Federated credentials

[freddydk]

If the AppSourceContext doesn't contain a clientSecret, then we assume that federated credentials have been assigned and are available, so we will try to get an ID_TOKEN and use clientAssertion instead Same with other Auth Context's - if they contain a clientId and no clientSecret, we will use clientAssertion instead.

Azure_Credentials also supports app registrations or managed identities with federated credentials if it contains a clientId without a clientSecret

Here are the supported formats for the various auth contexts:

STORAGECONTEXT (for deliver to storage)

Managed Identity/Federated credential {"storageAccountName":"storageaccountname","clientId":"08b6d80c-68cf-48f9-a5ff-b054326e2ec3","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","containerName":"{project}","blobName":"{version}/{project}-{type}.zip"}

App Registration/Federated credential {"storageAccountName":"storageaccountname","clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","containerName":"{project}","blobName":"{version}/{project}-{type}.zip"}

App Registration/Client Secret {"storageAccountName":"storageaccountname","clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","clientSecret":"OPXxxxxxxxxxxxxxxxxxxxxxxabge","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","containerName":"{project}","blobName":"{version}/{project}-{type}.zip"}

storageAccountName/sastoken {"storageAccountName":"storageaccountname","sastoken":"sv=2022-11-02&ss=b&srt=sco&sp=rwdlaciytf&se=2024-08-06T20:22:08Z&st=2024-04-06T12:22:08Z&spr=https&sig=IZyIf5xxxxxxxxxxxxxxb5I%3D","containerName":"{project}","blobName":"{version}/{project}-{type}.zip"}

storageAccountName/storageAccountKey {"storageAccountName":"storageaccountname","storageAccountKey":"JHFZErCyxxxxxxxxxxxxxxxxXQ==","containerName":"{project}","blobName":"{version}/{project}-{type}.zip"}

AZURE_CREDENTIALS (connection to Azure for secrets and signing)

Access Configuration = Azure role-based access control

Access Control:
Action          Role
Read secrets    Key Vault Secrets User
Sign Apps       Key Vault Crypto User + Key Vault Certificate User

Access Configuration = Vault Access Policy

Action          Permissions:
Read secrets    Secret permissions: Get, List
Sign apps       Cryptographic Operations: Sign + Certificate permissions: Get

Managed Identity/Federated credential {"keyVaultName":"BuildVariables","clientId":"55ce849b-c99d-484c-8999-df9f8df958bd","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47"}

App Registration/Federated credential {"keyVaultName":"BuildVariables","clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47"}

App Registration/Client Secret {"keyVaultName":"BuildVariables","clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","clientSecret":"OPXxxxxxxxxxxxxxxxxxxxxxxabge","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47"}

APPSOURCECONTEXT (for deliver to AppSource)

Managed identity not possible - as this is not an Azure resource

App Registration/Federated credential {"clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","Scopes":"https://api.partner.microsoft.com/.default"}

App Registration/Client Secret {"clientId":"a26651f5-0e90-473c-b4f9-e96119aac8b8","clientSecret":"OPXxxxxxxxxxxxxxxxxxxxxxxabge","tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","Scopes":"https://api.partner.microsoft.com/.default"}

AUTHCONTEXT (for deploy to Business Central)

Managed identity not possible - as this is not an Azure resource

Impersonation/RefreshToken {"TenantID":"69cb4a05-4ea8-482d-9f33-10fb5cf7db05","Scopes":"https://api.businesscentral.dynamics.com/","RefreshToken":"0.AUUAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_s6Eo4YOI","ClientID":"1950a258-227b-4e31-a9cf-717495945fc2"}

App Registration/Federated credential {"TenantID":"69cb4a05-4ea8-482d-9f33-10fb5cf7db05","Scopes":"https://api.businesscentral.dynamics.com/","ClientID":"a26651f5-0e90-473c-b4f9-e96119aac8b8"}

App Registration/Client Secret {"TenantID":"69cb4a05-4ea8-482d-9f33-10fb5cf7db05","Scopes":"https://api.businesscentral.dynamics.com/","ClientID":"a26651f5-0e90-473c-b4f9-e96119aac8b8","ClientSecret":"OPXxxxxxxxxxxxxxxxxxxxxxxabge"}

TODOs

• [x] Add documentation in codesigning.md (rbac)
• [x] Add documentation for appSourceContext federated credentials
• [x] Add documentation for other auth contexts
• [x] Add aka.ms/algosecrets#secretname
• [x] Add End 2 End test testing all these auth methods

This PR also switches to always use the Az PowerShell module (instead of the deprecated AzureRM PowerShell module installed on GitHub Hosted Windows runners)

Fixes #947