Skip to content

Commit c690c21

Browse files
isra-felYeming Liu
isra-fel
and
Yeming Liu
authored
Enabled setting ssh auth scope in environment (#27878)
Co-authored-by: Yeming Liu <yeliu@microsoft.com>
1 parent aa58e39 commit c690c21

File tree

10 files changed

+98
-34
lines changed

10 files changed

+98
-34
lines changed

‎src/Accounts/Accounts/ChangeLog.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
-->
2020

2121
## Upcoming Release
22+
* Enabled setting the authentication scope for SSH cmdlets by `Set-AzEnvironment -SshAuthScope <String>`.
2223

2324
## Version 5.0.2
2425
* Upgrade Azure.Core to 1.45.0

‎src/Accounts/Accounts/Environment/AddAzureRMEnvironment.cs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,10 @@ public string DataLakeAudience
225225
HelpMessage = "Microsoft Graph Url")]
226226
public string MicrosoftGraphUrl { get; set; }
227227

228+
[Parameter(ParameterSetName = EnvironmentPropertiesParameterSet, Mandatory = false, ValueFromPipelineByPropertyName = true,
229+
HelpMessage = "The scope for authentication when SSH to an Azure VM.")]
230+
public string SshAuthScope { get; set; }
231+
228232
protected override bool RequireDefaultContext()
229233
{
230234
return false;
@@ -391,6 +395,8 @@ public override void ExecuteCmdlet()
391395
nameof(MicrosoftGraphEndpointResourceId));
392396
SetEndpointIfBound(newEnvironment, AzureEnvironment.ExtendedEndpoint.MicrosoftGraphUrl,
393397
nameof(MicrosoftGraphUrl));
398+
SetEndpointIfBound(newEnvironment, AzureEnvironment.ExtendedEndpoint.AzureSshAuthScope,
399+
nameof(SshAuthScope));
394400
WriteObject(new PSAzureEnvironment(profileClient.AddOrSetEnvironment(newEnvironment)));
395401
}
396402
});

‎src/Accounts/Accounts/Environment/SetAzureRMEnvironment.cs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,10 @@ public string DataLakeAudience
196196
HelpMessage = "Microsoft Graph Url")]
197197
public string MicrosoftGraphUrl { get; set; }
198198

199+
[Parameter(ParameterSetName = EnvironmentPropertiesParameterSet, Mandatory = false, ValueFromPipelineByPropertyName = true,
200+
HelpMessage = "The scope for authentication when SSH to an Azure VM.")]
201+
public string SshAuthScope { get; set; }
202+
199203
protected override bool RequireDefaultContext()
200204
{
201205
return false;
@@ -364,6 +368,8 @@ public override void ExecuteCmdlet()
364368
nameof(MicrosoftGraphEndpointResourceId));
365369
SetEndpointIfBound(newEnvironment, AzureEnvironment.ExtendedEndpoint.MicrosoftGraphUrl,
366370
nameof(MicrosoftGraphUrl));
371+
SetEndpointIfBound(newEnvironment, AzureEnvironment.ExtendedEndpoint.AzureSshAuthScope,
372+
nameof(SshAuthScope));
367373
WriteObject(new PSAzureEnvironment(profileClient.AddOrSetEnvironment(newEnvironment)));
368374
}
369375
});

‎src/Accounts/Accounts/help/Add-AzEnvironment.md

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,9 @@ Add-AzEnvironment [-Name] <String> [[-PublishSettingsFileUrl] <String>] [[-Servi
2828
[-AzureAnalysisServicesEndpointResourceId <String>] [-AzureAttestationServiceEndpointSuffix <String>]
2929
[-AzureAttestationServiceEndpointResourceId <String>] [-AzureSynapseAnalyticsEndpointSuffix <String>]
3030
[-ContainerRegistryEndpointSuffix <String>] [-AzureSynapseAnalyticsEndpointResourceId <String>]
31-
[-MicrosoftGraphEndpointResourceId <String>] [-MicrosoftGraphUrl <String>] [-Scope <ContextModificationScope>]
32-
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]
31+
[-MicrosoftGraphEndpointResourceId <String>] [-MicrosoftGraphUrl <String>] [-SshAuthScope <String>]
32+
[-Scope <ContextModificationScope>] [-DefaultProfile <IAzureContextContainer>]
33+
[-WhatIf] [-Confirm] [<CommonParameters>]
3334
```
3435

3536
### ARMEndpoint
@@ -110,7 +111,7 @@ ExtendedProperties : {}
110111
BatchEndpointResourceId :
111112
```
112113

113-
In this example we are creating a new Azure environment with sample endpoints using Add-AzEnvironment, and then we are changing the value of the ActiveDirectoryEndpoint and GraphEndpoint attributes of the created environment using the cmdlet Set-AzEnvironment.
114+
In this example we are creating a new Azure environment with sample endpoints using Add-AzEnvironment, and then we are changing the value of the ActiveDirectoryEndpoint and GraphEndpoint attributes of the created environment using the cmdlet Set-AzEnvironment.
114115

115116
### Example 2: Discovering a new environment via Uri
116117
```powershell
@@ -677,6 +678,21 @@ Accept pipeline input: True (ByPropertyName)
677678
Accept wildcard characters: False
678679
```
679680

681+
### -SshAuthScope
682+
The scope for authentication when SSH to an Azure VM.
683+
684+
```yaml
685+
Type: System.String
686+
Parameter Sets: Name
687+
Aliases:
688+
689+
Required: False
690+
Position: Named
691+
Default value: None
692+
Accept pipeline input: True (ByPropertyName)
693+
Accept wildcard characters: False
694+
```
695+
680696
### -StorageEndpoint
681697
Specifies the endpoint for storage (blob, table, queue, and file) access.
682698

‎src/Accounts/Accounts/help/Az.Accounts.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,9 @@ Exports all the configs into a file so that it can be imported on another machin
6262
### [Get-AzAccessToken](Get-AzAccessToken.md)
6363
Get secure access token. When using -ResourceUrl, please make sure the value does match current Azure environment. You may refer to the value of `(Get-AzContext).Environment`.
6464

65+
> [!NOTE]
66+
> For security purposes, the default output type has been changed from a plain text `String` to `SecureString`. For more information, see [Protect secrets in Azure PowerShell](https://go.microsoft.com/fwlink/?linkid=2258844).
67+
6568
### [Get-AzConfig](Get-AzConfig.md)
6669
Gets the configs of Azure PowerShell.
6770

‎src/Accounts/Accounts/help/Set-AzEnvironment.md

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,9 @@ Set-AzEnvironment [-Name] <String> [[-PublishSettingsFileUrl] <String>] [[-Servi
2828
[-AzureAnalysisServicesEndpointResourceId <String>] [-AzureAttestationServiceEndpointSuffix <String>]
2929
[-AzureAttestationServiceEndpointResourceId <String>] [-AzureSynapseAnalyticsEndpointSuffix <String>]
3030
[-ContainerRegistryEndpointSuffix <String>] [-AzureSynapseAnalyticsEndpointResourceId <String>]
31-
[-MicrosoftGraphEndpointResourceId <String>] [-MicrosoftGraphUrl <String>] [-Scope <ContextModificationScope>]
32-
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]
31+
[-MicrosoftGraphEndpointResourceId <String>] [-MicrosoftGraphUrl <String>] [-SshAuthScope <String>]
32+
[-Scope <ContextModificationScope>] [-DefaultProfile <IAzureContextContainer>]
33+
[-WhatIf] [-Confirm] [<CommonParameters>]
3334
```
3435

3536
### ARMEndpoint
@@ -76,7 +77,7 @@ ActiveDirectoryServiceEndpointResourceId : TestADApplicationId
7677
AdTenant :
7778
GalleryUrl : TestGalleryEndpoint
7879
ManagementPortalUrl :
79-
ServiceManagementUrl :
80+
ServiceManagementUrl :
8081
PublishSettingsFileUrl :
8182
ResourceManagerUrl : TestRMEndpoint
8283
SqlDatabaseDnsSuffix :
@@ -599,6 +600,21 @@ Accept pipeline input: True (ByPropertyName)
599600
Accept wildcard characters: False
600601
```
601602

603+
### -SshAuthScope
604+
The scope for authentication when SSH to an Azure VM.
605+
606+
```yaml
607+
Type: System.String
608+
Parameter Sets: Name
609+
Aliases:
610+
611+
Required: False
612+
Position: Named
613+
Default value: None
614+
Accept pipeline input: True (ByPropertyName)
615+
Accept wildcard characters: False
616+
```
617+
602618
### -StorageEndpoint
603619
Specifies the endpoint for storage (blob, table, queue, and file) access.
604620

‎src/Accounts/Authentication/Factories/SshCredentialFactory.cs

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
using Microsoft.Azure.Commands.Common.Authentication.Abstractions;
1616
using Microsoft.Azure.Commands.Common.Authentication.Abstractions.Models;
1717
using Microsoft.Azure.Commands.Common.Authentication.Properties;
18+
using Microsoft.Azure.Commands.Common.Exceptions;
1819
using Microsoft.Identity.Client.SSHCertificates;
1920
using Microsoft.WindowsAzure.Commands.Utilities.Common;
2021

@@ -29,12 +30,12 @@ namespace Microsoft.Azure.Commands.Common.Authentication.Factories
2930
{
3031
public class SshCredentialFactory : ISshCredentialFactory
3132
{
32-
33-
private readonly Dictionary<string, string> CloudToScope = new Dictionary<string, string>()
33+
// kept for backward-compatibility
34+
private readonly Dictionary<string, string> CloudToScope = new Dictionary<string, string>(StringComparer.InvariantCultureIgnoreCase)
3435
{
35-
{ "azurecloud", "https://pas.windows.net/CheckMyAccess/Linux/.default" },
36-
{ "azurechinacloud", "https://pas.chinacloudapi.cn/CheckMyAccess/Linux/.default" },
37-
{ "azureusgovernment", "https://pasff.usgovcloudapi.net/CheckMyAccess/Linux/.default" },
36+
{ EnvironmentName.AzureCloud, AzureEnvironmentConstants.AzureSshAuthScope },
37+
{ EnvironmentName.AzureChinaCloud, AzureEnvironmentConstants.ChinaSshAuthScope },
38+
{ EnvironmentName.AzureUSGovernment, AzureEnvironmentConstants.USGovernmentSshAuthScope },
3839
};
3940

4041
private string CreateJwk(RSAParameters rsaKeyInfo, out string keyId)
@@ -69,12 +70,8 @@ public SshCredential GetSshCredential(IAzureContext context, RSAParameters rsaKe
6970
}
7071

7172
var publicClient = tokenCacheProvider.CreatePublicClient(context.Environment.ActiveDirectoryAuthority, context.Tenant.Id);
72-
string cloudName = context.Environment.Name.ToLower();
73-
string scope = CloudToScope.GetValueOrDefault(cloudName, null);
74-
if (scope == null)
75-
{
76-
throw new Exception(string.Format("Unsupported cloud {0}. Supported clouds include AzureCloud,AzureChinaCloud,AzureUSGovernment.", cloudName));
77-
}
73+
string scope = GetAuthScope(context.Environment)
74+
?? throw new AzPSKeyNotFoundException(string.Format(Resources.ErrorSshAuthScopeNotSet, context.Environment.Name));
7875
List<string> scopes = new List<string>() { scope };
7976
var jwk = CreateJwk(rsaKeyInfo, out string keyId);
8077

@@ -92,5 +89,11 @@ public SshCredential GetSshCredential(IAzureContext context, RSAParameters rsaKe
9289
};
9390
return resultToken;
9491
}
92+
93+
private string GetAuthScope(IAzureEnvironment environment)
94+
{
95+
return environment.GetProperty(AzureEnvironment.ExtendedEndpoint.AzureSshAuthScope)
96+
?? CloudToScope.GetValueOrDefault(environment.Name.ToLower(), null);
97+
}
9598
}
9699
}

‎src/Accounts/Authentication/Properties/Resources.Designer.cs

Lines changed: 9 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/Accounts/Authentication/Properties/Resources.resx

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -422,4 +422,8 @@
422422
<data name="AuthenticationTelemetryRecordPushError" xml:space="preserve">
423423
<value>Fail to push authentication telemetry record, please check the CmdletcContext with Id {0}.</value>
424424
</data>
425+
<data name="ErrorSshAuthScopeNotSet" xml:space="preserve">
426+
<value>The scope of authenticating for SSH is not set. Please run "Set-AzEnvironment -Name {0} -SshAuthScope ..." to set it first.</value>
427+
<comment>0 = environment name</comment>
428+
</data>
425429
</root>

‎tools/Common.Netcore.Dependencies.targets

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,22 @@
33
<ItemGroup>
44
<PackageReference Include="Microsoft.Rest.ClientRuntime" Version="2.3.24"/>
55
<PackageReference Include="Microsoft.Rest.ClientRuntime.Azure" Version="3.3.19"/>
6-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Aks" Version="1.3.108-preview"/>
7-
<PackageReference Include="Microsoft.Azure.PowerShell.Authentication.Abstractions" Version="1.3.108-preview"/>
8-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Authorization" Version="1.3.108-preview"/>
9-
<PackageReference Include="Microsoft.Azure.PowerShell.Common" Version="1.3.108-preview"/>
10-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Compute" Version="1.3.108-preview"/>
11-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Graph.Rbac" Version="1.3.108-preview"/>
12-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.KeyVault" Version="1.3.108-preview"/>
13-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Monitor" Version="1.3.108-preview"/>
14-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Network" Version="1.3.108-preview"/>
15-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.PolicyInsights" Version="1.3.108-preview"/>
16-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.ResourceManager" Version="1.3.108-preview"/>
17-
<PackageReference Include="Microsoft.Azure.PowerShell.Storage" Version="1.3.108-preview"/>
18-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Storage.Management" Version="1.3.108-preview"/>
19-
<PackageReference Include="Microsoft.Azure.PowerShell.Strategies" Version="1.3.108-preview"/>
20-
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Websites" Version="1.3.108-preview"/>
21-
<PackageReference Include="Microsoft.Azure.PowerShell.Common.Share" Version="1.3.108-preview"/>
6+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Aks" Version="1.3.109-preview"/>
7+
<PackageReference Include="Microsoft.Azure.PowerShell.Authentication.Abstractions" Version="1.3.109-preview"/>
8+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Authorization" Version="1.3.109-preview"/>
9+
<PackageReference Include="Microsoft.Azure.PowerShell.Common" Version="1.3.109-preview"/>
10+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Compute" Version="1.3.109-preview"/>
11+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Graph.Rbac" Version="1.3.109-preview"/>
12+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.KeyVault" Version="1.3.109-preview"/>
13+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Monitor" Version="1.3.109-preview"/>
14+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Network" Version="1.3.109-preview"/>
15+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.PolicyInsights" Version="1.3.109-preview"/>
16+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.ResourceManager" Version="1.3.109-preview"/>
17+
<PackageReference Include="Microsoft.Azure.PowerShell.Storage" Version="1.3.109-preview"/>
18+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Storage.Management" Version="1.3.109-preview"/>
19+
<PackageReference Include="Microsoft.Azure.PowerShell.Strategies" Version="1.3.109-preview"/>
20+
<PackageReference Include="Microsoft.Azure.PowerShell.Clients.Websites" Version="1.3.109-preview"/>
21+
<PackageReference Include="Microsoft.Azure.PowerShell.Common.Share" Version="1.3.109-preview"/>
2222
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />
2323
</ItemGroup>
2424
<ItemGroup>
@@ -37,7 +37,7 @@
3737
<PackageReference Include="PowerShellStandard.Library" Version="5.1.0" PrivateAssets="All" />
3838
</ItemGroup>
3939
<PropertyGroup>
40-
<StorageToolsPath>$(NugetPackageRoot)\microsoft.azure.powershell.storage\1.3.108-preview\tools\</StorageToolsPath>
40+
<StorageToolsPath>$(NugetPackageRoot)\microsoft.azure.powershell.storage\1.3.109-preview\tools\</StorageToolsPath>
4141
</PropertyGroup>
4242
<ItemGroup Condition="'$(OmitJsonPackage)' != 'true'">
4343
<PackageReference Include="Newtonsoft.Json" Version="13.0.2"/>

0 commit comments

Comments
 (0)