Skip to content

Removed usermanaged identity from managed identity credential as Syst… #99

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vandanakvs merged 3 commits into from
Jun 4, 2025
Merged

Removed usermanaged identity from managed identity credential as Syst… #99

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ae30c8c
Removed usermanaged identity from managed identity credential as Syst…
prnikumb Jun 4, 2025
09ffecc
Created common method for managed identity credentials and refered ev…
prnikumb Jun 4, 2025
780e8ee
Merge branch 'main' into users/prnikumb/defaultCredential
charansai143 Jun 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 12 additions & 14 deletions src/service/API/Program.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,14 +38,13 @@ public static IHostBuilder CreateHostBuilder(string[] args)

private static void AddKeyVault(IConfigurationBuilder config)
{
var builtConfig = config.Build();
var builtConfig = config.Build();
TokenCredential credential;
#if DEBUG
credential = new VisualStudioCredential();
#else
credential = new ManagedIdentityCredential(
ManagedIdentityId.FromUserAssignedClientId(builtConfig["UserAssignedClientId"]));
#endif
#if DEBUG
credential = new VisualStudioCredential();
#else
credential = new ManagedIdentityCredential();
#endif

config.AddAzureKeyVault(
new SecretClient(
Expand All @@ -66,14 +65,13 @@ private static void AddAzureAppConfiguration(IConfigurationBuilder config)
string appConfigurationUri = builtConfig["AzureAppConfigurationUri"];
string flightingAppConfigLabel = builtConfig["AppConfiguration:FeatureFlightsLabel"];
string configurationCommonLabel = builtConfig["AppConfiguration:ConfigurationCommonLabel"];
string configurationEnvLabel = builtConfig["AppConfiguration:ConfigurationEnvLabel"];
string configurationEnvLabel = builtConfig["AppConfiguration:ConfigurationEnvLabel"];
TokenCredential credential;
#if DEBUG
credential = new VisualStudioCredential();
#else
credential = new ManagedIdentityCredential(
ManagedIdentityId.FromUserAssignedClientId(builtConfig["UserAssignedClientId"]));
#endif
#if DEBUG
Copy link
Copy Markdown
Collaborator

@vandanakvs vandanakvs Jun 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we add a common function?
In future if we have to update this code, it should be only one place

Copy link
Copy Markdown
Author

@prnikumb123 prnikumb123 Jun 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

credential = new VisualStudioCredential();
#else
credential = new ManagedIdentityCredential();
#endif

config.AddAzureAppConfiguration(options =>
{
Expand Down
5 changes: 2 additions & 3 deletions src/service/Common/Authentication/ITokenGenerator.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,8 @@ public interface ITokenGenerator
/// </summary>
/// <param name="authority">Authority to generate the token</param>
/// <param name="clientId">ID of the application for generating the token</param>
/// <param name="resourceId">Resource ID for which the token is generated</param>
/// <param name="userAssignedClientId">user Assigned Client Id</param>
/// <param name="resourceId">Resource ID for which the token is generated</param>
/// <returns>Bearer token</returns>
Task<string> GenerateToken(string authority, string clientId, string resourceId, string userAssignedClientId);
Task<string> GenerateToken(string authority, string clientId, string resourceId);
}
}
5 changes: 2 additions & 3 deletions src/service/Common/Authorization/IAuthorizationService.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,10 +29,9 @@ public interface IAuthorizationService
/// </summary>
/// <param name="authority">IDP authority</param>
/// <param name="clientId">AAD Client ID</param>
/// <param name="resourceId">AAD Client ID against which the token is acquired</param>
/// <param name="userAssignedClientId">user Assigned Client Id</param>
/// <param name="resourceId">AAD Client ID against which the token is acquired</param>
/// <returns>Bearer token</returns>
Task<string> GetAuthenticationToken(string authority, string clientId, string resourceId,string userAssignedClientId);
Task<string> GetAuthenticationToken(string authority, string clientId, string resourceId);

/// <summary>
/// Augments the user identity with the required claims
Expand Down
11 changes: 5 additions & 6 deletions src/service/Infrastructure/AppConfig/AzureConfigurationClientProvider.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,12 +33,11 @@ public ConfigurationClient GetConfigurationClient()
options.Retry.MaxRetries = 10;
options.Retry.Delay = TimeSpan.FromSeconds(1);
TokenCredential credential;
#if DEBUG
credential = new VisualStudioCredential();
#else
credential = new ManagedIdentityCredential(
ManagedIdentityId.FromUserAssignedClientId(_configuration["UserAssignedClientId"]));
#endif
#if DEBUG
credential = new VisualStudioCredential();
#else
credential = new ManagedIdentityCredential();
#endif
string appConfigUri = _configuration["AzureAppConfigurationUri"];
_configurationClient = new ConfigurationClient(new Uri(appConfigUri), credential, options);
return _configurationClient;
Expand Down
8 changes: 4 additions & 4 deletions src/service/Infrastructure/Authentication/AadTokenGenerator.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,17 +26,17 @@ public AadTokenGenerator()
}

// <inheritdoc/>
public async Task<string> GenerateToken(string authority, string clientId, string resourceId, string userAssignedClientId)
public async Task<string> GenerateToken(string authority, string clientId, string resourceId)
{
IConfidentialClientApplication client = GetOrCreateConfidentialApp(authority, clientId, userAssignedClientId);
IConfidentialClientApplication client = GetOrCreateConfidentialApp(authority, clientId);
var scopes = new string[] { resourceId };
AuthenticationResult authenticationResult = await client
.AcquireTokenForClient(scopes)
.ExecuteAsync();
return authenticationResult.AccessToken;
}

private IConfidentialClientApplication GetOrCreateConfidentialApp(string authority, string clientId, string userAssignedClientId)
private IConfidentialClientApplication GetOrCreateConfidentialApp(string authority, string clientId)
{
string confidentialAppCacheKey = CreateConfidentialAppCacheKey(authority, clientId);
if (_cache.ContainsKey(confidentialAppCacheKey))
Expand All @@ -58,7 +58,7 @@ private IConfidentialClientApplication GetOrCreateConfidentialApp(string authori
return client;

#else
var credential = new ManagedIdentityCredential(userAssignedClientId);
var credential = new ManagedIdentityCredential();

IConfidentialClientApplication client =
ConfidentialClientApplicationBuilder
Expand Down
8 changes: 4 additions & 4 deletions src/service/Infrastructure/Authorization/AuthorizationService.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,14 +75,14 @@ public bool IsAuthorized(string appName)
return false;
}

public async Task<string> GetAuthenticationToken(string authority, string clientId, string resourceId,string userAssignedClientId)
public async Task<string> GetAuthenticationToken(string authority, string clientId, string resourceId)
{
AuthenticationResult authenticationResult;
const string MsalScopeSuffix = "/.default";
string bearerToken = null;
try
{
IConfidentialClientApplication app = GetOrCreateConfidentialApp(authority, clientId, userAssignedClientId);
IConfidentialClientApplication app = GetOrCreateConfidentialApp(authority, clientId);
if (app != null)
{
var scopes = new[] { resourceId + MsalScopeSuffix };
Expand All @@ -97,7 +97,7 @@ public async Task<string> GetAuthenticationToken(string authority, string client
return bearerToken;
}

private IConfidentialClientApplication GetOrCreateConfidentialApp(string authority, string clientId,string userAssignedClientId)
private IConfidentialClientApplication GetOrCreateConfidentialApp(string authority, string clientId)
{
string confidentialAppCacheKey = $"{authority}-{clientId}";
if (_confidentialApps.ContainsKey(confidentialAppCacheKey))
Expand All @@ -115,7 +115,7 @@ private IConfidentialClientApplication GetOrCreateConfidentialApp(string authori
_confidentialApps.TryAdd(confidentialAppCacheKey, app);
return app;
#else
var credential = new ManagedIdentityCredential(userAssignedClientId);
var credential = new ManagedIdentityCredential();
IConfidentialClientApplication app =
ConfidentialClientApplicationBuilder
.Create(clientId)
Expand Down
2 changes: 1 addition & 1 deletion src/service/Infrastructure/Graph/GraphGroupVerificationService.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,7 @@ private IGraphServiceClient CreateGraphClient(IConfiguration configuration)
_cache.Add(confidentialAppCacheKey, client);

#else
var credential = new ManagedIdentityCredential(configuration["UserAssignedClientId"]);
var credential = new ManagedIdentityCredential();
IConfidentialClientApplication client =
ConfidentialClientApplicationBuilder
.Create(configuration["Graph:ClientId"])
Expand Down
11 changes: 5 additions & 6 deletions src/service/Infrastructure/Storage/BlobProviderFactory.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,11 @@ public BlobProviderFactory(ITenantConfigurationProvider tenantConfigurationProvi
_configuration = configuration;
if (_defaultAzureCredential == null)
{
#if DEBUG
_defaultAzureCredential = new VisualStudioCredential();
#else
_defaultAzureCredential = new ManagedIdentityCredential(
ManagedIdentityId.FromUserAssignedClientId(_configuration["UserAssignedClientId"]));
#endif
#if DEBUG
_defaultAzureCredential = new VisualStudioCredential();
#else
_defaultAzureCredential = new ManagedIdentityCredential();
#endif
}
}

Expand Down
9 changes: 4 additions & 5 deletions src/service/Infrastructure/Storage/CosmosDbRepository.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,11 +42,10 @@ public CosmosDbRepository(CosmosDbConfiguration cosmosConfiguration, IConfigurat
MaxRetryAttemptsOnRateLimitedRequests = int.Parse(_configuration["CosmosDb:MaxRetryAttemptsOnRateLimitedRequests"])
};
TokenCredential credential;
#if DEBUG
credential = new VisualStudioCredential();
#else
credential = new ManagedIdentityCredential(
ManagedIdentityId.FromUserAssignedClientId(_configuration["UserAssignedClientId"]));
#if DEBUG
credential = new VisualStudioCredential();
#else
credential = new ManagedIdentityCredential();
#endif

CosmosClient client = new(cosmosConfiguration.Endpoint, credential, options);
Expand Down
8 changes: 4 additions & 4 deletions src/service/Infrastructure/Webhook/WebhookTriggerManager.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
using Microsoft.Extensions.Configuration;

namespace Microsoft.FeatureFlighting.Infrastructure.Webhook
{
{
// <inheritdoc/>
internal class WebhookTriggerManager: IWebhookTriggerManager
{
Expand All @@ -26,7 +26,7 @@ internal class WebhookTriggerManager: IWebhookTriggerManager
public IConfiguration _configuration { get; }

public WebhookTriggerManager(IHttpClientFactory httpClientFactory, ITokenGenerator tokenGenerator, ILogger logger, IConfiguration configuration)
{
{
_httpClientFactory = httpClientFactory;
_tokenGenerator = tokenGenerator;
_logger= logger;
Expand All @@ -49,7 +49,7 @@ public async Task<string> Trigger(WebhookConfiguration webhook, string payload,

DependencyContext dependency = CreateDependencyContext(webhook, trackingIds);
HttpRequestMessage request = new(new HttpMethod(webhook.HttpMethod), webhook.Uri ?? "");
string bearerToken = await _tokenGenerator.GenerateToken(webhook.AuthenticationAuthority, webhook.ClientId, webhook.ResourceId, _configuration["UserAssignedClientId"]);
string bearerToken = await _tokenGenerator.GenerateToken(webhook.AuthenticationAuthority, webhook.ClientId, webhook.ResourceId);
request.Headers.Add("Authorization", $"Bearer {bearerToken}");
request.Headers.Add("x-correlationId", trackingIds.CorrelationId);
request.Headers.Add("x-messageId", trackingIds.TransactionId);
Expand All @@ -62,7 +62,7 @@ public async Task<string> Trigger(WebhookConfiguration webhook, string payload,
request.Headers.Add(header.Key, header.Value);
}
}

request.Content = new StringContent(payload, Encoding.UTF8, "application/json");
dependency.RequestDetails = payload;

Expand Down
Loading