Skip to content

Commit 07d67b7

Browse files
Avery-DunnAvery-Dunn
authored
Merge pull request #854 from AzureAD/avdunn/mi-object-id
Add object ID option for Managed Identity
2 parents 424eea6 + 51a0101 commit 07d67b7

11 files changed

+70
-48
lines changed

‎msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/AbstractManagedIdentitySource.java

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,14 @@
1515
//base class for all sources that support managed identity
1616
abstract class AbstractManagedIdentitySource {
1717

18-
protected static final String TIMEOUT_ERROR = "[Managed Identity] Authentication unavailable. The request to the managed identity endpoint timed out.";
1918
private static final Logger LOG = LoggerFactory.getLogger(AbstractManagedIdentitySource.class);
2019
private static final String MANAGED_IDENTITY_NO_RESPONSE_RECEIVED = "[Managed Identity] Authentication unavailable. No response received from the managed identity endpoint.";
2120

2221
protected final ManagedIdentityRequest managedIdentityRequest;
2322
protected final ServiceBundle serviceBundle;
2423
ManagedIdentitySourceType managedIdentitySourceType;
24+
ManagedIdentityIdType idType;
25+
String userAssignedId;
2526

2627
@Getter
2728
@Setter
@@ -40,6 +41,8 @@ public AbstractManagedIdentitySource(MsalRequest msalRequest, ServiceBundle serv
4041
this.managedIdentityRequest = (ManagedIdentityRequest) msalRequest;
4142
this.managedIdentitySourceType = sourceType;
4243
this.serviceBundle = serviceBundle;
44+
this.idType = ((ManagedIdentityApplication) msalRequest.application()).getManagedIdentityId().getIdType();
45+
this.userAssignedId = ((ManagedIdentityApplication) msalRequest.application()).getManagedIdentityId().getUserAssignedId();
4346
}
4447

4548
public ManagedIdentityResponse getManagedIdentityResponse(

‎msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/AppServiceManagedIdentitySource.java

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -34,16 +34,9 @@ public void createManagedIdentityRequest(String resource) {
3434
managedIdentityRequest.queryParameters.put("api-version", Collections.singletonList(APP_SERVICE_MSI_API_VERSION));
3535
managedIdentityRequest.queryParameters.put("resource", Collections.singletonList(resource));
3636

37-
if (!StringHelper.isNullOrBlank(getManagedIdentityUserAssignedClientId()))
38-
{
39-
LOG.info("[Managed Identity] Adding user assigned client id to the request.");
40-
managedIdentityRequest.queryParameters.put(Constants.MANAGED_IDENTITY_CLIENT_ID, Collections.singletonList(getManagedIdentityUserAssignedClientId()));
41-
}
42-
43-
if (!StringHelper.isNullOrBlank(getManagedIdentityUserAssignedResourceId()))
44-
{
45-
LOG.info("[Managed Identity] Adding user assigned resource id to the request.");
46-
managedIdentityRequest.queryParameters.put(Constants.MANAGED_IDENTITY_RESOURCE_ID, Collections.singletonList(getManagedIdentityUserAssignedResourceId()));
37+
if (this.idType != null && !StringHelper.isNullOrBlank(this.userAssignedId)) {
38+
LOG.info("[Managed Identity] Adding user assigned ID to the request for App Service Managed Identity.");
39+
managedIdentityRequest.addUserAssignedIdToQuery(this.idType, this.userAssignedId);
4740
}
4841
}
4942

‎msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/Constants.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ final class Constants {
1313

1414
public static final String MANAGED_IDENTITY_CLIENT_ID = "client_id";
1515
public static final String MANAGED_IDENTITY_RESOURCE_ID = "mi_res_id";
16+
public static final String MANAGED_IDENTITY_OBJECT_ID = "object_id";
1617
public static final String MANAGED_IDENTITY_DEFAULT_TENTANT = "managed_identity";
1718

1819
public static final String IDENTITY_ENDPOINT = "IDENTITY_ENDPOINT";

‎msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/IMDSManagedIdentitySource.java

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,8 @@ class IMDSManagedIdentitySource extends AbstractManagedIdentitySource{
3434
public IMDSManagedIdentitySource(MsalRequest msalRequest,
3535
ServiceBundle serviceBundle) {
3636
super(msalRequest, serviceBundle, ManagedIdentitySourceType.IMDS);
37-
ManagedIdentityParameters parameters = (ManagedIdentityParameters) msalRequest.requestContext().apiParameters();
3837
IEnvironmentVariables environmentVariables = getEnvironmentVariables();
38+
3939
if (!StringHelper.isNullOrBlank(environmentVariables.getEnvironmentVariable(Constants.AZURE_POD_IDENTITY_AUTHORITY_HOST))){
4040
LOG.info(String.format("[Managed Identity] Environment variable AZURE_POD_IDENTITY_AUTHORITY_HOST for IMDS returned endpoint: %s", environmentVariables.getEnvironmentVariable(Constants.AZURE_POD_IDENTITY_AUTHORITY_HOST)));
4141
try {
@@ -77,18 +77,9 @@ public void createManagedIdentityRequest(String resource) {
7777
managedIdentityRequest.queryParameters.put("api-version", Collections.singletonList(IMDS_API_VERSION));
7878
managedIdentityRequest.queryParameters.put("resource", Collections.singletonList(resource));
7979

80-
String clientId = getManagedIdentityUserAssignedClientId();
81-
String resourceId = getManagedIdentityUserAssignedResourceId();
82-
if (!StringHelper.isNullOrBlank(clientId))
83-
{
84-
LOG.info("[Managed Identity] Adding user assigned client id to the request.");
85-
managedIdentityRequest.queryParameters.put(Constants.MANAGED_IDENTITY_CLIENT_ID, Collections.singletonList(clientId));
86-
}
87-
88-
if (!StringHelper.isNullOrBlank(resourceId))
89-
{
90-
LOG.info("[Managed Identity] Adding user assigned resource id to the request.");
91-
managedIdentityRequest.queryParameters.put(Constants.MANAGED_IDENTITY_RESOURCE_ID, Collections.singletonList(resourceId));
80+
if (this.idType != null && !StringHelper.isNullOrBlank(this.userAssignedId)) {
81+
LOG.info("[Managed Identity] Adding user assigned ID to the request for IMDS Managed Identity.");
82+
managedIdentityRequest.addUserAssignedIdToQuery(this.idType, this.userAssignedId);
9283
}
9384
}
9485

‎msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/ManagedIdentityClient.java

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@
33

44
package com.microsoft.aad.msal4j;
55

6-
import lombok.AccessLevel;
7-
import lombok.Getter;
86
import org.slf4j.Logger;
97
import org.slf4j.LoggerFactory;
108

@@ -31,8 +29,9 @@ static ManagedIdentitySourceType getManagedIdentitySource() {
3129
!StringHelper.isNullOrBlank(environmentVariables.getEnvironmentVariable(Constants.IDENTITY_HEADER))) {
3230
if (!StringHelper.isNullOrBlank(environmentVariables.getEnvironmentVariable(Constants.IDENTITY_SERVER_THUMBPRINT))) {
3331
managedIdentitySourceType = ManagedIdentitySourceType.SERVICE_FABRIC;
34-
} else
35-
managedIdentitySourceType = ManagedIdentitySourceType.APP_SERVICE;
32+
} else {
33+
managedIdentitySourceType = ManagedIdentitySourceType.APP_SERVICE;
34+
}
3635
} else if (!StringHelper.isNullOrBlank(environmentVariables.getEnvironmentVariable(Constants.MSI_ENDPOINT))) {
3736
managedIdentitySourceType = ManagedIdentitySourceType.CLOUD_SHELL;
3837
} else if (!StringHelper.isNullOrBlank(environmentVariables.getEnvironmentVariable(Constants.IDENTITY_ENDPOINT)) &&
@@ -54,12 +53,6 @@ static ManagedIdentitySourceType getManagedIdentitySource() {
5453
ManagedIdentityIdType identityIdType = managedIdentityApplication.getManagedIdentityId().getIdType();
5554
if (!identityIdType.equals(ManagedIdentityIdType.SYSTEM_ASSIGNED)) {
5655
managedIdentitySource.setUserAssignedManagedIdentity(true);
57-
String userAssignedId = managedIdentityApplication.getManagedIdentityId().getUserAssignedId();
58-
if (identityIdType.equals(ManagedIdentityIdType.CLIENT_ID)) {
59-
managedIdentitySource.setManagedIdentityUserAssignedClientId(userAssignedId);
60-
} else if (identityIdType.equals(ManagedIdentityIdType.RESOURCE_ID)) {
61-
managedIdentitySource.setManagedIdentityUserAssignedResourceId(userAssignedId);
62-
}
6356
}
6457
}
6558

@@ -70,7 +63,6 @@ ManagedIdentityResponse getManagedIdentityResponse(ManagedIdentityParameters par
7063
// This method tries to create managed identity source for different sources, if none is created then defaults to IMDS.
7164
private static AbstractManagedIdentitySource createManagedIdentitySource(MsalRequest msalRequest,
7265
ServiceBundle serviceBundle) {
73-
AbstractManagedIdentitySource managedIdentitySource;
7466

7567
if (managedIdentitySourceType == null || managedIdentitySourceType == ManagedIdentitySourceType.NONE) {
7668
managedIdentitySourceType = getManagedIdentitySource();

‎msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/ManagedIdentityId.java

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,4 +61,21 @@ public static ManagedIdentityId userAssignedResourceId(String resourceId)
6161

6262
return new ManagedIdentityId(ManagedIdentityIdType.RESOURCE_ID, resourceId);
6363
}
64+
65+
/**
66+
* Create an instance of ManagedIdentityId for a user assigned managed identity from an object id.
67+
*
68+
* @param objectId Object ID of the user assigned managed identity assigned to azure resource.
69+
* @return Instance of ManagedIdentityId
70+
* @exception NullPointerException Indicates the resourceId param is null or blank
71+
*/
72+
public static ManagedIdentityId userAssignedObjectId(String objectId)
73+
{
74+
if (StringHelper.isNullOrBlank(objectId))
75+
{
76+
throw new NullPointerException(objectId);
77+
}
78+
79+
return new ManagedIdentityId(ManagedIdentityIdType.OBJECT_ID, objectId);
80+
}
6481
}

‎msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/ManagedIdentityIdType.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,6 @@ enum ManagedIdentityIdType {
77

88
SYSTEM_ASSIGNED,
99
CLIENT_ID,
10-
RESOURCE_ID
10+
RESOURCE_ID,
11+
OBJECT_ID
1112
}

‎msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/ManagedIdentityRequest.java

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,21 @@
44
package com.microsoft.aad.msal4j;
55

66
import com.nimbusds.oauth2.sdk.util.URLUtils;
7+
import org.slf4j.Logger;
8+
import org.slf4j.LoggerFactory;
79

810
import java.net.MalformedURLException;
911
import java.net.URI;
1012
import java.net.URISyntaxException;
1113
import java.net.URL;
14+
import java.util.Collections;
1215
import java.util.List;
1316
import java.util.Map;
1417

1518
class ManagedIdentityRequest extends MsalRequest {
1619

20+
private static final Logger LOG = LoggerFactory.getLogger(ManagedIdentityRequest.class);
21+
1722
URI baseEndpoint;
1823

1924
HttpMethod method;
@@ -53,4 +58,21 @@ private String appendQueryParametersToBaseEndpoint() {
5358

5459
return baseEndpoint.toString() + "?" + queryString;
5560
}
61+
62+
void addUserAssignedIdToQuery(ManagedIdentityIdType idType, String userAssignedId) {
63+
switch (idType) {
64+
case CLIENT_ID:
65+
LOG.info("[Managed Identity] Adding user assigned client id to the request.");
66+
queryParameters.put(Constants.MANAGED_IDENTITY_CLIENT_ID, Collections.singletonList(userAssignedId));
67+
break;
68+
case RESOURCE_ID:
69+
LOG.info("[Managed Identity] Adding user assigned resource id to the request.");
70+
queryParameters.put(Constants.MANAGED_IDENTITY_RESOURCE_ID, Collections.singletonList(userAssignedId));
71+
break;
72+
case OBJECT_ID:
73+
LOG.info("[Managed Identity] Adding user assigned object id to the request.");
74+
queryParameters.put(Constants.MANAGED_IDENTITY_OBJECT_ID, Collections.singletonList(userAssignedId));
75+
break;
76+
}
77+
}
5678
}

‎msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/ServiceFabricManagedIdentitySource.java

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,6 @@ class ServiceFabricManagedIdentitySource extends AbstractManagedIdentitySource {
2020

2121
private final URI msiEndpoint;
2222
private final String identityHeader;
23-
private final ManagedIdentityIdType idType;
24-
private final String userAssignedId;
2523

2624
//Service Fabric requires a special check for an environment variable containing a certificate thumbprint used for validating requests.
2725
//No other flow need this and an app developer may not be aware of it, so it was decided that for the Service Fabric flow we will simply override
@@ -41,12 +39,9 @@ public void createManagedIdentityRequest(String resource) {
4139
managedIdentityRequest.queryParameters.put("resource", Collections.singletonList(resource));
4240
managedIdentityRequest.queryParameters.put("api-version", Collections.singletonList(SERVICE_FABRIC_MSI_API_VERSION));
4341

44-
if (idType == ManagedIdentityIdType.CLIENT_ID) {
45-
LOG.info("[Managed Identity] Adding user assigned client id to the request for Service Fabric Managed Identity.");
46-
managedIdentityRequest.queryParameters.put(Constants.MANAGED_IDENTITY_CLIENT_ID, Collections.singletonList(userAssignedId));
47-
} else if (idType == ManagedIdentityIdType.RESOURCE_ID) {
48-
LOG.info("[Managed Identity] Adding user assigned resource id to the request for Service Fabric Managed Identity.");
49-
managedIdentityRequest.queryParameters.put(Constants.MANAGED_IDENTITY_RESOURCE_ID, Collections.singletonList(userAssignedId));
42+
if (this.idType != null && !StringHelper.isNullOrBlank(this.userAssignedId)) {
43+
LOG.info("[Managed Identity] Adding user assigned ID to the request for Service Fabric Managed Identity.");
44+
managedIdentityRequest.addUserAssignedIdToQuery(this.idType, this.userAssignedId);
5045
}
5146
}
5247

@@ -55,9 +50,6 @@ private ServiceFabricManagedIdentitySource(MsalRequest msalRequest, ServiceBundl
5550
super(msalRequest, serviceBundle, ManagedIdentitySourceType.SERVICE_FABRIC);
5651
this.msiEndpoint = msiEndpoint;
5752
this.identityHeader = identityHeader;
58-
59-
this.idType = ((ManagedIdentityApplication) msalRequest.application()).getManagedIdentityId().getIdType();
60-
this.userAssignedId = ((ManagedIdentityApplication) msalRequest.application()).getManagedIdentityId().getUserAssignedId();
6153
}
6254

6355
@Override

‎msal4j-sdk/src/test/java/com/microsoft/aad/msal4j/ManagedIdentityTestDataProvider.java

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
class ManagedIdentityTestDataProvider {
1111
private static final String CLIENT_ID = "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa";
1212
private static final String RESOURCE_ID = "/subscriptions/ffa4aaa2-4444-4444-5555-e3ccedd3d046/resourcegroups/UAMI_group/providers/Microsoft.ManagedIdentityClient/userAssignedIdentities/UAMI";
13+
private static final String OBJECT_ID = "593b2662-5af7-4a90-a9cb-5a9de615b82f";
1314

1415
public static Stream<Arguments> createData() {
1516
return Stream.of(
@@ -43,14 +44,20 @@ public static Stream<Arguments> createDataUserAssigned() {
4344
ManagedIdentityId.userAssignedClientId(CLIENT_ID)),
4445
Arguments.of(ManagedIdentitySourceType.APP_SERVICE, ManagedIdentityTests.appServiceEndpoint,
4546
ManagedIdentityId.userAssignedResourceId(RESOURCE_ID)),
47+
Arguments.of(ManagedIdentitySourceType.APP_SERVICE, ManagedIdentityTests.appServiceEndpoint,
48+
ManagedIdentityId.userAssignedObjectId(OBJECT_ID)),
4649
Arguments.of(ManagedIdentitySourceType.IMDS, null,
4750
ManagedIdentityId.userAssignedClientId(CLIENT_ID)),
4851
Arguments.of(ManagedIdentitySourceType.IMDS, null,
4952
ManagedIdentityId.userAssignedResourceId(RESOURCE_ID)),
53+
Arguments.of(ManagedIdentitySourceType.IMDS, null,
54+
ManagedIdentityId.userAssignedObjectId(OBJECT_ID)),
5055
Arguments.of(ManagedIdentitySourceType.SERVICE_FABRIC, ManagedIdentityTests.serviceFabricEndpoint,
5156
ManagedIdentityId.userAssignedResourceId(CLIENT_ID)),
5257
Arguments.of(ManagedIdentitySourceType.SERVICE_FABRIC, ManagedIdentityTests.serviceFabricEndpoint,
53-
ManagedIdentityId.userAssignedResourceId(RESOURCE_ID)));
58+
ManagedIdentityId.userAssignedResourceId(RESOURCE_ID)),
59+
Arguments.of(ManagedIdentitySourceType.SERVICE_FABRIC, ManagedIdentityTests.serviceFabricEndpoint,
60+
ManagedIdentityId.userAssignedObjectId(OBJECT_ID)));
5461
}
5562

5663
public static Stream<Arguments> createDataUserAssignedNotSupported() {

‎msal4j-sdk/src/test/java/com/microsoft/aad/msal4j/ManagedIdentityTests.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,9 @@ private HttpRequest expectedRequest(ManagedIdentitySourceType source, String res
124124
case RESOURCE_ID:
125125
queryParameters.put("mi_res_id", Collections.singletonList(id.getUserAssignedId()));
126126
break;
127+
case OBJECT_ID:
128+
queryParameters.put("object_id", Collections.singletonList(id.getUserAssignedId()));
129+
break;
127130
}
128131

129132
return new HttpRequest(HttpMethod.GET, computeUri(endpoint, queryParameters), headers);

0 commit comments

Comments
 (0)