[jclouds/jclouds-labs] Injectable current service principal (#424)

[Ignasi Barrera <no...@github.com>]

This PR exposes the current service principal in the Azure API and provides several improvements to allow APIs interact with the current user information and the different OAuth resources.

* It uses the *Graph RBAC* API to retrieve the current Service Principal.
* If binds it to the Guice context to make it injectable as a `Supplier<ServicePrincipal>`. This way it is available where needed (for example in the `KeyVault` classes, to get its `obejctId`).
* It also makes the `tenantId` injectable as: `@Tenant String tenantId`.
* Provides a generic way to specify custom OAuth resources for APIs classes and concrete API methods. To use a custom OAuth resource in an API call just annotate the API or method with `@OAuthResource("custom resource")` and authentication will automatically use the custom one.

@jmspring I think this will be very useful for the KeyVault pull request. Could you give this approach a try? In concrete:

* You'll be able to remove the need to ask for the `objectId` in the properties, as now it is automatically resolved and you can inject the service principal supplier wherever you need the `objectId`.
* It also allows you to configure the entire KeyVault API with the custom OAuth endpoint annotation for a clean OAuth configuration.

You can view, comment on, or merge this pull request online at:

  https://github.com/jclouds/jclouds-labs/pull/424

-- Commit Summary --

  * Injectable current service principal

-- File Changes --

    M azurecompute-arm/src/main/java/org/jclouds/azurecompute/arm/AzureComputeApi.java (40)
    M azurecompute-arm/src/main/java/org/jclouds/azurecompute/arm/AzureComputeProviderMetadata.java (20)
    M azurecompute-arm/src/main/java/org/jclouds/azurecompute/arm/config/AzureComputeHttpApiModule.java (83)
    A azurecompute-arm/src/main/java/org/jclouds/azurecompute/arm/config/AzureOAuthConfigFactory.java (60)
    A azurecompute-arm/src/main/java/org/jclouds/azurecompute/arm/config/GraphRBAC.java (35)
    A azurecompute-arm/src/main/java/org/jclouds/azurecompute/arm/config/OAuthResource.java (35)
    A azurecompute-arm/src/main/java/org/jclouds/azurecompute/arm/config/Tenant.java (34)
    A azurecompute-arm/src/main/java/org/jclouds/azurecompute/arm/domain/ServicePrincipal.java (71)
    A azurecompute-arm/src/test/java/org/jclouds/azurecompute/arm/features/CurrentServicePrincipalApiLiveTest.java (34)

-- Patch Links --

https://github.com/jclouds/jclouds-labs/pull/424.patch
https://github.com/jclouds/jclouds-labs/pull/424.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/jclouds/jclouds-labs/pull/424

Re: [jclouds/jclouds-labs] Injectable current service principal (#424)

[Ignasi Barrera <no...@github.com>]

Thanks for the review @jmspring! According to your comments I've slightly changed the PR to:

* Support both formats of the OAuth endpoint (tests added).
* Extracted the service principal call into a GraphRBACApi class, so we can add additional methods there as needed.
* Modified the structure of the HTTPApiModule and the base mock test class to allow overriding the custom endpoints used in the graph API, and possibly others (as they differ from the endpoint configured when creating the context, and overriding is not trivial).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/jclouds/jclouds-labs/pull/424#issuecomment-348901851

Re: [jclouds/jclouds-labs] Injectable current service principal (#424)

[Jim Spring <no...@github.com>]

jmspring requested changes on this pull request.

Need to be more flexible in handling the oauth endpoint.

>  
 @ConfiguresHttpApi
 public class AzureComputeHttpApiModule extends HttpApiModule<AzureComputeApi> {
 
+   private static final Pattern OAUTH_TENANT_PATTERN = Pattern
+         .compile("https://login.microsoftonline.com/([^/]+)/oauth2/token");
+

```
   private static final Pattern OAUTH_TENANT_PATTERN_MICROSOFT_ONLINE = Pattern
           .compile("https://login.microsoftonline.com/([^/]+)/oauth2/token");
   private static final Pattern OAUTH_TENANT_PATTERN_MICROSOFT = Pattern
           .compile("https://login.microsoft.com/([^/]+)/oauth2/token");
```

>        bind(OAuthScopes.class).toInstance(OAuthScopes.NoScopes.create());
+      bind(OAuthConfigFactory.class).to(AzureOAuthConfigFactory.class).in(Scopes.SINGLETON);
+   }
+
+   @Provides
+   @Singleton
+   @Tenant
+   protected String provideTenant(@Named("oauth.endpoint") final String oauthEndpoint) {
+      Matcher m = OAUTH_TENANT_PATTERN.matcher(oauthEndpoint);
+      if (!m.matches()) {
+         throw new IllegalArgumentException("Could not parse tenantId from: " + oauthEndpoint);
+      }
+      return m.group(1);
+   }
+

```
   protected String provideTenant(@Named("oauth.endpoint") final String oauthEndpoint) {
      Matcher m = OAUTH_TENANT_PATTERN_MICROSOFT_ONLINE.matcher(oauthEndpoint);
      if (!m.matches()) {
         m = OAUTH_TENANT_PATTERN_MICROSOFT.matcher(oauthEndpoint);
         if(!m.matches()) {
            throw new IllegalArgumentException("Could not parse tenantId from: " + oauthEndpoint);
         }
      }
      return m.group(1);
   }
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/jclouds/jclouds-labs/pull/424#pullrequestreview-80632767

Re: [jclouds/jclouds-labs] Injectable current service principal (#424)

[Ignasi Barrera <no...@github.com>]

@nacx pushed 1 commit.

67c5466  Configure the Graph RBAC API and allow mocking service endpoints


-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/jclouds/jclouds-labs/pull/424/files/86fc88f1b07c9d964d554ab32eaf7c07228a127f..67c5466766ea5ae22da7ea91b5ccfae86e16c836

Re: [jclouds/jclouds-labs] Injectable current service principal (#424)

[Jim Spring <no...@github.com>]

@nacx - this worked well.  

Some thoughts re: ObjectID and KeyVault -- the current tests use the configured service principal and give access to that SP for the generated vault for purposes of the tests.  It is possible to grant access to other service principals as well.  So access to the GraphRBAC API to resolve the ObjectId for a general SP might be useful.

Also, I've added a patch to extracting out the TenantID since the URL can vary.  For instance `https://login.microsoft.com` is another valid OAuth endpoint.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/jclouds/jclouds-labs/pull/424#issuecomment-348624756