private async Task <ICredential> GeneratePersonalAccessTokenAsync(InputArguments input)
{
ThrowIfDisposed();
// We should not allow unencrypted communication and should inform the user
if (StringComparer.OrdinalIgnoreCase.Equals(input.Protocol, "http"))
{
throw new Exception("Unencrypted HTTP is not supported for Azure Repos. Ensure the repository remote URL is using HTTPS.");
}
Uri remoteUri = input.GetRemoteUri();
Uri orgUri = UriHelpers.CreateOrganizationUri(remoteUri, out _);
// Determine the MS authentication authority for this organization
_context.Trace.WriteLine("Determining Microsoft Authentication Authority...");
string authAuthority = await _azDevOps.GetAuthorityAsync(orgUri);
_context.Trace.WriteLine($"Authority is '{authAuthority}'.");
// Get an AAD access token for the Azure DevOps SPS
_context.Trace.WriteLine("Getting Azure AD access token...");
IMicrosoftAuthenticationResult result = await _msAuth.GetTokenAsync(
authAuthority,
GetClientId(),
GetRedirectUri(),
AzureDevOpsConstants.AzureDevOpsDefaultScopes,
null);
_context.Trace.WriteLineSecrets(
$"Acquired Azure access token. Account='{result.AccountUpn}' Token='{{0}}'", new object[] { result.AccessToken });
// Ask the Azure DevOps instance to create a new PAT
var patScopes = new[]
{
AzureDevOpsConstants.PersonalAccessTokenScopes.ReposWrite,
AzureDevOpsConstants.PersonalAccessTokenScopes.ArtifactsRead
};
_context.Trace.WriteLine($"Creating Azure DevOps PAT with scopes '{string.Join(", ", patScopes)}'...");
string pat = await _azDevOps.CreatePersonalAccessTokenAsync(
orgUri,
result.AccessToken,
patScopes);
_context.Trace.WriteLineSecrets("PAT created. PAT='{0}'", new object[] { pat });
return(new GitCredential(result.AccountUpn, pat));
}
private async Task <IMicrosoftAuthenticationResult> GetAzureAccessTokenAsync(Uri remoteUri, string userName)
{
// We should not allow unencrypted communication and should inform the user
if (StringComparer.OrdinalIgnoreCase.Equals(remoteUri.Scheme, "http"))
{
throw new Exception("Unencrypted HTTP is not supported for Azure Repos. Ensure the repository remote URL is using HTTPS.");
}
Uri orgUri = UriHelpers.CreateOrganizationUri(remoteUri, out string orgName);
_context.Trace.WriteLine($"Determining Microsoft Authentication authority for Azure DevOps organization '{orgName}'...");
string authAuthority = _authorityCache.GetAuthority(orgName);
if (authAuthority is null)
{
// If there is no cached value we must query for it and cache it for future use
_context.Trace.WriteLine($"No cached authority value - querying {orgUri} for authority...");
authAuthority = await _azDevOps.GetAuthorityAsync(orgUri);
_authorityCache.UpdateAuthority(orgName, authAuthority);
}
_context.Trace.WriteLine($"Authority is '{authAuthority}'.");
//
// If the remote URI is a classic "*.visualstudio.com" host name and we have a user specified from the
// remote then take that as the current AAD/MSA user in the first instance.
//
// For "dev.azure.com" host names we only use the user info part of the remote when this doesn't
// match the Azure DevOps organization name. Our friends in Azure DevOps decided "borrow" the username
// part of the remote URL to include the organization name (not an actual username).
//
// If we have no specified user from the remote (or this is [email protected]/org/..) then query the
// user manager for a bound user for this organization, if one exists...
//
var icmp = StringComparer.OrdinalIgnoreCase;
if (!string.IsNullOrWhiteSpace(userName) &&
(UriHelpers.IsVisualStudioComHost(remoteUri.Host) ||
(UriHelpers.IsAzureDevOpsHost(remoteUri.Host) && !icmp.Equals(orgName, userName))))
{
_context.Trace.WriteLine("Using username as specified in remote.");
}
else
{
_context.Trace.WriteLine($"Looking up user for organization '{orgName}'...");
userName = _bindingManager.GetUser(orgName);
}
_context.Trace.WriteLine(string.IsNullOrWhiteSpace(userName) ? "No user found." : $"User is '{userName}'.");
// Get an AAD access token for the Azure DevOps SPS
_context.Trace.WriteLine("Getting Azure AD access token...");
IMicrosoftAuthenticationResult result = await _msAuth.GetTokenAsync(
authAuthority,
GetClientId(),
GetRedirectUri(),
AzureDevOpsConstants.AzureDevOpsDefaultScopes,
userName);
_context.Trace.WriteLineSecrets(
$"Acquired Azure access token. Account='{result.AccountUpn}' Token='{{0}}'", new object[] { result.AccessToken });
return(result);
}