83 lines
2.6 KiB
Python
83 lines
2.6 KiB
Python
from .plugin import CredentialPlugin
|
|
|
|
from django.utils.translation import ugettext_lazy as _
|
|
from azure.keyvault import KeyVaultClient, KeyVaultAuthentication
|
|
from azure.common.credentials import ServicePrincipalCredentials
|
|
from msrestazure import azure_cloud
|
|
|
|
|
|
# https://github.com/Azure/msrestazure-for-python/blob/master/msrestazure/azure_cloud.py
|
|
clouds = [
|
|
vars(azure_cloud)[n]
|
|
for n in dir(azure_cloud)
|
|
if n.startswith("AZURE_") and n.endswith("_CLOUD")
|
|
]
|
|
default_cloud = vars(azure_cloud)["AZURE_PUBLIC_CLOUD"]
|
|
|
|
|
|
azure_keyvault_inputs = {
|
|
'fields': [{
|
|
'id': 'url',
|
|
'label': _('Vault URL (DNS Name)'),
|
|
'type': 'string',
|
|
'format': 'url',
|
|
}, {
|
|
'id': 'client',
|
|
'label': _('Client ID'),
|
|
'type': 'string'
|
|
}, {
|
|
'id': 'secret',
|
|
'label': _('Client Secret'),
|
|
'type': 'string',
|
|
'secret': True,
|
|
}, {
|
|
'id': 'tenant',
|
|
'label': _('Tenant ID'),
|
|
'type': 'string'
|
|
}, {
|
|
'id': 'cloud_name',
|
|
'label': _('Cloud Environment'),
|
|
'help_text': _('Specify which azure cloud environment to use.'),
|
|
'choices': list(set([default_cloud.name] + [c.name for c in clouds])),
|
|
'default': default_cloud.name
|
|
}],
|
|
'metadata': [{
|
|
'id': 'secret_field',
|
|
'label': _('Secret Name'),
|
|
'type': 'string',
|
|
'help_text': _('The name of the secret to look up.'),
|
|
}, {
|
|
'id': 'secret_version',
|
|
'label': _('Secret Version'),
|
|
'type': 'string',
|
|
'help_text': _('Used to specify a specific secret version (if left empty, the latest version will be used).'),
|
|
}],
|
|
'required': ['url', 'client', 'secret', 'tenant', 'secret_field'],
|
|
}
|
|
|
|
|
|
def azure_keyvault_backend(**kwargs):
|
|
url = kwargs['url']
|
|
[cloud] = [c for c in clouds if c.name == kwargs.get('cloud_name', default_cloud.name)]
|
|
|
|
def auth_callback(server, resource, scope):
|
|
credentials = ServicePrincipalCredentials(
|
|
url = url,
|
|
client_id = kwargs['client'],
|
|
secret = kwargs['secret'],
|
|
tenant = kwargs['tenant'],
|
|
resource = f"https://{cloud.suffixes.keyvault_dns.split('.', 1).pop()}",
|
|
)
|
|
token = credentials.token
|
|
return token['token_type'], token['access_token']
|
|
|
|
kv = KeyVaultClient(KeyVaultAuthentication(auth_callback))
|
|
return kv.get_secret(url, kwargs['secret_field'], kwargs.get('secret_version', '')).value
|
|
|
|
|
|
azure_keyvault_plugin = CredentialPlugin(
|
|
'Microsoft Azure Key Vault',
|
|
inputs=azure_keyvault_inputs,
|
|
backend=azure_keyvault_backend
|
|
)
|