def test_unexpected_error(): """The credential should log stderr when Get-AzAccessToken returns an unexpected error""" class MockHandler(logging.Handler): def __init__(self): super(MockHandler, self).__init__() self.messages = [] def emit(self, record): self.messages.append(record) mock_handler = MockHandler() logger = logging.getLogger(AzurePowerShellCredential.__module__) logger.addHandler(mock_handler) logger.setLevel(logging.DEBUG) expected_output = "something went wrong" Popen = get_mock_Popen(return_code=42, stderr=expected_output) with patch(POPEN, Popen): with pytest.raises(ClientAuthenticationError): AzurePowerShellCredential().get_token("scope") for message in mock_handler.messages: if message.levelname == "DEBUG" and expected_output in message.message: return assert False, "Credential should have included stderr in a DEBUG level message"
def test_az_powershell_not_installed(): """The credential should raise CredentialUnavailableError when Azure PowerShell isn't installed""" with patch(POPEN, get_mock_Popen(stdout=NO_AZ_ACCOUNT_MODULE)): with pytest.raises(CredentialUnavailableError, match=AZ_ACCOUNT_NOT_INSTALLED): AzurePowerShellCredential().get_token("scope")
def test_not_logged_in(stderr): """The credential should raise CredentialUnavailableError when a user isn't logged in to Azure PowerShell""" Popen = get_mock_Popen(return_code=1, stderr=stderr) with patch(POPEN, Popen): with pytest.raises(CredentialUnavailableError, match=RUN_CONNECT_AZ_ACCOUNT): AzurePowerShellCredential().get_token("scope")
def test_powershell_not_installed_cmd(stderr): """The credential should raise CredentialUnavailableError when PowerShell isn't installed""" Popen = get_mock_Popen(return_code=1, stderr=stderr) with patch(POPEN, Popen): with pytest.raises(CredentialUnavailableError, match=POWERSHELL_NOT_INSTALLED): AzurePowerShellCredential().get_token("scope")
def test_blocked_by_execution_policy(): """The credential should raise CredentialUnavailableError when execution policy blocks Get-AzAccessToken""" stderr = r"""#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><S S="Error">Import-Module : Errors occurred while loading the format data file: _x000D__x000A_</S><S S="Error">C:\Users\foo\Documents\WindowsPowerShell\Modules\Az.Accounts\2.2.7\Accounts.format.ps1xml, , C:\Users\foo\Documents\WindowsPowerShell\Modules\Az.Accounts\2.2.7\Accounts.format.ps1xml: The file was skipped because of the _x000D__x000A_</S><S S="Error">following validation exception: AuthorizationManager check failed.._x000D__x000A_</S><S S="Error">C:\Users\foo\Documents\WindowsPowerShell\Modules\Az.Accounts\2.2.7\Accounts.generated.format.ps1xml, , C:\Users\foo\Documents\WindowsPowerShell\Modules\Az.Accounts\2.2.7\Accounts.generated.format.ps1xml: The file was skipped _x000D__x000A_</S><S S="Error">because of the following validation exception: AuthorizationManager check failed.._x000D__x000A_</S><S S="Error">At line:4 char:6_x000D__x000A_</S><S S="Error">+ $m = Import-Module Az.Accounts -MinimumVersion $minimumVersion -PassT ..._x000D__x000A_</S><S S="Error">+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~_x000D__x000A_</S><S S="Error"> + CategoryInfo : InvalidOperation: (:) [Import-Module], RuntimeException_x000D__x000A_</S><S S="Error"> + FullyQualifiedErrorId : FormatXmlUpdateException,Microsoft.PowerShell.Commands.ImportModuleCommand_x000D__x000A_</S><S S="Error"> _x000D__x000A_</S></Objs>""" Popen = get_mock_Popen(return_code=1, stderr=stderr) with patch(POPEN, Popen): with pytest.raises(CredentialUnavailableError, match=BLOCKED_BY_EXECUTION_POLICY): AzurePowerShellCredential().get_token("scope")
def _initialize_credentials(self): if self.subscription_id is not None \ and self.arm_base_url is not None: if self.vscode_tenant_id is None: self.vscode_tenant_id = self._get_tenant_id( arm_base_url=self.arm_base_url, subscription_id=self.subscription_id) if self.shared_cache_tenant_id is None: self.shared_cache_tenant_id = self._get_tenant_id( arm_base_url=self.arm_base_url, subscription_id=self.subscription_id) if self.interactive_browser_tenant_id is None: self.interactive_browser_tenant_id = self._get_tenant_id( arm_base_url=self.arm_base_url, subscription_id=self.subscription_id) credentials = [] # type: List[TokenCredential] if not self.exclude_token_file_credential: credentials.append(_TokenFileCredential()) if not self.exclude_environment_credential: credentials.append(EnvironmentCredential(authority=self.authority)) if not self.exclude_managed_identity_credential: credentials.append( ManagedIdentityCredential( client_id=self.managed_identity_client_id)) if not self.exclude_shared_token_cache_credential and SharedTokenCacheCredential.supported( ): try: # username and/or tenant_id are only required when the cache contains tokens for multiple identities shared_cache = SharedTokenCacheCredential( username=self.shared_cache_username, tenant_id=self.shared_cache_tenant_id, authority=self.authority) credentials.append(shared_cache) except Exception as ex: # pylint:disable=broad-except _LOGGER.info("Shared token cache is unavailable: '%s'", ex) if not self.exclude_visual_studio_code_credential: credentials.append( VisualStudioCodeCredential(tenant_id=self.vscode_tenant_id)) if not self.exclude_cli_credential: credentials.append(AzureCliCredential()) if not self.exclude_powershell_credential: credentials.append(AzurePowerShellCredential()) if not self.exclude_interactive_browser_credential: credentials.append( InteractiveBrowserCredential( tenant_id=self.interactive_browser_tenant_id)) if not self.exclude_device_code_credential: credentials.append( DeviceCodeCredential( tenant_id=self.interactive_browser_tenant_id)) self.credentials = credentials
def test_timeout(): """The credential should kill the subprocess after a timeout""" from subprocess import TimeoutExpired proc = Mock(communicate=Mock(side_effect=TimeoutExpired("", 42)), returncode=None) with patch(POPEN, Mock(return_value=proc)): with pytest.raises(CredentialUnavailableError): AzurePowerShellCredential().get_token("scope") assert proc.communicate.call_count == 1 assert proc.kill.call_count == 1
def test_ignores_extraneous_stdout_content(): expected_access_token = "access" expected_expires_on = 1617923581 motd = "MOTD: Customize your experience: save your profile to $HOME/.config/PowerShell\n" Popen = get_mock_Popen( stdout=motd + "azsdk%{}%{}".format(expected_access_token, expected_expires_on)) with patch(POPEN, Popen): token = AzurePowerShellCredential().get_token("scope") assert token.token == expected_access_token assert token.expires_on == expected_expires_on
def test_get_token_tenant_id(stderr): expected_access_token = "access" expected_expires_on = 1617923581 scope = "scope" stdout = "azsdk%{}%{}".format(expected_access_token, expected_expires_on) Popen = get_mock_Popen(stdout=stdout, stderr=stderr) with patch(POPEN, Popen): token = AzurePowerShellCredential().get_token(scope, tenant_id="tenant_id") assert token.token == expected_access_token assert token.expires_on == expected_expires_on
def test_multitenant_authentication_not_allowed(): """get_token(tenant_id=...) should raise when allow_multitenant_authentication is False (the default)""" expected_token = "***" def fake_Popen(command, **_): assert command[-1].startswith("pwsh -NonInteractive -EncodedCommand ") encoded_script = command[-1].split()[-1] decoded_script = base64.b64decode(encoded_script).decode("utf-16-le") match = re.search( r"Get-AzAccessToken -ResourceUrl '(\S+)'(?: -TenantId (\S+))?", decoded_script) tenant = match.groups()[1] assert tenant is None, "credential shouldn't accept an explicit tenant ID" stdout = "azsdk%{}%{}".format(expected_token, int(time.time()) + 3600) communicate = Mock(return_value=(stdout, "")) return Mock(communicate=communicate, returncode=0) credential = AzurePowerShellCredential() with patch(POPEN, fake_Popen): token = credential.get_token("scope") assert token.token == expected_token # specifying a tenant should get an error with pytest.raises(ClientAuthenticationError, match="allow_multitenant_authentication"): credential.get_token("scope", tenant_id="some tenant") # ...unless the compat switch is enabled with patch.dict( "os.environ", { EnvironmentVariables.AZURE_IDENTITY_ENABLE_LEGACY_TENANT_SELECTION: "true" }): token = credential.get_token("scope", tenant_id="some tenant") assert ( token.token == expected_token ), "credential should ignore tenant_id kwarg when the compat switch is enabled"
def test_allow_multitenant_authentication(): """When allow_multitenant_authentication is True, the credential should respect get_token(tenant_id=...)""" first_token = "***" second_tenant = "second-tenant" second_token = first_token * 2 def fake_Popen(command, **_): assert command[-1].startswith("pwsh -NonInteractive -EncodedCommand ") encoded_script = command[-1].split()[-1] decoded_script = base64.b64decode(encoded_script).decode("utf-16-le") match = re.search( r"Get-AzAccessToken -ResourceUrl '(\S+)'(?: -TenantId (\S+))?", decoded_script) tenant = match.groups()[1] assert tenant is None or tenant == second_tenant, 'unexpected tenant "{}"'.format( tenant) token = first_token if tenant is None else second_token stdout = "azsdk%{}%{}".format(token, int(time.time()) + 3600) communicate = Mock(return_value=(stdout, "")) return Mock(communicate=communicate, returncode=0) credential = AzurePowerShellCredential( allow_multitenant_authentication=True) with patch(POPEN, fake_Popen): token = credential.get_token("scope") assert token.token == first_token token = credential.get_token("scope", tenant_id=second_tenant) assert token.token == second_token # should still default to the first tenant token = credential.get_token("scope") assert token.token == first_token
def test_cannot_execute_shell(): """The credential should raise CredentialUnavailableError when the subprocess doesn't start""" with patch(POPEN, Mock(side_effect=OSError)): with pytest.raises(CredentialUnavailableError): AzurePowerShellCredential().get_token("scope")
def test_multiple_scopes(): """The credential should raise ValueError when get_token is called with more than one scope""" with pytest.raises(ValueError): AzurePowerShellCredential().get_token("one scope", "and another")
def test_no_scopes(): """The credential should raise ValueError when get_token is called with no scopes""" with pytest.raises(ValueError): AzurePowerShellCredential().get_token()