-
Notifications
You must be signed in to change notification settings - Fork 202
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #531 from AzureAD/release-1.21.0
MSAL Python 1.21.0, passed Azure Identity's smoke test
- Loading branch information
Showing
8 changed files
with
71 additions
and
32 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -196,6 +196,8 @@ def _test_username_password(self, | |
| azure_region=azure_region, # Regional endpoint does not support ROPC. | ||
| # Here we just use it to test a regional app won't break ROPC. | ||
| client_credential=client_secret) | ||
| self.assertEqual( | ||
| self.app.get_accounts(username=username), [], "Cache starts empty") | ||
| result = self.app.acquire_token_by_username_password( | ||
| username, password, scopes=scope) | ||
| self.assertLoosely(result) | ||
|
|
@@ -204,6 +206,9 @@ def _test_username_password(self, | |
| username=username, # Our implementation works even when "profile" scope was not requested, or when profile claims is unavailable in B2C | ||
| ) | ||
|
|
||
| @unittest.skipIf( | ||
| os.getenv("TRAVIS"), # It is set when running on TravisCI or Github Actions | ||
| "Although it is doable, we still choose to skip device flow to save time") | ||
| def _test_device_flow( | ||
| self, client_id=None, authority=None, scope=None, **ignored): | ||
| assert client_id and authority and scope | ||
|
|
@@ -229,6 +234,7 @@ def _test_device_flow( | |
| logger.info( | ||
| "%s obtained tokens: %s", self.id(), json.dumps(result, indent=4)) | ||
|
|
||
| @unittest.skipIf(os.getenv("TRAVIS"), "Browser automation is not yet implemented") | ||
| def _test_acquire_token_interactive( | ||
| self, client_id=None, authority=None, scope=None, port=None, | ||
| username=None, lab_name=None, | ||
|
|
@@ -289,7 +295,6 @@ def test_ssh_cert_for_service_principal(self): | |
| result.get("error"), result.get("error_description"))) | ||
| self.assertEqual("ssh-cert", result["token_type"]) | ||
|
|
||
| @unittest.skipIf(os.getenv("TRAVIS"), "Browser automation is not yet implemented") | ||
| def test_ssh_cert_for_user_should_work_with_any_account(self): | ||
| result = self._test_acquire_token_interactive( | ||
| client_id="04b07795-8ddb-461a-bbee-02f9e1bf7b46", # Azure CLI is one | ||
|
|
@@ -524,8 +529,8 @@ def tearDownClass(cls): | |
| cls.session.close() | ||
|
|
||
| @classmethod | ||
| def get_lab_app_object(cls, **query): # https://msidlab.com/swagger/index.html | ||
| url = "https://msidlab.com/api/app" | ||
| def get_lab_app_object(cls, client_id=None, **query): # https://msidlab.com/swagger/index.html | ||
| url = "https://msidlab.com/api/app/{}".format(client_id or "") | ||
| resp = cls.session.get(url, params=query) | ||
| result = resp.json()[0] | ||
| result["scopes"] = [ # Raw data has extra space, such as "s1, s2" | ||
|
|
@@ -546,6 +551,8 @@ def get_lab_user_secret(cls, lab_name="msidlab4"): | |
| def get_lab_user(cls, **query): # https://docs.msidlab.com/labapi/userapi.html | ||
| resp = cls.session.get("https://msidlab.com/api/user", params=query) | ||
| result = resp.json()[0] | ||
| assert result.get("upn"), "Found no test user but {}".format( | ||
| json.dumps(result, indent=2)) | ||
| _env = query.get("azureenvironment", "").lower() | ||
| authority_base = { | ||
| "azureusgovernment": "https://login.microsoftonline.us/" | ||
|
|
@@ -561,6 +568,7 @@ def get_lab_user(cls, **query): # https://docs.msidlab.com/labapi/userapi.html | |
| "scope": scope, | ||
| } | ||
|
|
||
| @unittest.skipIf(os.getenv("TRAVIS"), "Browser automation is not yet implemented") | ||
| def _test_acquire_token_by_auth_code( | ||
| self, client_id=None, authority=None, port=None, scope=None, | ||
| **ignored): | ||
|
|
@@ -583,6 +591,7 @@ def _test_acquire_token_by_auth_code( | |
| error_description=result.get("error_description"))) | ||
| self.assertCacheWorksForUser(result, scope, username=None) | ||
|
|
||
| @unittest.skipIf(os.getenv("TRAVIS"), "Browser automation is not yet implemented") | ||
| def _test_acquire_token_by_auth_code_flow( | ||
| self, client_id=None, authority=None, port=None, scope=None, | ||
| username=None, lab_name=None, | ||
|
|
@@ -723,11 +732,9 @@ def test_adfs2019_fed_user(self): | |
| self.skipTest("MEX endpoint in our test environment tends to fail") | ||
| raise | ||
|
|
||
| @unittest.skipIf(os.getenv("TRAVIS"), "Browser automation is not yet implemented") | ||
| def test_cloud_acquire_token_interactive(self): | ||
| self._test_acquire_token_interactive(**self.get_lab_user(usertype="cloud")) | ||
|
|
||
| @unittest.skipIf(os.getenv("TRAVIS"), "Browser automation is not yet implemented") | ||
| def test_msa_pt_app_signin_via_organizations_authority_without_login_hint(self): | ||
| """There is/was an upstream bug. See test case full docstring for the details. | ||
|
|
@@ -751,7 +758,6 @@ def test_ropc_adfs2019_onprem(self): | |
| config["password"] = self.get_lab_user_secret(config["lab_name"]) | ||
| self._test_username_password(**config) | ||
|
|
||
| @unittest.skipIf(os.getenv("TRAVIS"), "Browser automation is not yet implemented") | ||
| def test_adfs2019_onprem_acquire_token_by_auth_code(self): | ||
| """When prompted, you can manually login using this account: | ||
|
|
@@ -765,7 +771,6 @@ def test_adfs2019_onprem_acquire_token_by_auth_code(self): | |
| config["port"] = 8080 | ||
| self._test_acquire_token_by_auth_code(**config) | ||
|
|
||
| @unittest.skipIf(os.getenv("TRAVIS"), "Browser automation is not yet implemented") | ||
| def test_adfs2019_onprem_acquire_token_by_auth_code_flow(self): | ||
| config = self.get_lab_user(usertype="onprem", federationProvider="ADFSv2019") | ||
| self._test_acquire_token_by_auth_code_flow(**dict( | ||
|
|
@@ -775,7 +780,6 @@ def test_adfs2019_onprem_acquire_token_by_auth_code_flow(self): | |
| port=8080, | ||
| )) | ||
|
|
||
| @unittest.skipIf(os.getenv("TRAVIS"), "Browser automation is not yet implemented") | ||
| def test_adfs2019_onprem_acquire_token_interactive(self): | ||
| config = self.get_lab_user(usertype="onprem", federationProvider="ADFSv2019") | ||
| self._test_acquire_token_interactive(**dict( | ||
|
|
@@ -846,7 +850,6 @@ def _build_b2c_authority(self, policy): | |
| base = "https://msidlabb2c.b2clogin.com/msidlabb2c.onmicrosoft.com" | ||
| return base + "/" + policy # We do not support base + "?p=" + policy | ||
|
|
||
| @unittest.skipIf(os.getenv("TRAVIS"), "Browser automation is not yet implemented") | ||
| def test_b2c_acquire_token_by_auth_code(self): | ||
| """ | ||
| When prompted, you can manually login using this account: | ||
|
|
@@ -863,7 +866,6 @@ def test_b2c_acquire_token_by_auth_code(self): | |
| scope=config["scopes"], | ||
| ) | ||
|
|
||
| @unittest.skipIf(os.getenv("TRAVIS"), "Browser automation is not yet implemented") | ||
| def test_b2c_acquire_token_by_auth_code_flow(self): | ||
| self._test_acquire_token_by_auth_code_flow(**dict( | ||
| self.get_lab_user(usertype="b2c", b2cprovider="local"), | ||
|
|
@@ -882,6 +884,18 @@ def test_b2c_acquire_token_by_ropc(self): | |
| scope=config["scopes"], | ||
| ) | ||
|
|
||
| def test_b2c_allows_using_client_id_as_scope(self): | ||
| # See also https://learn.microsoft.com/en-us/azure/active-directory-b2c/access-tokens#openid-connect-scopes | ||
| config = self.get_lab_app_object(azureenvironment="azureb2ccloud") | ||
| config["scopes"] = [config["appId"]] | ||
| self._test_username_password( | ||
| authority=self._build_b2c_authority("B2C_1_ROPC_Auth"), | ||
| client_id=config["appId"], | ||
| username="[email protected]", | ||
| password=self.get_lab_user_secret("msidlabb2c"), | ||
| scope=config["scopes"], | ||
| ) | ||
|
|
||
|
|
||
| class WorldWideRegionalEndpointTestCase(LabBasedTestCase): | ||
| region = "westus" | ||
|
|
@@ -904,7 +918,7 @@ def _test_acquire_token_for_client(self, configured_region, expected_region): | |
| self.app.http_client, "post", return_value=MinimalResponse( | ||
| status_code=400, text='{"error": "mock"}')) as mocked_method: | ||
| self.app.acquire_token_for_client(scopes) | ||
| expected_host = '{}.r.login.microsoftonline.com'.format( | ||
| expected_host = '{}.login.microsoft.com'.format( | ||
| expected_region) if expected_region else 'login.microsoftonline.com' | ||
| mocked_method.assert_called_with( | ||
| 'https://{}/{}/oauth2/v2.0/token'.format( | ||
|
|
||