Golang azure.NewServicePrincipalToken函数代码示例

// NewServicePrincipalTokenFromCredentials creates a new ServicePrincipalToken using values of the
// passed credentials map.
func NewServicePrincipalTokenFromCredentials(c map[string]string, scope string) (*azure.ServicePrincipalToken, error) {
	oauthConfig, err := azure.PublicCloud.OAuthConfigForTenant(c["tenantID"])
	if err != nil {
		panic(err)
	}
	return azure.NewServicePrincipalToken(*oauthConfig, c["clientID"], c["clientSecret"], scope)
}

// NewServicePrincipalTokenFromCredentials creates a new ServicePrincipalToken using values of the
// passed credentials map.
func (c *DNSProvider) newServicePrincipalTokenFromCredentials(scope string) (*azure.ServicePrincipalToken, error) {
	oauthConfig, err := azure.PublicCloud.OAuthConfigForTenant(c.tenantId)
	if err != nil {
		panic(err)
	}
	return azure.NewServicePrincipalToken(*oauthConfig, c.clientId, c.clientSecret, scope)
}

func getStorageAccountAccessKey(conf map[string]string, resourceGroupName, storageAccountName string) (string, error) {
	creds, err := getCredentialsFromConf(conf)
	if err != nil {
		return "", err
	}

	oauthConfig, err := azure.PublicCloud.OAuthConfigForTenant(creds.TenantID)
	if err != nil {
		return "", err
	}
	if oauthConfig == nil {
		return "", fmt.Errorf("Unable to configure OAuthConfig for tenant %s", creds.TenantID)
	}

	spt, err := azure.NewServicePrincipalToken(*oauthConfig, creds.ClientID, creds.ClientSecret, azure.PublicCloud.ResourceManagerEndpoint)
	if err != nil {
		return "", err
	}

	accountsClient := storage.NewAccountsClient(creds.SubscriptionID)
	accountsClient.Authorizer = spt

	keys, err := accountsClient.ListKeys(resourceGroupName, storageAccountName)
	if err != nil {
		return "", fmt.Errorf("Error retrieving keys for storage account %q: %s", storageAccountName, err)
	}

	if keys.Key1 == nil {
		return "", fmt.Errorf("Nil key returned for storage account %q", storageAccountName)
	}

	return *keys.Key1, nil
}

// AuthToken returns a service principal token, suitable for authorizing
// Resource Manager API requests, based on the supplied CloudSpec.
func AuthToken(cloud environs.CloudSpec, sender autorest.Sender) (*azure.ServicePrincipalToken, error) {
	if authType := cloud.Credential.AuthType(); authType != clientCredentialsAuthType {
		// We currently only support a single auth-type for
		// non-interactive authentication. Interactive auth
		// is used only to generate a service-principal.
		return nil, errors.NotSupportedf("auth-type %q", authType)
	}

	credAttrs := cloud.Credential.Attributes()
	subscriptionId := credAttrs[credAttrSubscriptionId]
	appId := credAttrs[credAttrAppId]
	appPassword := credAttrs[credAttrAppPassword]
	client := subscriptions.Client{subscriptions.NewWithBaseURI(cloud.Endpoint)}
	client.Sender = sender
	oauthConfig, _, err := azureauth.OAuthConfig(client, cloud.Endpoint, subscriptionId)
	if err != nil {
		return nil, errors.Trace(err)
	}

	resource := azureauth.TokenResource(cloud.Endpoint)
	token, err := azure.NewServicePrincipalToken(
		*oauthConfig,
		appId,
		appPassword,
		resource,
	)
	if err != nil {
		return nil, errors.Annotate(err, "constructing service principal token")
	}
	if sender != nil {
		token.SetSender(sender)
	}
	return token, nil
}

func (b *Builder) createServicePrincipalToken() (*azure.ServicePrincipalToken, error) {
	spt, err := azure.NewServicePrincipalToken(
		b.config.ClientID,
		b.config.ClientSecret,
		b.config.TenantID,
		azure.AzureResourceManagerScope)

	return spt, err
}

func (c *Config) NewClient() (*Client, error) {

	token, err := azure.NewServicePrincipalToken(c.ClientSecret, c.ClientSecret, c.TenantID, azure.AzureResourceManagerScope)
	if err != nil {
		return &Client{
			servicePrincipalToken: token,
			resourceGroupsClient:  resources.NewResourceGroupsClient(c.SubscriptionID),
			mutex:                 &sync.Mutex{},
		}, nil
	} else {
		return nil, err
	}
}

// ServicePrincipalAuth creates a new AuthFunc that authenticates to Azure
// using the provided Service Principal Account credentials (client_id and
// client_secret).
func ServicePrincipalAuth(spID, spPassword string) AuthFunc {
	return func(oauthCfg azure.OAuthConfig, _, resource string) (*azure.ServicePrincipalToken, error) {
		spt, err := azure.NewServicePrincipalToken(oauthCfg, spID, spPassword, resource)
		if err != nil {
			return nil, err
		}
		// force Refresh() to get a token to be stored.
		if err := spt.Refresh(); err != nil {
			return nil, fmt.Errorf("Failed to get a token with service principal: %v", err)
		}
		return spt, nil
	}
}

// Create an Azure cluster.
func (clst *azureCluster) Connect(namespace string) error {
	if namespace == "" {
		return errors.New("namespace cannot be empty")
	}
	clst.namespace = namespace

	if err := clst.loadCredentials(); err != nil {
		return errors.New("failed to load Azure credentials")
	}

	oauthConfig, err := azure.PublicCloud.OAuthConfigForTenant(clst.tenantID)
	if err != nil {
		return errors.New("failed to configure OAuthConfig for tenant")
	}

	spt, err := azure.NewServicePrincipalToken(*oauthConfig, clst.clientID,
		clst.clientSecret, azure.PublicCloud.ResourceManagerEndpoint)
	if err != nil {
		return err
	}

	client := azureClient{}

	client.ifaceClient = network.NewInterfacesClient(clst.subscriptionID)
	client.ifaceClient.Authorizer = spt

	client.publicIPClient = network.NewPublicIPAddressesClient(clst.subscriptionID)
	client.publicIPClient.Authorizer = spt

	client.secGroupClient = network.NewSecurityGroupsClient(clst.subscriptionID)
	client.secGroupClient.Authorizer = spt

	client.secRulesClient = network.NewSecurityRulesClient(clst.subscriptionID)
	client.secRulesClient.Authorizer = spt

	client.vnetClient = network.NewVirtualNetworksClient(clst.subscriptionID)
	client.vnetClient.Authorizer = spt

	client.rgClient = resources.NewGroupsClient(clst.subscriptionID)
	client.rgClient.Authorizer = spt

	client.storageClient = storage.NewAccountsClient(clst.subscriptionID)
	client.storageClient.Authorizer = spt

	client.vmClient = compute.NewVirtualMachinesClient(clst.subscriptionID)
	client.vmClient.Authorizer = spt

	clst.azureClient = client

	return clst.configureResourceGroup()
}

func (a *Authenticate) getServicePrincipalTokenWithResource(resource string) (*azure.ServicePrincipalToken, error) {
	oauthConfig, err := newOAuthConfigWithTenant(a.tenantID)
	if err != nil {
		return nil, err
	}

	spt, err := azure.NewServicePrincipalToken(
		*oauthConfig,
		a.clientID,
		a.clientSecret,
		resource)

	return spt, err
}

func (b *Builder) createServicePrincipalToken() (*azure.ServicePrincipalToken, error) {
	oauthConfig, err := azure.PublicCloud.OAuthConfigForTenant(b.config.TenantID)
	if err != nil {
		return nil, err
	}

	spt, err := azure.NewServicePrincipalToken(
		*oauthConfig,
		b.config.ClientID,
		b.config.ClientSecret,
		azure.PublicCloud.ResourceManagerEndpoint)

	return spt, err
}

// AuthenticateServicePrincipal uses given service principal credentials to return a
// service principal token. Generated token is not stored in a cache file or refreshed.
func AuthenticateServicePrincipal(env azure.Environment, subscriptionID, spID, spPassword string) (*azure.ServicePrincipalToken, error) {
	tenantID, err := loadOrFindTenantID(env, subscriptionID)
	if err != nil {
		return nil, err
	}
	oauthCfg, err := env.OAuthConfigForTenant(tenantID)
	if err != nil {
		return nil, fmt.Errorf("Failed to obtain oauth config for azure environment: %v", err)
	}

	spt, err := azure.NewServicePrincipalToken(*oauthCfg, spID, spPassword, getScope(env))
	if err != nil {
		return nil, fmt.Errorf("Failed to create service principal token: %+v", err)
	}
	return spt, nil
}

// createAzureClient is a helper function for creating an Azure compute client to ARM.
func createAzureClient(cfg config.AzureSDConfig) (azureClient, error) {
	var c azureClient
	oauthConfig, err := azure.PublicCloud.OAuthConfigForTenant(cfg.TenantID)
	if err != nil {
		return azureClient{}, err
	}
	spt, err := azure.NewServicePrincipalToken(*oauthConfig, cfg.ClientID, cfg.ClientSecret, azure.PublicCloud.ResourceManagerEndpoint)
	if err != nil {
		return azureClient{}, err
	}

	c.vm = compute.NewVirtualMachinesClient(cfg.SubscriptionID)
	c.vm.Authorizer = spt

	c.nic = network.NewInterfacesClient(cfg.SubscriptionID)
	c.nic.Authorizer = spt

	return c, nil
}

func (a *acrProvider) Enabled() bool {
	if a.file == nil || len(*a.file) == 0 {
		glog.V(5).Infof("Azure config unspecified, disabling")
		return false
	}
	contents, err := ioutil.ReadFile(*a.file)
	if err != nil {
		glog.Errorf("Failed to load azure credential file: %v", err)
		return false
	}
	if err := a.loadConfig(contents); err != nil {
		glog.Errorf("Failed to parse azure credential file: %v", err)
		return false
	}

	oauthConfig, err := a.environment.OAuthConfigForTenant(a.config.TenantID)
	if err != nil {
		glog.Errorf("Failed to get oauth config: %v", err)
		return false
	}

	servicePrincipalToken, err := azureapi.NewServicePrincipalToken(
		*oauthConfig,
		a.config.AADClientID,
		a.config.AADClientSecret,
		a.environment.ServiceManagementEndpoint)
	if err != nil {
		glog.Errorf("Failed to create service principal token: %v", err)
		return false
	}

	registryClient := containerregistry.NewRegistriesClient(a.config.SubscriptionID)
	registryClient.BaseURI = a.environment.ResourceManagerEndpoint
	registryClient.Authorizer = servicePrincipalToken
	a.registryClient = registryClient

	return true
}

// NewServicePrincipalTokenFromCredentials creates a new ServicePrincipalToken using values of the
// passed credentials map.
func NewServicePrincipalTokenFromCredentials(c map[string]string, scope string) (*azure.ServicePrincipalToken, error) {
	return azure.NewServicePrincipalToken(c["clientID"], c["clientSecret"], c["tenantID"], scope)
}

// NewCloud returns a Cloud with initialized clients
func NewCloud(configReader io.Reader) (cloudprovider.Interface, error) {
	var az Cloud

	configContents, err := ioutil.ReadAll(configReader)
	if err != nil {
		return nil, err
	}
	err = yaml.Unmarshal(configContents, &az)
	if err != nil {
		return nil, err
	}

	if az.Cloud == "" {
		az.Environment = azure.PublicCloud
	} else {
		az.Environment, err = azure.EnvironmentFromName(az.Cloud)
		if err != nil {
			return nil, err
		}
	}

	oauthConfig, err := az.Environment.OAuthConfigForTenant(az.TenantID)
	if err != nil {
		return nil, err
	}

	servicePrincipalToken, err := azure.NewServicePrincipalToken(
		*oauthConfig,
		az.AADClientID,
		az.AADClientSecret,
		az.Environment.ServiceManagementEndpoint)
	if err != nil {
		return nil, err
	}

	az.SubnetsClient = network.NewSubnetsClient(az.SubscriptionID)
	az.SubnetsClient.BaseURI = az.Environment.ResourceManagerEndpoint
	az.SubnetsClient.Authorizer = servicePrincipalToken

	az.RouteTablesClient = network.NewRouteTablesClient(az.SubscriptionID)
	az.RouteTablesClient.BaseURI = az.Environment.ResourceManagerEndpoint
	az.RouteTablesClient.Authorizer = servicePrincipalToken

	az.RoutesClient = network.NewRoutesClient(az.SubscriptionID)
	az.RoutesClient.BaseURI = az.Environment.ResourceManagerEndpoint
	az.RoutesClient.Authorizer = servicePrincipalToken

	az.InterfacesClient = network.NewInterfacesClient(az.SubscriptionID)
	az.InterfacesClient.BaseURI = az.Environment.ResourceManagerEndpoint
	az.InterfacesClient.Authorizer = servicePrincipalToken

	az.LoadBalancerClient = network.NewLoadBalancersClient(az.SubscriptionID)
	az.LoadBalancerClient.BaseURI = az.Environment.ResourceManagerEndpoint
	az.LoadBalancerClient.Authorizer = servicePrincipalToken

	az.VirtualMachinesClient = compute.NewVirtualMachinesClient(az.SubscriptionID)
	az.VirtualMachinesClient.BaseURI = az.Environment.ResourceManagerEndpoint
	az.VirtualMachinesClient.Authorizer = servicePrincipalToken

	az.PublicIPAddressesClient = network.NewPublicIPAddressesClient(az.SubscriptionID)
	az.PublicIPAddressesClient.BaseURI = az.Environment.ResourceManagerEndpoint
	az.PublicIPAddressesClient.Authorizer = servicePrincipalToken

	az.SecurityGroupsClient = network.NewSecurityGroupsClient(az.SubscriptionID)
	az.SecurityGroupsClient.BaseURI = az.Environment.ResourceManagerEndpoint
	az.SecurityGroupsClient.Authorizer = servicePrincipalToken

	az.StorageAccountClient = storage.NewAccountsClientWithBaseURI(az.Environment.ResourceManagerEndpoint, az.SubscriptionID)
	az.StorageAccountClient.Authorizer = servicePrincipalToken
	return &az, nil
}