Comments (11)
I believe this effort is now abandoned in favor of Azure CLI's az rest
which is cross-platform from birth.
Example -
~ $ az rest --help
Command
az rest : Invoke a custom request.
This command automatically authenticates using the logged-in credential: If Authorization
header is not set, it attaches header `Authorization: Bearer <token>`, where `<token>` is
retrieved from AAD. The target resource of the token is derived from --url if --url starts
with an endpoint from `az cloud show --query endpoints`. You may also use --resource for a
custom resource.
If Content-Type header is not set and --body is a valid JSON string, Content-Type header
will default to application/json.
$ az rest --method get --url https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>?api-version=2021-01-01
{
"authorizationSource": "Legacy",
"displayName": "xx",
"id": "/subscriptions/xxxxxxxx",
"managedByTenants": [
{
"tenantId": "xxxxxxx"
},
{
"tenantId": "xxxxxxx"
}
],
"state": "Enabled",
[...]
from armclient.
Yes, would be great to have it work on Core. For auth, I think we'd need to switch to a model like what xplat CLI is doing. It gives you some code that you have to paste in a browser page, and then auth continues without needed to ever pop up UI. It's just too hard to pop up a browser window in a portable way.
Here is what it looks like with cli, though I don't know about implementation:
info: Executing command login
info: To sign in, use a web browser to open the page https://aka.ms/devicelogin and enter the code EKCCKBJ6D to authenticate.
from armclient.
I saw that in the Mac PowerShell and az as well, so it must be coming from ADAL. I'll do some detective work since PowerShell is now open. This magic must be revealed.
from armclient.
Alright, so it's called OAuth 2.0 Device Flow Grant, it's in ADAL and it goes like this:
DeviceCodeResult codeResult = ctx.AcquireDeviceCodeAsync(resource, clientId).Result;
Console.WriteLine("You need to sign in.");
Console.WriteLine("Message: " + codeResult.Message + "\n");
result = ctx.AcquireTokenByDeviceCodeAsync(codeResult).Result;
Result:
So it's definitely doable. I'll take a shot at adding it to ARMClient (unless you guys want to do it - i'm finding it difficult to commit time lately).
Vittorio's blog post on ADAL 3.x and Device Flow here:
http://www.cloudidentity.com/blog/2015/12/02/new-adal-3-x-previewdevice-profile-linux-and-os-x-sample/
from armclient.
Ha yes, now that I hear 'device flow', that rings a bell from some thread I was on when they were coming up with it for xplat CLI. If you can make it work here, that's awesome.
And hopefully that's the only thing preventing it from using Core (or Mono). The rest should be very portal http request logic.
from armclient.
Well, Device Flow login now works (build this branch) but i broke the X509 cert auth in the process and i'm not sure how to get out of this one:
C:\lab\armclient\bin\Debug>armclient devicelogin
Using OAuth 2.0 Device Flow
You need to sign in.
Message: To sign in, use a web browser to open the page https://aka.ms/devicelogin and
enter the code DY2RRGXVN to authenticate.
Got Bearer token from Device Flow: eyJ0eXAiOiJKV1QiLCJh..
User: [email protected], Tenant: xxxxxxxxxxxxxxxx (microsoft.onmicrosoft.com)
There are 3 subscriptions
Subscription 6xxxxxxxxxxxxxxxx (yyyyyyyyyy)
Subscription axxxxxxxxxxxxx (zzzzzzzzzzzzzzzz)
Subscription bxxxxxxxxxxxxxxx (qqqqqqqqqqqqqq)
User: [email protected], Tenant: xxxxxxxxxxxxxxxxxxxx (swearjarbank.onmicrosoft.com)
There are 0 subscriptions
C:\lab\armclient\bin\Debug>armclient get %testurl%
{
"id": "/subscriptions/axxxx-xxxx-xxxxx-xxxxxx/resourceGroups/securitywhat",
"name": "securitywhat",
"location": "eastus",
"properties": {
"provisioningState": "Succeeded"
}
}
C:\lab\armclient\bin\Debug>armclient listcache
User: [email protected], Tenant: xxxxx-xxxxx-xxxxxx-xxxxxx (microsoft.onmicrosoft.com)
There are 3 subscriptions
Subscription xxxxxxxx
Subscription yyyyyyy
Subscription zzzzzzzz
User: [email protected], Tenant: xxxx-xxxx-xxxx-xxxx (swearjarbank.onmicrosoft.com)
There are 0 subscriptions
Not sure about:
- Token store and refresh tokens, since ADAL 3.0 no longer exposes refresh tokens. Seems the token gets stored correctly in
%userprofile%\.arm
, but will it work in 1 hour? Didn't test. - I'm using
common
here as tenant, am i doing it right? The token seems to be fine. - There's no more
context.AcquireTokenByRefreshTokenAsync()
- so do we just do this instead?
I'm still fixing and testing but would value your input here @davidebbo @ahmelsayed
from armclient.
Looks like i broke the token refresh mechanism.
This is what happens after >1h from devicelogin:
C:\lab\armclient\bin\Debug>armclient get "https://management.azure.com/subscriptions/x-x-x-x/resourceGroups/?api-version=2014-04-01"
The method or operation is not implemented.
Which i believe is this line here.
Well, back to the drawing board.
from armclient.
Presumably, the xplat CLI is able to continue to work after one hour? Sorry, I'm not very familiar with the refresh mechanism.
from armclient.
Yes it is. I suspect i'm not saving the correct thing to offline cache with ADAL 3. I'll figure it out.
from armclient.
Any plans to make armclient cross-platform by porting to .NET Core? Would be handy to have it in Cloud Shell, Linux and Mac.
from armclient.
Thanks @snobu!
from armclient.
Related Issues (20)
- Getting an error during installing Arm client HOT 1
- Issue getting token in Government Environment - Fairfax HOT 1
- Unhandled case: renewal fails because the token is too old
- ADAL v3 HOT 2
- Parameters in Resources#List does not work HOT 2
- Add maintainers to the Chocolatey package HOT 4
- Environment names
- Armclient Dogfood login and request is not working HOT 10
- Azure login fail with azlogin HOT 1
- Setting audience while retrieving token
- Feature idea: option to wait for provisioningState Succeeded
- misposted, please ignore
- What is the latest version? HOT 6
- Unable to login in dogfood environment HOT 1
- 403 Forbidden HOT 1
- How to replicate the armclient token generation in REST?
- Where is ArmClientGui Src?
- Support for device code login in ARM client
- Migrate from ADAL to MSAL or Azure.Identity
- How do you set the `ARMCLIENT_TENANT` environment variable correctly? HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from armclient.