Skip to content

Commit b6f9d22

Browse files
idg10idg10
committed
Use ClientTenantProvider
1 parent 2799487 commit b6f9d22

6 files changed

Lines changed: 56 additions & 8 deletions

File tree

‎Solutions/Marain.Operations.ControlHost.Functions/local.settings.template.json‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,34 @@
33
"Values": {
44
"AzureWebJobsStorage": "UseDevelopmentStorage=true",
55
"FUNCTIONS_WORKER_RUNTIME": "dotnet",
6-
"ExternalServices:OperationsStatus": "http://localhost:7077/",
76
"AzureServicesAuthConnectionString": "RunAs=Developer; DeveloperTool=AzureCLI",
87
"APPINSIGHTS_INSTRUMENTATIONKEY": "",
98
"ExternalServices__OperationsStatus": "http://localhost:7077/",
109

10+
// If you want to debug against a real storage account in Azure, set AccountName to the full connection string.
11+
// If you want to debug the code the fetches the storage strings from key vault, set AccountName to just the
12+
// storage account name and then set the key vault and secret names, and you'll also need to set
13+
// TenantCloudBlobContainerFactoryOptions__AzureServicesAuthConnectionString
14+
// to a suitable string for authenticating against key vault. If your personal account has access to the key vault, you can use:
15+
// "RunAs=Developer; DeveloperTool=AzureCLI",
16+
// otherwise, set up a suitable service principle, and use:
17+
// "TenantCloudBlobContainerFactoryOptions__AzureServicesAuthConnectionString": "RunAs=App;AppId=AppIdForYourServicePrinciple;TenantId=0f621c67-98a0-4ed5-b5bd-31a35be41e29;AppKey=YourAppSecretHere",
1118
"TenantCloudBlobContainerFactoryOptions__RootTenantBlobStorageConfiguration__AccountName": "UseDevelopmentStorage=true",
1219
"TenantCloudBlobContainerFactoryOptions__RootTenantBlobStorageConfiguration__KeyVaultName": "",
13-
"TenantCloudBlobContainerFactoryOptions__RootTenantBlobStorageConfiguration__AccountKeySecretName": ""
20+
"TenantCloudBlobContainerFactoryOptions__RootTenantBlobStorageConfiguration__AccountKeySecretName": "",
21+
22+
// If running with a local tenancy service, point TenancyClient__TenancyServiceBaseUri at the localhost address for that
23+
"TenancyClient__TenancyServiceBaseUri": "https://maridgtenancy.azurewebsites.net/"
24+
25+
// If instead you point TenancyClient__TenancyServiceBaseUri at an instance in Azure, this local service will need to
26+
// authenticate, which means you'll need to set this this:
27+
// "TenancyClient__ResourceIdForMsiAuthentication": "AppIdSecuringAccessToTenancyFunction"
28+
//
29+
// And for that to work, you won't be able to use tne normal az cli-based AzureServicesAuthConnectionString
30+
// (because az cli is only able to obtain tokens for a fixed set of known Microsoft resource; it can't be
31+
// used to obtain tokens for arbitrary applications that we've defined). Instead, you'll need to create
32+
// a suitable service principle in AAD, grant that service principle access to the tenancy service, and
33+
// set up the credentials like this instead of the setting above:
34+
// "AzureServicesAuthConnectionString": "RunAs=App;AppId=AppIdForYourServicePrinciple;TenantId=0f621c67-98a0-4ed5-b5bd-31a35be41e29;AppKey=YourAppSecretHere"
1435
}
1536
}

‎Solutions/Marain.Operations.Deployment/Templates/functions-app-settings-operations-control-host.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,8 @@
6060
"ExternalServices__OperationsStatus": "[parameters('operationsStatusServiceBaseUrl')]",
6161

6262
"TenantCloudBlobContainerFactoryOptions:RootTenantBlobStorageConfiguration:AccountName": "[parameters('storageAccountName')]",
63-
"TenantCloudBlobContainerFactoryOptions:RootTenantBlobStorageConfiguration:KeyVaultName": "[parameters('storageAccountKeyName')]",
64-
"TenantCloudBlobContainerFactoryOptions:RootTenantBlobStorageConfiguration:AccountKeySecretName": "[parameters('keyVaultName')]"
63+
"TenantCloudBlobContainerFactoryOptions:RootTenantBlobStorageConfiguration:KeyVaultName": "[parameters('keyVaultName')]",
64+
"TenantCloudBlobContainerFactoryOptions:RootTenantBlobStorageConfiguration:AccountKeySecretName": "[parameters('storageAccountKeyName')]"
6565
}
6666
}
6767
],

‎Solutions/Marain.Operations.Deployment/Templates/functions-app-settings-operations-status-host.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,8 @@
5555
"AzureServicesAuthConnectionString": "",
5656

5757
"TenantCloudBlobContainerFactoryOptions:RootTenantBlobStorageConfiguration:AccountName": "[parameters('storageAccountName')]",
58-
"TenantCloudBlobContainerFactoryOptions:RootTenantBlobStorageConfiguration:KeyVaultName": "[parameters('storageAccountKeyName')]",
59-
"TenantCloudBlobContainerFactoryOptions:RootTenantBlobStorageConfiguration:AccountKeySecretName": "[parameters('keyVaultName')]"
58+
"TenantCloudBlobContainerFactoryOptions:RootTenantBlobStorageConfiguration:KeyVaultName": "[parameters('keyVaultName')]",
59+
"TenantCloudBlobContainerFactoryOptions:RootTenantBlobStorageConfiguration:AccountKeySecretName": "[parameters('storageAccountKeyName')]"
6060
}
6161
}
6262
],

‎Solutions/Marain.Operations.Hosting.AspNetCore/Marain.Operations.Hosting.AspNetCore.csproj‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,9 @@
1414
<Import Project="..\Common.NetStandard_2_0.proj" />
1515

1616
<ItemGroup>
17+
<PackageReference Include="Corvus.Identity.ManagedServiceIdentity.ClientAuthentication" Version="0.2.0-preview.5" />
1718
<PackageReference Include="Corvus.Tenancy.Abstractions" Version="0.21.0" />
19+
<PackageReference Include="Marain.Tenancy.ClientTenantProvider" Version="0.3.0-preview.8" />
1820
<PackageReference Include="Menes.Abstractions" Version="0.9.0" />
1921
<PackageReference Include="Menes.Hosting.AspNetCore" Version="0.9.0" />
2022
<PackageReference Include="Newtonsoft.Json" Version="11.0.2" />

‎Solutions/Marain.Operations.Hosting.AspNetCore/Microsoft/Extensions/DependencyInjection/OperationsRepositoryServiceCollectionExtensions.cs‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ namespace Microsoft.Extensions.DependencyInjection
99
using Marain.Operations.OpenApi;
1010
using Marain.Operations.Storage;
1111
using Marain.Operations.Storage.Blob;
12+
using Marain.Tenancy.Client;
1213
using Menes;
1314
using Microsoft.Extensions.Configuration;
1415

@@ -26,7 +27,9 @@ public static class OperationsRepositoryServiceCollectionExtensions
2627
public static IServiceCollection AddTenancyBlobContainerOperationsRepository(
2728
this IServiceCollection services)
2829
{
29-
services.AddTenantProviderBlobStore();
30+
services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>().GetSection("TenancyClient").Get<TenancyClientOptions>());
31+
services.AddAzureManagedIdentityBasedTokenSource();
32+
services.AddTenantProviderServiceClient();
3033
services.AddTenantCloudBlobContainerFactory(sp => sp.GetRequiredService<TenantCloudBlobContainerFactoryOptions>());
3134
services.AddSingleton<IOperationsRepository, OperationsRepository>();
3235

‎Solutions/Marain.Operations.StatusHost.Functions/local.settings.template.json‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,30 @@
66
"AzureServicesAuthConnectionString": "RunAs=Developer; DeveloperTool=AzureCLI",
77
"APPINSIGHTS_INSTRUMENTATIONKEY": "",
88

9+
// If you want to debug against a real storage account in Azure, set AccountName to the full connection string.
10+
// If you want to debug the code the fetches the storage strings from key vault, set AccountName to just the
11+
// storage account name and then set the key vault and secret names, and you'll also need to set
12+
// TenantCloudBlobContainerFactoryOptions__AzureServicesAuthConnectionString
13+
// to a suitable string for authenticating against key vault. If your personal account has access to the key vault, you can use:
14+
// "RunAs=Developer; DeveloperTool=AzureCLI",
15+
// otherwise, set up a suitable service principle, and use:
16+
// "TenantCloudBlobContainerFactoryOptions__AzureServicesAuthConnectionString": "RunAs=App;AppId=AppIdForYourServicePrinciple;TenantId=0f621c67-98a0-4ed5-b5bd-31a35be41e29;AppKey=YourAppSecretHere",
917
"TenantCloudBlobContainerFactoryOptions__RootTenantBlobStorageConfiguration__AccountName": "UseDevelopmentStorage=true",
1018
"TenantCloudBlobContainerFactoryOptions__RootTenantBlobStorageConfiguration__KeyVaultName": "",
11-
"TenantCloudBlobContainerFactoryOptions__RootTenantBlobStorageConfiguration__AccountKeySecretName": ""
19+
"TenantCloudBlobContainerFactoryOptions__RootTenantBlobStorageConfiguration__AccountKeySecretName": "",
20+
21+
// If running with a local tenancy service, point TenancyClient__TenancyServiceBaseUri at the localhost address for that
22+
"TenancyClient__TenancyServiceBaseUri": "https://marYOURENVIRONMENTtenancy.azurewebsites.net/"
23+
24+
// If instead you point TenancyClient__TenancyServiceBaseUri at an instance in Azure, this local service will need to
25+
// authenticate, which means you'll need to set this this:
26+
// "TenancyClient__ResourceIdForMsiAuthentication": "AppIdSecuringAccessToTenancyFunction"
27+
//
28+
// And for that to work, you won't be able to use tne normal az cli-based AzureServicesAuthConnectionString
29+
// (because az cli is only able to obtain tokens for a fixed set of known Microsoft resource; it can't be
30+
// used to obtain tokens for arbitrary applications that we've defined). Instead, you'll need to create
31+
// a suitable service principle in AAD, grant that service principle access to the tenancy service, and
32+
// set up the credentials like this instead of the setting above:
33+
// "AzureServicesAuthConnectionString": "RunAs=App;AppId=AppIdForYourServicePrinciple;TenantId=0f621c67-98a0-4ed5-b5bd-31a35be41e29;AppKey=YourAppSecretHere"
1234
}
1335
}

0 commit comments

Comments
 (0)