Config Refactor Round 2.

docs/webhook_events.md

@@ -696,6 +696,8 @@ If webhook is set to have Event Grid message format then the payload will look a
         "allowed_aad_tenants": [
             "00000000-0000-0000-0000-000000000000"
         ],
+        "authority": "",
+        "client_id": "",
         "default_linux_vm_image": "Canonical:0001-com-ubuntu-server-focal:20_04-lts:latest",
         "default_windows_vm_image": "MicrosoftWindowsDesktop:Windows-10:win10-21h2-pro:latest",
         "network_config": {
@@ -707,7 +709,8 @@ If webhook is set to have Event Grid message format then the payload will look a
             "allowed_service_tags": []
         },
         "proxy_vm_sku": "Standard_B2s",
-        "require_admin_privileges": false
+        "require_admin_privileges": false,
+        "tenant_domain": ""
     }
 }
 ```
@@ -838,6 +841,16 @@ If webhook is set to have Event Grid message format then the payload will look a
                     "title": "Api Access Rules",
                     "type": "object"
                 },
+                "authority": {
+                    "default": "",
+                    "title": "Authority",
+                    "type": "string"
+                },
+                "client_id": {
+                    "default": "",
+                    "title": "Client Id",
+                    "type": "string"
+                },
                 "default_linux_vm_image": {
                     "default": "Canonical:0001-com-ubuntu-server-focal:20_04-lts:latest",
                     "title": "Default Linux Vm Image",
@@ -878,6 +891,11 @@ If webhook is set to have Event Grid message format then the payload will look a
                     "title": "Require Admin Privileges",
                     "type": "boolean"
                 },
+                "tenant_domain": {
+                    "default": "",
+                    "title": "Tenant Domain",
+                    "type": "string"
+                },
                 "vm_tags": {
                     "additionalProperties": {
                         "type": "string"
@@ -6158,6 +6176,16 @@ If webhook is set to have Event Grid message format then the payload will look a
                     "title": "Api Access Rules",
                     "type": "object"
                 },
+                "authority": {
+                    "default": "",
+                    "title": "Authority",
+                    "type": "string"
+                },
+                "client_id": {
+                    "default": "",
+                    "title": "Client Id",
+                    "type": "string"
+                },
                 "default_linux_vm_image": {
                     "default": "Canonical:0001-com-ubuntu-server-focal:20_04-lts:latest",
                     "title": "Default Linux Vm Image",
@@ -6198,6 +6226,11 @@ If webhook is set to have Event Grid message format then the payload will look a
                     "title": "Require Admin Privileges",
                     "type": "boolean"
                 },
+                "tenant_domain": {
+                    "default": "",
+                    "title": "Tenant Domain",
+                    "type": "string"
+                },
                 "vm_tags": {
                     "additionalProperties": {
                         "type": "string"

src/ApiService/ApiService/Functions/Config.cs

@@ -0,0 +1,35 @@
+using System.Net;
+using Microsoft.Azure.Functions.Worker;
+using Microsoft.Azure.Functions.Worker.Http;
+
+namespace Microsoft.OneFuzz.Service.Functions;
+
+public class Config {
+    private readonly ILogTracer _log;
+    private readonly IOnefuzzContext _context;
+
+    public Config(ILogTracer log, IOnefuzzContext context) {
+        _log = log;
+        _context = context;
+    }
+
+    [Function("Config")]
+    public Async.Task<HttpResponseData> Run(
+        [HttpTrigger(AuthorizationLevel.Anonymous, "GET", Route = "config")] HttpRequestData req) {
+        return Get(req);
+    }
+    public async Async.Task<HttpResponseData> Get(HttpRequestData req) {
+        _log.Info($"getting endpoint config parameters");
+        var config = await _context.ConfigOperations.Fetch();
+
+        var endpointParams = new ConfigResponse(
+                Authority: config.Authority,
+                ClientId: config.ClientId,
+                TenantDomain: config.TenantDomain);
+
+        var response = req.CreateResponse(HttpStatusCode.OK);
+        await response.WriteAsJsonAsync(endpointParams);
+
+        return response;
+    }
+}

src/ApiService/ApiService/OneFuzzTypes/Model.cs

@@ -347,7 +347,10 @@ public record InstanceConfig
     IDictionary<Endpoint, ApiAccessRule>? ApiAccessRules = null,
     IDictionary<PrincipalId, GroupId[]>? GroupMembership = null,
     IDictionary<string, string>? VmTags = null,
-    IDictionary<string, string>? VmssTags = null
+    IDictionary<string, string>? VmssTags = null,
+    string? Authority = "",
+    string? ClientId = "",
+    string? TenantDomain = ""
 ) : EntityBase() {
     public InstanceConfig(string instanceName) : this(
         instanceName,

src/ApiService/ApiService/OneFuzzTypes/Responses.cs

@@ -159,6 +159,12 @@ public static ScalesetResponse ForScaleset(Scaleset s, bool includeAuth)
             Nodes: null);
 }
 
+public record ConfigResponse(
+    string? Authority,
+    string? ClientId,
+    string? TenantDomain
+) : BaseResponse();
+
 public class BaseResponseConverter : JsonConverter<BaseResponse> {
     public override BaseResponse? Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options) {
         return null;

src/ApiService/ApiService/onefuzzlib/ConfigOperations.cs

@@ -26,7 +26,7 @@ private sealed record InstanceConfigCacheKey();
     private static readonly InstanceConfigCacheKey _key = new(); // singleton key
     public Task<InstanceConfig> Fetch()
         => _cache.GetOrCreateAsync(_key, async entry => {
-            entry = entry.SetAbsoluteExpiration(TimeSpan.FromMinutes(10)); // cached for 10 minutes
+            entry = entry.SetAbsoluteExpiration(TimeSpan.FromMinutes(1)); // cached for 1 minute
             var key = _context.ServiceConfiguration.OneFuzzInstanceName ?? throw new Exception("Environment variable ONEFUZZ_INSTANCE_NAME is not set");
             return await GetEntityAsync(key, key);
         });

src/cli/onefuzz/api.py

@@ -122,6 +122,10 @@ def _req_model(
         as_params: bool = False,
         alternate_endpoint: Optional[str] = None,
     ) -> A:
+
+        # Retrieve Auth Parameters
+        self._req_config_params()
+        logging.debug("in req model")
         response = self._req_base(
             method,
             data=data,
@@ -153,6 +157,38 @@ def _req_model_list(
 
         return [model.parse_obj(x) for x in response]
 
+    def _req_config_params(
+        self,
+    ) -> None:
+
+        endpoint_params = responses.Config(
+            authority="",
+            client_id="",
+            tenant_domain="",
+        )
+
+        if self.onefuzz._backend.config.endpoint is not None:
+
+            endpoint = self.onefuzz._backend.config.endpoint
+
+            response = self.onefuzz._backend.session.request(
+                "GET", endpoint + "/api/config"
+            )
+
+            endpoint_params = responses.Config.parse_obj(response.json())
+
+            # Will override client id in storage w/ provided client_id for SP use
+            if self.onefuzz._backend.config.client_id == "":
+                self.onefuzz._backend.config.client_id = endpoint_params.client_id
+
+            # Ignores provided auth and tenant_domain in favor of what's in storage
+            self.onefuzz._backend.config.authority = endpoint_params.authority
+            self.onefuzz._backend.config.tenant_domain = endpoint_params.tenant_domain
+
+            self.onefuzz._backend.save_config()
+        else:
+            raise Exception("Endpoint Not Configured")
+
     def _disambiguate(
         self,
         name: str,

src/cli/onefuzz/backend.py

@@ -181,7 +181,7 @@ def get_access_token(self) -> Any:
         if not self.config.endpoint:
             raise Exception("endpoint not configured")
 
-        if self.config.tenant_domain:
+        if "common" in self.config.authority:
             endpoint = urlparse(self.config.endpoint).netloc.split(".")[0]
             scopes = [
                 f"api://{self.config.tenant_domain}/{endpoint}/.default",

src/deployment/bicep-templates/function.bicep

@@ -23,7 +23,6 @@ param diagnostics_log_level string
 param log_retention int
 param linux_fx_version string
 
-
 var siteconfig = (use_windows) ? {
 } : {
   linuxFxVersion: linux_fx_version
@@ -57,24 +56,25 @@ resource function 'Microsoft.Web/sites@2021-03-01' = {
     type: 'SystemAssigned'
   }
   properties: union({
-    siteConfig: union(siteconfig, commonSiteConfig)
-    httpsOnly: true
-    serverFarmId: server_farm_id
-    clientAffinityEnabled: true
-  }, extraProperties)
+      siteConfig: union(siteconfig, commonSiteConfig)
+      httpsOnly: true
+      serverFarmId: server_farm_id
+      clientAffinityEnabled: true
+    }, extraProperties)
 }
 
 resource funcAuthSettings 'Microsoft.Web/sites/config@2021-03-01' = {
   name: 'authsettingsV2'
   properties: {
-    login:{
+    login: {
       tokenStore: {
         enabled: true
       }
     }
     globalValidation: {
       unauthenticatedClientAction: 'RedirectToLoginPage'
       requireAuthentication: true
+      excludedPaths: [ '/api/config' ]
     }
     httpSettings: {
       requireHttps: true

src/deployment/config.json

@@ -1,6 +1,12 @@
 {
+    "tenant_id": "72f988bf-86f1-41af-91ab-2d7cd011db47",
+    "tenant_domain": "azurewebsites.net",
+    "multi_tenant_domain": "",
+    "cli_client_id": "72f1562a-8c0c-41ea-beb9-fa2b71c80134",
     "proxy_nsg_config": {
-        "allowed_ips": ["*"],
+        "allowed_ips": [
+            "*"
+        ],
         "allowed_service_tags": []
     }
 }