Adding support for ADO service connection in PowershellV2 Task #20726
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
praval-microsoft
force-pushed
the
feature/WiscPSV2Task
branch
from
0f78c68 to
e575715
Compare
praval-microsoft
force-pushed
the
feature/WiscPSV2Task
branch
from
3552b97 to
d58a630
Compare
praval-microsoft
changed the title
merlynomsft
requested changes
Dec 17, 2024
merlynomsft
reviewed
Dec 17, 2024
| @@ -7,6 +7,137 @@ import { validateFileArgs } from './helpers'; | |||
| import { ArgsSanitizingError } from './errors'; | |||
| import { emitTelemetry } from 'azure-pipelines-tasks-utility-common/telemetry'; | |||
| var uuidV4 = require('uuid/v4'); | |||
| import * as msal from "@azure/msal-node"; | |||
There was a problem hiding this comment.
special handling is needed for older node runners (node10 needs msal1). Node10 is used by agent in some scenerios e.g. when using system node for some fallback scenerios. We'll need to ensure we include that to test matrix
| $hub = $taskDict["Hub"] | ||
| $projectId = $taskDict["ProjectId"] | ||
|
|
||
| $url = $uri + "$projectId/_apis/distributedtask/hubs/$hub/plans/$planId/jobs/$jobId/oidctoken?serviceConnectionId=$serviceConnectionId&api-version=7.1-preview.1" |
There was a problem hiding this comment.
Client classes are automatically generated for backend ADO REST APIs.
See TaskHttpClient class, which contains CreateOidcTokenAsync method.
| ) | ||
|
|
||
| $defaultEnvironmentMSALAuthUri = "https://login.microsoftonline.com/" | ||
| $defaultEnvironmentADALAuthUri = "https://login.windows.net/" |
There was a problem hiding this comment.
ADAL has been deprecated.
I would only keep the MSAL path, as the use of ADAL will likely be considered a security issue.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Task name: PowershellV2
Description:
The change is to add support for the Azure Devops Service Connection in the PowershellV2 task.
The requirement is to allow the user to use the Azure Devops Service Connection in the PowershellV2 task and have an utility function to get the access token for that service connection.
We have added a new task input field called azureDevOpsServiceConnection.
To get the access token for the service connection, we have added a new utility function called Get-AzDoToken. User can directly call this method to fetch the access token for the service connection. If an ADO service conn is passed in inputs, this function would return the access token for the ADO service conn, otherwise it would return the default $(System.AccessToken).
For both the node script and the powershell script, we are running a token handler asynchronously which would listen for requests from the UserScript(sent via Get-AzDoToken) and return the access token.
For node script, we have used FIFO pipes for communication between the TokenHandler and the Get-AzDoToken method running in UserScript.
For powershell script, we have used EventHandles for signaling and a shared file for reading and writing the access token.
For code execution flow, refer : https://microsoftapc-my.sharepoint.com/:w:/g/personal/prsinghal_microsoft_com/EY2mag9RXDxChJQ2yqYA1NMBWKQwhNnKjK3KLzYfUzwCiA?e=06W770
Documentation changes required: Y
Added unit tests: (Y/N) Y
Attached related issue: https://dev.azure.com/mseng/AzureDevOps/_workitems/edit/2189744
Checklist: