Update the authorization / authentication protocol for the OSPO REST API from PAT to OIDC #335
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Minor clean up and switch to Bearer token header * Add a test sandbox, and expose a means for getting a hydrated `OspoClient` via a factory that does `az login` and `az account get-access-token`. * A tweak or two
* use OIDC in the code for what's new, Quest Update the What's New app code to use the new OIDC approach. Update the Quest app to use the new OIDC approach. * Configure the OSPO client using the new keys In both SeQuester, and the What's New app, make the following changes: - Use the OIDC configuration to setup access to the OSPO client. - Check for the deprecated key, and produce a warning if the deprecated key is present. - If the authorization fails, fail gracefully in both apps when an item needs to be updated.
|
/cc @jeffwilcox |
gewarren
approved these changes
Apr 25, 2024
* Minor clean up and switch to Bearer token header * Add a test sandbox, and expose a means for getting a hydrated `OspoClient` via a factory that does `az login` and `az account get-access-token`. * A tweak or two
* use OIDC in the code for what's new, Quest Update the What's New app code to use the new OIDC approach. Update the Quest app to use the new OIDC approach. * Configure the OSPO client using the new keys In both SeQuester, and the What's New app, make the following changes: - Use the OIDC configuration to setup access to the OSPO client. - Check for the deprecated key, and produce a warning if the deprecated key is present. - If the authorization fails, fail gracefully in both apps when an item needs to be updated.
BillWagner
force-pushed
the
oidc-sandbox
branch
from
6e83ec9 to
bf6f856
Compare
BillWagner
force-pushed
the
oidc-sandbox
branch
2 times, most recently
from
80440a7 to
48a2a76
Compare
BillWagner
force-pushed
the
oidc-sandbox
branch
from
35d7a9f to
472df68
Compare
BillWagner
added a commit
to BillWagner/docs
that referenced
this pull request
Apr 30, 2024
Relies on dotnet/docs-tools#335 Update the YML files for the OIDC authorization protocol
BillWagner
added a commit
to dotnet/docs
that referenced
this pull request
Apr 30, 2024
* Use OIDC keys for the OSPO API Relies on dotnet/docs-tools#335 Update the YML files for the OIDC authorization protocol * Apply suggestions from code review Co-authored-by: David Pine <[email protected]> --------- Co-authored-by: David Pine <[email protected]>
BillWagner
added a commit
to BillWagner/csharpstandard
that referenced
this pull request
Apr 30, 2024
See dotnet/docs-tools#335 for details.
BillWagner
added a commit
to dotnet/csharpstandard
that referenced
this pull request
Apr 30, 2024
See dotnet/docs-tools#335 for details.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
DON'T SQUASH THIS PR. INDIVIDUAL PRs INTO THIS BRANCH WERE SQUASHED.
The work on this feature branch updated the authorization and config for using the Open Source Programs Office REST API from Personal Access Tokens to OIDC. In addition, the code using that REST API was made resilient if the config has not be updated. When the OIDC configuration variables are missing, the HTTP client is
null, and no API calls are tried.However, if the new tokens are configured, but are invalid, the service will throw exceptions to indicate the configuration failure.