[AuthV2] Nov 2022 Bug Fixes and Improvements

src/authV2/azext_authV2/_params.py

@@ -65,6 +65,8 @@ def load_arguments(self, _):
                    help='The name of the header containing the host of the request.')
         c.argument('proxy_custom_proto_header', options_list=['--proxy-custom-proto-header', '--custom-proto-header'],
                    help='The name of the header containing the scheme of the request.')
+        c.argument('excluded_paths', options_list=['--excluded-paths'],
+                   help='The list of paths that should be excluded from authentication rules.')
 
     with self.argument_context('webapp auth microsoft update') as c:
         c.argument('client_id', options_list=['--client-id'],
@@ -77,6 +79,12 @@ def load_arguments(self, _):
                    help='The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application.')
         c.argument('allowed_token_audiences', options_list=['--allowed-token-audiences', '--allowed-audiences'],
                    help='The configuration settings of the allowed list of audiences from which to validate the JWT token.')
+        c.argument('client_secret_certificate_thumbprint', options_list=['--thumbprint', '--client-secret-certificate-thumbprint'],
+                   help='Alternative to AAD Client Secret, thumbprint of a certificate used for signing purposes')
+        c.argument('client_secret_certificate_san', options_list=['--san', '--client-secret-certificate-san'],
+                   help='Alternative to AAD Client Secret and thumbprint, subject alternative name of a certificate used for signing purposes')
+        c.argument('client_secret_certificate_issuer', options_list=['--certificate-issuer', '--client-secret-certificate-issuer'],
+                   help='Alternative to AAD Client Secret and thumbprint, issuer of a certificate used for signing purposes')
         c.argument('yes', options_list=['--yes', '-y'], help='Do not prompt for confirmation.', action='store_true')
         c.argument('tenant_id', options_list=['--tenant-id'],
                    help='The tenant id of the application.')

src/authV2/azext_authV2/custom.py

@@ -10,6 +10,7 @@
 from azure.cli.core.util import send_raw_request
 from azure.cli.command_modules.appservice._appservice_utils import _generic_site_operation
 from azure.cli.command_modules.appservice.custom import update_app_settings
+from azure.cli.core.azclierror import ArgumentUsageError
 from azure.cli.core.commands.client_factory import get_subscription_id
 from azure.cli.command_modules.appservice._params import AUTH_TYPES
 from azure.cli.core.cloud import AZURE_PUBLIC_CLOUD, AZURE_CHINA_CLOUD, AZURE_US_GOV_CLOUD, AZURE_GERMAN_CLOUD
@@ -119,7 +120,7 @@ def update_auth_settings_v2(cmd, resource_group_name, name, set_string=None, ena
                             runtime_version=None, config_file_path=None, unauthenticated_client_action=None,  # pylint: disable=unused-argument
                             redirect_provider=None, enable_token_store=None, require_https=None,  # pylint: disable=unused-argument
                             proxy_convention=None, proxy_custom_host_header=None,  # pylint: disable=unused-argument
-                            proxy_custom_proto_header=None, slot=None):  # pylint: disable=unused-argument
+                            proxy_custom_proto_header=None, excluded_paths=None, slot=None):  # pylint: disable=unused-argument
     existing_auth = get_auth_settings_v2(cmd, resource_group_name, name, slot)["properties"]
     existing_auth = set_field_in_auth_settings(existing_auth, set_string)
 
@@ -155,6 +156,12 @@ def update_auth_settings_v2(cmd, resource_group_name, name, set_string=None, ena
             existing_auth["login"]["tokenStore"] = {}
         existing_auth["login"]["tokenStore"]["enabled"] = enable_token_store
 
+    if excluded_paths is not None:
+        if "globalValidation" not in existing_auth.keys():
+            existing_auth["globalValidation"] = {}
+        excluded_paths_list_string = excluded_paths[1:-1]
+        existing_auth["globalValidation"]["excludedPaths"] = excluded_paths_list_string.split(",")
+
     existing_auth = update_http_settings_in_auth_settings(existing_auth, require_https,
                                                           proxy_convention, proxy_custom_host_header,
                                                           proxy_custom_proto_header)
@@ -242,7 +249,11 @@ def is_app_new_to_auth(cmd, resource_group_name, name, slot):
 
 def set_field_in_auth_settings_recursive(field_name_split, field_value, auth_settings):
     if len(field_name_split) == 1:
-        auth_settings[field_name_split[0]] = field_value
+        if not field_value.startswith('[') or not field_value.endswith(']'):
+            auth_settings[field_name_split[0]] = field_value
+        else:
+            field_value_list_string = field_value[1:-1]
+            auth_settings[field_name_split[0]] = field_value_list_string.split(",")
         return auth_settings
 
     remaining_field_names = field_name_split[1:]
@@ -452,14 +463,42 @@ def get_aad_settings(cmd, resource_group_name, name, slot=None):
 def update_aad_settings(cmd, resource_group_name, name, slot=None,  # pylint: disable=unused-argument
                         client_id=None, client_secret_setting_name=None,  # pylint: disable=unused-argument
                         issuer=None, allowed_token_audiences=None, client_secret=None,  # pylint: disable=unused-argument
+                        client_secret_certificate_thumbprint=None,  # pylint: disable=unused-argument
+                        client_secret_certificate_san=None,  # pylint: disable=unused-argument
+                        client_secret_certificate_issuer=None,  # pylint: disable=unused-argument
                         yes=False, tenant_id=None):    # pylint: disable=unused-argument
     if client_secret is not None and client_secret_setting_name is not None:
-        raise CLIError('Usage Error: --client-secret and --client-secret-setting-name cannot both be '
-                       'configured to non empty strings')
+        raise ArgumentUsageError('Usage Error: --client-secret and --client-secret-setting-name cannot both be '
+                                 'configured to non empty strings')
+
+    if client_secret_setting_name is not None and client_secret_certificate_thumbprint is not None:
+        raise ArgumentUsageError('Usage Error: --client-secret-setting-name and --thumbprint cannot both be '
+                                 'configured to non empty strings')
+
+    if client_secret is not None and client_secret_certificate_thumbprint is not None:
+        raise ArgumentUsageError('Usage Error: --client-secret and --thumbprint cannot both be '
+                                 'configured to non empty strings')
+
+    if client_secret is not None and client_secret_certificate_san is not None:
+        raise ArgumentUsageError('Usage Error: --client-secret and --san cannot both be '
+                                 'configured to non empty strings')
+
+    if client_secret_setting_name is not None and client_secret_certificate_san is not None:
+        raise ArgumentUsageError('Usage Error: --client-secret-setting-name and --san cannot both be '
+                                 'configured to non empty strings')
+
+    if client_secret_certificate_thumbprint is not None and client_secret_certificate_san is not None:
+        raise ArgumentUsageError('Usage Error: --thumbprint and --san cannot both be '
+                                 'configured to non empty strings')
+
+    if ((client_secret_certificate_san is not None and client_secret_certificate_issuer is None) or
+            (client_secret_certificate_san is None and client_secret_certificate_issuer is not None)):
+        raise ArgumentUsageError('Usage Error: --san and --certificate-issuer must both be '
+                                 'configured to non empty strings')
 
     if issuer is not None and (tenant_id is not None):
-        raise CLIError('Usage Error: --issuer and --tenant-id cannot be configured '
-                       'to non empty strings at the same time.')
+        raise ArgumentUsageError('Usage Error: --issuer and --tenant-id cannot be configured '
+                                 'to non empty strings at the same time.')
 
     is_new_aad_app = False
     existing_auth = get_auth_settings_v2(cmd, resource_group_name, name, slot)["properties"]
@@ -497,7 +536,10 @@ def update_aad_settings(cmd, resource_group_name, name, slot=None,  # pylint: di
     if "azureActiveDirectory" not in existing_auth["identityProviders"].keys():
         existing_auth["identityProviders"]["azureActiveDirectory"] = {}
     if (client_id is not None or client_secret is not None or
-            client_secret_setting_name is not None or openid_issuer is not None):
+            client_secret_setting_name is not None or openid_issuer is not None or
+            client_secret_certificate_thumbprint is not None or
+            client_secret_certificate_san is not None or
+            client_secret_certificate_issuer is not None):
         if "registration" not in existing_auth["identityProviders"]["azureActiveDirectory"].keys():
             existing_auth["identityProviders"]["azureActiveDirectory"]["registration"] = {}
         registration = existing_auth["identityProviders"]["azureActiveDirectory"]["registration"]
@@ -515,13 +557,40 @@ def update_aad_settings(cmd, resource_group_name, name, slot=None,  # pylint: di
         settings = []
         settings.append(MICROSOFT_SECRET_SETTING_NAME + '=' + client_secret)
         update_app_settings(cmd, resource_group_name, name, slot=slot, slot_settings=settings)
+    if client_secret_setting_name is not None or client_secret is not None:
+        if "clientSecretCertificateThumbprint" in registration.keys() and registration["clientSecretCertificateThumbprint"] is not None:
+            registration["clientSecretCertificateThumbprint"] = None
+        if "clientSecretCertificateSubjectAlternativeName" in registration.keys() and registration["clientSecretCertificateSubjectAlternativeName"] is not None:
+            registration["clientSecretCertificateSubjectAlternativeName"] = None
+        if "clientSecretCertificateIssuer" in registration.keys() and registration["clientSecretCertificateIssuer"] is not None:
+            registration["clientSecretCertificateIssuer"] = None
+    if client_secret_certificate_thumbprint is not None:
+        registration["clientSecretCertificateThumbprint"] = client_secret_certificate_thumbprint
+        if "clientSecretSettingName" in registration.keys() and registration["clientSecretSettingName"] is not None:
+            registration["clientSecretSettingName"] = None
+        if "clientSecretCertificateSubjectAlternativeName" in registration.keys() and registration["clientSecretCertificateSubjectAlternativeName"] is not None:
+            registration["clientSecretCertificateSubjectAlternativeName"] = None
+        if "clientSecretCertificateIssuer" in registration.keys() and registration["clientSecretCertificateIssuer"] is not None:
+            registration["clientSecretCertificateIssuer"] = None
+    if client_secret_certificate_san is not None:
+        registration["clientSecretCertificateSubjectAlternativeName"] = client_secret_certificate_san
+    if client_secret_certificate_issuer is not None:
+        registration["clientSecretCertificateIssuer"] = client_secret_certificate_issuer
+    if client_secret_certificate_san is not None and client_secret_certificate_issuer is not None:
+        if "clientSecretSettingName" in registration.keys() and registration["clientSecretSettingName"] is not None:
+            registration["clientSecretSettingName"] = None
+        if "clientSecretCertificateThumbprint" in registration.keys() and registration["clientSecretCertificateThumbprint"] is not None:
+            registration["clientSecretCertificateThumbprint"] = None
     if openid_issuer is not None:
         registration["openIdIssuer"] = openid_issuer
     if allowed_token_audiences is not None:
         validation["allowedAudiences"] = allowed_token_audiences.split(",")
         existing_auth["identityProviders"]["azureActiveDirectory"]["validation"] = validation
     if (client_id is not None or client_secret is not None or
-            client_secret_setting_name is not None or issuer is not None):
+            client_secret_setting_name is not None or issuer is not None or
+            client_secret_certificate_thumbprint is not None or
+            client_secret_certificate_san is not None or
+            client_secret_certificate_issuer is not None):
         existing_auth["identityProviders"]["azureActiveDirectory"]["registration"] = registration
 
     updated_auth_settings = update_auth_settings_v2_rest_call(cmd, resource_group_name, name, existing_auth, slot)