Skip to content

Commit dc1f5bc

Browse files
manicminermanicminer
authored
Merge pull request #31070 from hashicorp/f/removing-adal-auth
backend/azurerm: exclusively using Microsoft Graph/MSAL and removing Azure Active Directory Graph/ADAL
2 parents 06baea9 + 05528e8 commit dc1f5bc

File tree

7 files changed

+23
-235
lines changed

7 files changed

+23
-235
lines changed

‎internal/backend/remote-state/azure/arm_client.go‎

Lines changed: 15 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -7,18 +7,17 @@ import (
77
"os"
88
"time"
99

10-
"github.com/manicminer/hamilton/environments"
11-
12-
"github.com/tombuildsstuff/giovanni/storage/2018-11-09/blob/blobs"
13-
"github.com/tombuildsstuff/giovanni/storage/2018-11-09/blob/containers"
14-
1510
"github.com/Azure/azure-sdk-for-go/profiles/2017-03-09/resources/mgmt/resources"
1611
armStorage "github.com/Azure/azure-sdk-for-go/services/storage/mgmt/2021-01-01/storage"
1712
"github.com/Azure/go-autorest/autorest"
1813
"github.com/Azure/go-autorest/autorest/azure"
1914
"github.com/hashicorp/go-azure-helpers/authentication"
2015
"github.com/hashicorp/go-azure-helpers/sender"
2116
"github.com/hashicorp/terraform/internal/httpclient"
17+
"github.com/hashicorp/terraform/version"
18+
"github.com/manicminer/hamilton/environments"
19+
"github.com/tombuildsstuff/giovanni/storage/2018-11-09/blob/blobs"
20+
"github.com/tombuildsstuff/giovanni/storage/2018-11-09/blob/containers"
2221
)
2322

2423
type ArmClient struct {
@@ -91,7 +90,7 @@ func buildArmClient(ctx context.Context, config BackendConfig) (*ArmClient, erro
9190
SupportsClientSecretAuth: true,
9291
SupportsManagedServiceIdentity: config.UseMsi,
9392
SupportsOIDCAuth: config.UseOIDC,
94-
UseMicrosoftGraph: config.UseMicrosoftGraph,
93+
UseMicrosoftGraph: true,
9594
}
9695
armConfig, err := builder.Build()
9796
if err != nil {
@@ -109,37 +108,19 @@ func buildArmClient(ctx context.Context, config BackendConfig) (*ArmClient, erro
109108
}
110109

111110
sender := sender.BuildSender("backend/remote-state/azure")
112-
var auth autorest.Authorizer
113-
if builder.UseMicrosoftGraph {
114-
log.Printf("[DEBUG] Obtaining an MSAL / Microsoft Graph token for Resource Manager..")
115-
auth, err = armConfig.GetMSALToken(ctx, hamiltonEnv.ResourceManager, sender, oauthConfig, env.TokenAudience)
116-
if err != nil {
117-
return nil, err
118-
}
119-
} else {
120-
log.Printf("[DEBUG] Obtaining an ADAL / Azure Active Directory Graph token for Resource Manager..")
121-
auth, err = armConfig.GetADALToken(ctx, sender, oauthConfig, env.TokenAudience)
122-
if err != nil {
123-
return nil, err
124-
}
111+
log.Printf("[DEBUG] Obtaining an MSAL / Microsoft Graph token for Resource Manager..")
112+
auth, err := armConfig.GetMSALToken(ctx, hamiltonEnv.ResourceManager, sender, oauthConfig, env.TokenAudience)
113+
if err != nil {
114+
return nil, err
125115
}
126116

127117
if config.UseAzureADAuthentication {
128-
if builder.UseMicrosoftGraph {
129-
log.Printf("[DEBUG] Obtaining an MSAL / Microsoft Graph token for Storage..")
130-
storageAuth, err := armConfig.GetMSALToken(ctx, hamiltonEnv.Storage, sender, oauthConfig, env.ResourceIdentifiers.Storage)
131-
if err != nil {
132-
return nil, err
133-
}
134-
client.azureAdStorageAuth = &storageAuth
135-
} else {
136-
log.Printf("[DEBUG] Obtaining an ADAL / Azure Active Directory Graph token for Storage..")
137-
storageAuth, err := armConfig.GetADALToken(ctx, sender, oauthConfig, env.ResourceIdentifiers.Storage)
138-
if err != nil {
139-
return nil, err
140-
}
141-
client.azureAdStorageAuth = &storageAuth
118+
log.Printf("[DEBUG] Obtaining an MSAL / Microsoft Graph token for Storage..")
119+
storageAuth, err := armConfig.GetMSALToken(ctx, hamiltonEnv.Storage, sender, oauthConfig, env.ResourceIdentifiers.Storage)
120+
if err != nil {
121+
return nil, err
142122
}
123+
client.azureAdStorageAuth = &storageAuth
143124
}
144125

145126
accountsClient := armStorage.NewAccountsClientWithBaseURI(env.ResourceManagerEndpoint, armConfig.SubscriptionID)
@@ -252,7 +233,7 @@ func (c *ArmClient) configureClient(client *autorest.Client, auth autorest.Autho
252233
}
253234

254235
func buildUserAgent() string {
255-
userAgent := httpclient.UserAgentString()
236+
userAgent := httpclient.TerraformUserAgent(version.Version)
256237

257238
// append the CloudShell version to the user agent if it exists
258239
if azureAgent := os.Getenv("AZURE_HTTP_USER_AGENT"); azureAgent != "" {

‎internal/backend/remote-state/azure/backend.go‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -164,13 +164,6 @@ func New() backend.Backend {
164164
Description: "Should Terraform use AzureAD Authentication to access the Blob?",
165165
DefaultFunc: schema.EnvDefaultFunc("ARM_USE_AZUREAD", false),
166166
},
167-
"use_microsoft_graph": {
168-
Type: schema.TypeBool,
169-
Optional: true,
170-
Deprecated: "This field now defaults to `true` and will be removed in v1.3 of Terraform Core due to the deprecation of ADAL by Microsoft.",
171-
Description: "Should Terraform obtain an MSAL auth token and use Microsoft Graph rather than Azure Active Directory?",
172-
DefaultFunc: schema.EnvDefaultFunc("ARM_USE_MSGRAPH", true),
173-
},
174167
},
175168
}
176169

@@ -213,7 +206,6 @@ type BackendConfig struct {
213206
UseMsi bool
214207
UseOIDC bool
215208
UseAzureADAuthentication bool
216-
UseMicrosoftGraph bool
217209
}
218210

219211
func (b *Backend) configure(ctx context.Context) error {
@@ -248,7 +240,6 @@ func (b *Backend) configure(ctx context.Context) error {
248240
UseMsi: data.Get("use_msi").(bool),
249241
UseOIDC: data.Get("use_oidc").(bool),
250242
UseAzureADAuthentication: data.Get("use_azuread_auth").(bool),
251-
UseMicrosoftGraph: data.Get("use_microsoft_graph").(bool),
252243
}
253244

254245
armClient, err := buildArmClient(context.TODO(), config)

‎internal/backend/remote-state/azure/backend_test.go‎

Lines changed: 5 additions & 168 deletions
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ func TestAccBackendOIDCBasic(t *testing.T) {
123123
backend.TestBackendStates(t, b)
124124
}
125125

126-
func TestAccBackendADALAzureADAuthBasic(t *testing.T) {
126+
func TestAccBackendAzureADAuthBasic(t *testing.T) {
127127
testAccAzureBackend(t)
128128
rs := acctest.RandString(4)
129129
res := testResourceNames(rs, "testState")
@@ -151,7 +151,7 @@ func TestAccBackendADALAzureADAuthBasic(t *testing.T) {
151151
backend.TestBackendStates(t, b)
152152
}
153153

154-
func TestAccBackendADALManagedServiceIdentityBasic(t *testing.T) {
154+
func TestAccBackendManagedServiceIdentityBasic(t *testing.T) {
155155
testAccAzureBackendRunningInAzure(t)
156156
rs := acctest.RandString(4)
157157
res := testResourceNames(rs, "testState")
@@ -179,7 +179,7 @@ func TestAccBackendADALManagedServiceIdentityBasic(t *testing.T) {
179179
backend.TestBackendStates(t, b)
180180
}
181181

182-
func TestAccBackendADALServicePrincipalClientCertificateBasic(t *testing.T) {
182+
func TestAccBackendServicePrincipalClientCertificateBasic(t *testing.T) {
183183
testAccAzureBackend(t)
184184

185185
clientCertPassword := os.Getenv("ARM_CLIENT_CERTIFICATE_PASSWORD")
@@ -216,7 +216,7 @@ func TestAccBackendADALServicePrincipalClientCertificateBasic(t *testing.T) {
216216
backend.TestBackendStates(t, b)
217217
}
218218

219-
func TestAccBackendADALServicePrincipalClientSecretBasic(t *testing.T) {
219+
func TestAccBackendServicePrincipalClientSecretBasic(t *testing.T) {
220220
testAccAzureBackend(t)
221221
rs := acctest.RandString(4)
222222
res := testResourceNames(rs, "testState")
@@ -245,7 +245,7 @@ func TestAccBackendADALServicePrincipalClientSecretBasic(t *testing.T) {
245245
backend.TestBackendStates(t, b)
246246
}
247247

248-
func TestAccBackendADALServicePrincipalClientSecretCustomEndpoint(t *testing.T) {
248+
func TestAccBackendServicePrincipalClientSecretCustomEndpoint(t *testing.T) {
249249
testAccAzureBackend(t)
250250

251251
// this is only applicable for Azure Stack.
@@ -281,169 +281,6 @@ func TestAccBackendADALServicePrincipalClientSecretCustomEndpoint(t *testing.T)
281281
backend.TestBackendStates(t, b)
282282
}
283283

284-
func TestAccBackendMSALAzureADAuthBasic(t *testing.T) {
285-
testAccAzureBackend(t)
286-
rs := acctest.RandString(4)
287-
res := testResourceNames(rs, "testState")
288-
res.useAzureADAuth = true
289-
res.useMicrosoftGraph = true
290-
armClient := buildTestClient(t, res)
291-
292-
ctx := context.TODO()
293-
err := armClient.buildTestResources(ctx, &res)
294-
defer armClient.destroyTestResources(ctx, res)
295-
if err != nil {
296-
armClient.destroyTestResources(ctx, res)
297-
t.Fatalf("Error creating Test Resources: %q", err)
298-
}
299-
300-
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
301-
"storage_account_name": res.storageAccountName,
302-
"container_name": res.storageContainerName,
303-
"key": res.storageKeyName,
304-
"access_key": res.storageAccountAccessKey,
305-
"environment": os.Getenv("ARM_ENVIRONMENT"),
306-
"endpoint": os.Getenv("ARM_ENDPOINT"),
307-
"use_azuread_auth": true,
308-
})).(*Backend)
309-
310-
backend.TestBackendStates(t, b)
311-
}
312-
313-
func TestAccBackendMSALManagedServiceIdentityBasic(t *testing.T) {
314-
testAccAzureBackendRunningInAzure(t)
315-
rs := acctest.RandString(4)
316-
res := testResourceNames(rs, "testState")
317-
res.useMicrosoftGraph = true
318-
armClient := buildTestClient(t, res)
319-
320-
ctx := context.TODO()
321-
err := armClient.buildTestResources(ctx, &res)
322-
defer armClient.destroyTestResources(ctx, res)
323-
if err != nil {
324-
t.Fatalf("Error creating Test Resources: %q", err)
325-
}
326-
327-
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
328-
"storage_account_name": res.storageAccountName,
329-
"container_name": res.storageContainerName,
330-
"key": res.storageKeyName,
331-
"resource_group_name": res.resourceGroup,
332-
"use_msi": true,
333-
"subscription_id": os.Getenv("ARM_SUBSCRIPTION_ID"),
334-
"tenant_id": os.Getenv("ARM_TENANT_ID"),
335-
"environment": os.Getenv("ARM_ENVIRONMENT"),
336-
"endpoint": os.Getenv("ARM_ENDPOINT"),
337-
})).(*Backend)
338-
339-
backend.TestBackendStates(t, b)
340-
}
341-
342-
func TestAccBackendMSALServicePrincipalClientCertificateBasic(t *testing.T) {
343-
testAccAzureBackend(t)
344-
345-
clientCertPassword := os.Getenv("ARM_CLIENT_CERTIFICATE_PASSWORD")
346-
clientCertPath := os.Getenv("ARM_CLIENT_CERTIFICATE_PATH")
347-
if clientCertPath == "" {
348-
t.Skip("Skipping since `ARM_CLIENT_CERTIFICATE_PATH` is not specified!")
349-
}
350-
351-
rs := acctest.RandString(4)
352-
res := testResourceNames(rs, "testState")
353-
res.useMicrosoftGraph = true
354-
armClient := buildTestClient(t, res)
355-
356-
ctx := context.TODO()
357-
err := armClient.buildTestResources(ctx, &res)
358-
defer armClient.destroyTestResources(ctx, res)
359-
if err != nil {
360-
t.Fatalf("Error creating Test Resources: %q", err)
361-
}
362-
363-
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
364-
"storage_account_name": res.storageAccountName,
365-
"container_name": res.storageContainerName,
366-
"key": res.storageKeyName,
367-
"resource_group_name": res.resourceGroup,
368-
"subscription_id": os.Getenv("ARM_SUBSCRIPTION_ID"),
369-
"tenant_id": os.Getenv("ARM_TENANT_ID"),
370-
"client_id": os.Getenv("ARM_CLIENT_ID"),
371-
"client_certificate_password": clientCertPassword,
372-
"client_certificate_path": clientCertPath,
373-
"environment": os.Getenv("ARM_ENVIRONMENT"),
374-
"endpoint": os.Getenv("ARM_ENDPOINT"),
375-
})).(*Backend)
376-
377-
backend.TestBackendStates(t, b)
378-
}
379-
380-
func TestAccBackendMSALServicePrincipalClientSecretBasic(t *testing.T) {
381-
testAccAzureBackend(t)
382-
rs := acctest.RandString(4)
383-
res := testResourceNames(rs, "testState")
384-
res.useMicrosoftGraph = true
385-
armClient := buildTestClient(t, res)
386-
387-
ctx := context.TODO()
388-
err := armClient.buildTestResources(ctx, &res)
389-
defer armClient.destroyTestResources(ctx, res)
390-
if err != nil {
391-
t.Fatalf("Error creating Test Resources: %q", err)
392-
}
393-
394-
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
395-
"storage_account_name": res.storageAccountName,
396-
"container_name": res.storageContainerName,
397-
"key": res.storageKeyName,
398-
"resource_group_name": res.resourceGroup,
399-
"subscription_id": os.Getenv("ARM_SUBSCRIPTION_ID"),
400-
"tenant_id": os.Getenv("ARM_TENANT_ID"),
401-
"client_id": os.Getenv("ARM_CLIENT_ID"),
402-
"client_secret": os.Getenv("ARM_CLIENT_SECRET"),
403-
"environment": os.Getenv("ARM_ENVIRONMENT"),
404-
"endpoint": os.Getenv("ARM_ENDPOINT"),
405-
})).(*Backend)
406-
407-
backend.TestBackendStates(t, b)
408-
}
409-
410-
func TestAccBackendMSALServicePrincipalClientSecretCustomEndpoint(t *testing.T) {
411-
testAccAzureBackend(t)
412-
413-
// this is only applicable for Azure Stack.
414-
endpoint := os.Getenv("ARM_ENDPOINT")
415-
if endpoint == "" {
416-
t.Skip("Skipping as ARM_ENDPOINT isn't configured")
417-
}
418-
419-
rs := acctest.RandString(4)
420-
res := testResourceNames(rs, "testState")
421-
res.useMicrosoftGraph = true
422-
armClient := buildTestClient(t, res)
423-
424-
ctx := context.TODO()
425-
err := armClient.buildTestResources(ctx, &res)
426-
defer armClient.destroyTestResources(ctx, res)
427-
if err != nil {
428-
t.Fatalf("Error creating Test Resources: %q", err)
429-
}
430-
431-
b := backend.TestBackendConfig(t, New(), backend.TestWrapConfig(map[string]interface{}{
432-
"storage_account_name": res.storageAccountName,
433-
"container_name": res.storageContainerName,
434-
"key": res.storageKeyName,
435-
"resource_group_name": res.resourceGroup,
436-
"subscription_id": os.Getenv("ARM_SUBSCRIPTION_ID"),
437-
"tenant_id": os.Getenv("ARM_TENANT_ID"),
438-
"client_id": os.Getenv("ARM_CLIENT_ID"),
439-
"client_secret": os.Getenv("ARM_CLIENT_SECRET"),
440-
"environment": os.Getenv("ARM_ENVIRONMENT"),
441-
"endpoint": endpoint,
442-
})).(*Backend)
443-
444-
backend.TestBackendStates(t, b)
445-
}
446-
447284
func TestAccBackendAccessKeyLocked(t *testing.T) {
448285
testAccAzureBackend(t)
449286
rs := acctest.RandString(4)

‎internal/backend/remote-state/azure/client.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,9 @@ import (
1010

1111
"github.com/hashicorp/go-multierror"
1212
"github.com/hashicorp/go-uuid"
13-
"github.com/tombuildsstuff/giovanni/storage/2018-11-09/blob/blobs"
14-
1513
"github.com/hashicorp/terraform/internal/states/remote"
1614
"github.com/hashicorp/terraform/internal/states/statemgr"
15+
"github.com/tombuildsstuff/giovanni/storage/2018-11-09/blob/blobs"
1716
)
1817

1918
const (

‎internal/backend/remote-state/azure/helpers_test.go‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,6 @@ func buildTestClient(t *testing.T, res resourceNames) *ArmClient {
9393
StorageAccountName: res.storageAccountName,
9494
UseMsi: msiEnabled,
9595
UseAzureADAuthentication: res.useAzureADAuth,
96-
UseMicrosoftGraph: res.useMicrosoftGraph,
9796
})
9897
if err != nil {
9998
t.Fatalf("Failed to build ArmClient: %+v", err)
@@ -137,7 +136,6 @@ type resourceNames struct {
137136
storageKeyName string
138137
storageAccountAccessKey string
139138
useAzureADAuth bool
140-
useMicrosoftGraph bool
141139
}
142140

143141
func testResourceNames(rString string, keyName string) resourceNames {

‎internal/httpclient/useragent.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import (
1313
const userAgentFormat = "Terraform/%s"
1414
const uaEnvVar = "TF_APPEND_USER_AGENT"
1515

16-
// Deprecated: Use UserAgent(version) instead
16+
// Deprecated: Use TerraformUserAgent(version) instead
1717
func UserAgentString() string {
1818
ua := fmt.Sprintf(userAgentFormat, version.Version)
1919

0 commit comments

Comments
 (0)