Share azureauth between prometheus clients (#58122)

* Move azureauth to upper package * Refactor http transport options
2022-11-03 19:44:37 +01:00
parent 1722000309
commit 0367f61bb3
7 changed files with 13 additions and 11 deletions
@@ -0,0 +1,113 @@
+package azureauth
+
+import (
+	"fmt"
+	"net/url"
+	"path"
+
+	"github.com/grafana/grafana-azure-sdk-go/azcredentials"
+	"github.com/grafana/grafana-azure-sdk-go/azhttpclient"
+	"github.com/grafana/grafana-azure-sdk-go/azsettings"
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
+	sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
+	"github.com/grafana/grafana/pkg/tsdb/prometheus/utils"
+
+	"github.com/grafana/grafana/pkg/util/maputil"
+)
+
+var (
+	azurePrometheusScopes = map[string][]string{
+		azsettings.AzurePublic:       {"https://prometheus.monitor.azure.com/.default"},
+		azsettings.AzureChina:        {"https://prometheus.monitor.chinacloudapp.cn/.default"},
+		azsettings.AzureUSGovernment: {"https://prometheus.monitor.usgovcloudapi.net/.default"},
+	}
+)
+
+func ConfigureAzureAuthentication(settings backend.DataSourceInstanceSettings, azureSettings *azsettings.AzureSettings, opts *sdkhttpclient.Options) error {
+	jsonData, err := utils.GetJsonData(settings)
+	if err != nil {
+		return fmt.Errorf("failed to get jsonData: %w", err)
+	}
+	credentials, err := azcredentials.FromDatasourceData(jsonData, settings.DecryptedSecureJSONData)
+	if err != nil {
+		err = fmt.Errorf("invalid Azure credentials: %w", err)
+		return err
+	}
+
+	if credentials != nil {
+		var scopes []string
+
+		if scopes, err = getOverriddenScopes(jsonData); err != nil {
+			return err
+		}
+
+		if scopes == nil {
+			if scopes, err = getPrometheusScopes(azureSettings, credentials); err != nil {
+				return err
+			}
+		}
+
+		azhttpclient.AddAzureAuthentication(opts, azureSettings, credentials, scopes)
+	}
+
+	return nil
+}
+
+func getOverriddenScopes(jsonData map[string]interface{}) ([]string, error) {
+	resourceIdStr, err := maputil.GetStringOptional(jsonData, "azureEndpointResourceId")
+	if err != nil {
+		err = fmt.Errorf("overridden resource ID (audience) invalid")
+		return nil, err
+	} else if resourceIdStr == "" {
+		return nil, nil
+	}
+
+	resourceId, err := url.Parse(resourceIdStr)
+	if err != nil || resourceId.Scheme == "" || resourceId.Host == "" {
+		err = fmt.Errorf("overridden endpoint resource ID (audience) '%s' invalid", resourceIdStr)
+		return nil, err
+	}
+
+	resourceId.Path = path.Join(resourceId.Path, ".default")
+	scopes := []string{resourceId.String()}
+	return scopes, nil
+}
+
+func getPrometheusScopes(settings *azsettings.AzureSettings, credentials azcredentials.AzureCredentials) ([]string, error) {
+	// Extract cloud from credentials
+	azureCloud, err := getAzureCloudFromCredentials(settings, credentials)
+	if err != nil {
+		return nil, err
+	}
+
+	// Get scopes for the given cloud
+	if scopes, ok := azurePrometheusScopes[azureCloud]; !ok {
+		err := fmt.Errorf("the Azure cloud '%s' not supported by Prometheus datasource", azureCloud)
+		return nil, err
+	} else {
+		return scopes, nil
+	}
+}
+
+// To be part of grafana-azure-sdk-go
+func getAzureCloudFromCredentials(settings *azsettings.AzureSettings, credentials azcredentials.AzureCredentials) (string, error) {
+	switch c := credentials.(type) {
+	case *azcredentials.AzureManagedIdentityCredentials:
+		// In case of managed identity, the cloud is always same as where Grafana is hosted
+		return getDefaultAzureCloud(settings), nil
+	case *azcredentials.AzureClientSecretCredentials:
+		return c.AzureCloud, nil
+	default:
+		err := fmt.Errorf("the Azure credentials of type '%s' not supported by Prometheus datasource", c.AzureAuthType())
+		return "", err
+	}
+}
+
+// To be part of grafana-azure-sdk-go
+func getDefaultAzureCloud(settings *azsettings.AzureSettings) string {
+	cloudName := settings.Cloud
+	if cloudName == "" {
+		return azsettings.AzurePublic
+	}
+	return cloudName
+}
@@ -0,0 +1,117 @@
+package azureauth
+
+import (
+	"testing"
+
+	"github.com/grafana/grafana-azure-sdk-go/azsettings"
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
+	sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
+
+	"github.com/grafana/grafana/pkg/setting"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConfigureAzureAuthentication(t *testing.T) {
+	cfg := &setting.Cfg{
+		Azure: &azsettings.AzureSettings{},
+	}
+
+	t.Run("should set Azure middleware when JsonData contains valid credentials", func(t *testing.T) {
+		settings := backend.DataSourceInstanceSettings{
+			JSONData: []byte(`{
+					"httpMethod": "POST",
+					"azureCredentials": {
+						"authType": "msi"
+					}
+				}`),
+		}
+
+		var opts = &sdkhttpclient.Options{CustomOptions: map[string]interface{}{}}
+
+		err := ConfigureAzureAuthentication(settings, cfg.Azure, opts)
+		require.NoError(t, err)
+
+		require.NotNil(t, opts.Middlewares)
+		assert.Len(t, opts.Middlewares, 1)
+	})
+
+	t.Run("should not set Azure middleware when JsonData doesn't contain valid credentials", func(t *testing.T) {
+		settings := backend.DataSourceInstanceSettings{
+			JSONData: []byte(`{ "httpMethod": "POST" }`),
+		}
+
+		var opts = &sdkhttpclient.Options{CustomOptions: map[string]interface{}{}}
+
+		err := ConfigureAzureAuthentication(settings, cfg.Azure, opts)
+		require.NoError(t, err)
+
+		assert.NotContains(t, opts.CustomOptions, "_azureCredentials")
+	})
+
+	t.Run("should return error when JsonData contains invalid credentials", func(t *testing.T) {
+		settings := backend.DataSourceInstanceSettings{
+			JSONData: []byte(`{
+					"httpMethod":       "POST",
+					"azureCredentials": "invalid"
+				}`),
+		}
+
+		var opts = &sdkhttpclient.Options{CustomOptions: map[string]interface{}{}}
+		err := ConfigureAzureAuthentication(settings, cfg.Azure, opts)
+		assert.Error(t, err)
+	})
+
+	t.Run("should set Azure middleware when JsonData contains credentials and valid audience", func(t *testing.T) {
+		settings := backend.DataSourceInstanceSettings{
+			JSONData: []byte(`{
+					"httpMethod": "POST",
+					"azureCredentials": {
+						"authType": "msi"
+					},
+					"azureEndpointResourceId": "https://api.example.com/abd5c4ce-ca73-41e9-9cb2-bed39aa2adb5"
+				}`),
+		}
+		var opts = &sdkhttpclient.Options{CustomOptions: map[string]interface{}{}}
+
+		err := ConfigureAzureAuthentication(settings, cfg.Azure, opts)
+		require.NoError(t, err)
+
+		require.NotNil(t, opts.Middlewares)
+		assert.Len(t, opts.Middlewares, 1)
+	})
+
+	t.Run("should not set Azure middleware when JsonData doesn't contain credentials", func(t *testing.T) {
+		settings := backend.DataSourceInstanceSettings{
+			JSONData: []byte(`{
+					"httpMethod":              "POST",
+					"azureEndpointResourceId": "https://api.example.com/abd5c4ce-ca73-41e9-9cb2-bed39aa2adb5"
+				}`),
+		}
+		var opts = &sdkhttpclient.Options{CustomOptions: map[string]interface{}{}}
+
+		err := ConfigureAzureAuthentication(settings, cfg.Azure, opts)
+		require.NoError(t, err)
+
+		if opts.Middlewares != nil {
+			assert.Len(t, opts.Middlewares, 0)
+		}
+	})
+
+	t.Run("should return error when JsonData contains invalid audience", func(t *testing.T) {
+		settings := backend.DataSourceInstanceSettings{
+			JSONData: []byte(`{
+					"httpMethod": "POST",
+					"azureCredentials": {
+						"authType": "msi"
+					},
+					"azureEndpointResourceId": "invalid"
+				}`),
+		}
+
+		var opts = &sdkhttpclient.Options{CustomOptions: map[string]interface{}{}}
+
+		err := ConfigureAzureAuthentication(settings, cfg.Azure, opts)
+		assert.Error(t, err)
+	})
+}