft.Developer.Azure.PowerShell"),
62+
new KeyValuePair<string, string>("Microsoft.Developer.Azure.PowerShell", "1.0.0.0"));
5163
_storage = Storage.Create(storageProperties.Build());
5264
VerifyPersistence();
65+
isProtected = true;
5366
}
54-
catch (MsalCachePersistenceException e)
67+
catch (Exception e)
5568
{
5669
_lastError = e;
57-
_storage.Clear();
58-
storageProperties = new StorageCreationPropertiesBuilder(FileName, Directory).WithUnprotectedFile();
70+
tempFileName = $"{FileName}.json";
71+
storageProperties = new StorageCreationPropertiesBuilder(tempFileName, Directory).WithUnprotectedFile();
5972
_storage = Storage.Create(storageProperties.Build());
73+
isProtected = false;
6074
}
6175
finally
6276
{
6377
storageLock.ExitWriteLock();
6478
}
79+
FileName = tempFileName ?? FileName;
6580
return this;
6681
}
6782

‎tools/Common.Netcore.Dependencies.targets

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,22 @@
33
<ItemGroup>
44
<PackageReference Include="Microsoft.Rest.ClientRuntime" Version="2.3.24"/>
55
<PackageReference Include="Microsoft.Rest.ClientRuntime.Azure" Version="3.3.19"/>
6-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Aks" Version="1.3.65-preview"/>
7-
<PackageReference Include="Microsoft.Azure.PowerShell.Authentication.Abstractions" Version="1.3.65-preview"/>
8-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Authorization" Version="1.3.65-preview"/>
9-
<PackageReference Include="Microsoft.Azure.PowerShell.Common" Version="1.3.65-preview"/>
10-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Compute" Version="1.3.65-preview"/>
11-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Graph.Rbac" Version="1.3.65-preview"/>
12-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.KeyVault" Version="1.3.65-preview"/>
13-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Monitor" Version="1.3.65-preview"/>
14-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Network" Version="1.3.65-preview"/>
15-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.PolicyInsights" Version="1.3.65-preview"/>
16-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.ResourceManager" Version="1.3.65-preview"/>
17-
<PackageReference Include="Microsoft.Azure.PowerShell.Storage" Version="1.3.65-preview"/>
18-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Storage.Management" Version="1.3.65-preview"/>
19-
<PackageReference Include="Microsoft.Azure.PowerShell.Strategies" Version="1.3.65-preview"/>
20-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Websites" Version="1.3.65-preview"/>
21-
<PackageReference Include="Microsoft.Azure.PowerShell.Common.Share" Version="1.3.65-preview"/>
6+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Aks" Version="1.3.67-preview"/>
7+
<PackageReference Include="Microsoft.Azure.PowerShell.Authentication.Abstractions" Version="1.3.67-preview"/>
8+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Authorization" Version="1.3.67-preview"/>
9+
<PackageReference Include="Microsoft.Azure.PowerShell.Common" Version="1.3.67-preview"/>
10+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Compute" Version="1.3.67-preview"/>
11+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Graph.Rbac" Version="1.3.67-preview"/>
12+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.KeyVault" Version="1.3.67-preview"/>
13+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Monitor" Version="1.3.67-preview"/>
14+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Network" Version="1.3.67-preview"/>
15+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.PolicyInsights" Version="1.3.67-preview"/>
16+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.ResourceManager" Version="1.3.67-preview"/>
17+
<PackageReference Include="Microsoft.Azure.PowerShell.Storage" Version="1.3.67-preview"/>
18+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Storage.Management" Version="1.3.67-preview"/>
19+
<PackageReference Include="Microsoft.Azure.PowerShell.Strategies" Version="1.3.67-preview"/>
20+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Websites" Version="1.3.67-preview"/>
21+
<PackageReference Include="Microsoft.Azure.PowerShell.Common.Share" Version="1.3.67-preview"/>
2222
</ItemGroup>
2323
<ItemGroup>
2424
<PackageReference Include="Azure.Core" Version="1.25.0"/>
@@ -36,7 +36,7 @@
3636
<PackageReference Include="PowerShellStandard.Library" Version="5.1.0" PrivateAssets="All" />
3737
</ItemGroup>
3838
<PropertyGroup>
39-
<StorageToolsPath>$(NugetPackageRoot)\microsoft.azure.powershell.storage\1.3.65-preview\tools\</StorageToolsPath>
39+
<StorageToolsPath>$(NugetPackageRoot)\microsoft.azure.powershell.storage\1.3.67-preview\tools\</StorageToolsPath>
4040
</PropertyGroup>
4141
<ItemGroup Condition="'$(OmitJsonPackage)' != 'true'">
4242
<PackageReference Include="Newtonsoft.Json" Version="10.0.3"/>

0 commit comments

Comments
 (0)