Skip to content

Commit 61e2317

Browse files
cheenamalhotracheenamalhotra
authored
ESRP federated credential update (move to AME) (#3261)
1 parent 2bb0dc7 commit 61e2317

File tree

6 files changed

+88
-70
lines changed

6 files changed

+88
-70
lines changed

‎eng/pipelines/akv-official-pipeline.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -133,12 +133,12 @@ extends:
133133
nugetPackageVersion: '${{ variables.nugetPackageVersion }}'
134134
mdsPackageVersion: '${{ variables.mdsPackageVersion }}'
135135
publishSymbols: '${{ parameters.publishSymbols }}'
136-
signingAppRegistrationClientId: '$(SigningAppRegistrationClientId)'
137-
signingAppRegistrationTenantId: '$(SigningAppRegistrationTenantId)'
138-
signingAkvName: '$(SigningAkvName)'
139-
signingAuthCertName: '$(SigningAuthCertName)'
140-
signingConnectedServiceName: '$(SigningConnectedServiceName)'
141-
signingSignCertName: '$(SigningSignCertName)'
136+
ESRPConnectedServiceName: '$(ESRPConnectedServiceName)'
137+
AppRegistrationClientId: '$(AppRegistrationClientId)'
138+
AppRegistrationTenantId: '$(AppRegistrationTenantId)'
139+
EsrpClientId: '$(EsrpClientId)'
140+
AuthAkvName: '$(AuthAkvName)'
141+
AuthSignCertName: '$(AuthSignCertName)'
142142
symbolsAzureSubscription: '$(SymbolsAzureSubscription)'
143143
symbolsPublishProjectName: '$(SymbolsPublishProjectName)'
144144
symbolsPublishServer: '$(SymbolsPublishServer)'

‎eng/pipelines/common/templates/steps/esrp-code-signing-step.yml

Lines changed: 32 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@ parameters:
1717
type: string
1818
default: $(artifactDirectory)
1919

20+
- name: ESRPConnectedServiceName
21+
type: string
22+
default: $(ESRPConnectedServiceName)
23+
2024
- name: appRegistrationClientId
2125
type: string
2226
default: $(appRegistrationClientId)
@@ -25,29 +29,42 @@ parameters:
2529
type: string
2630
default: $(appRegistrationTenantId)
2731

32+
- name: AuthAKVName
33+
type: string
34+
default: $(AuthAKVName)
35+
36+
- name: AuthSignCertName
37+
type: string
38+
default: $(AuthSignCertName)
39+
40+
- name: EsrpClientId
41+
type: string
42+
default: $(EsrpClientId)
43+
2844
steps:
2945
- ${{ if eq(parameters.artifactType, 'dll') }}:
3046
- task: EsrpMalwareScanning@5
3147
displayName: 'ESRP MalwareScanning'
3248
inputs:
33-
ConnectedServiceName: 'ESRP Workload Identity federation service-ADO.Net'
49+
ConnectedServiceName: '${{parameters.ESRPConnectedServiceName }}'
3450
AppRegistrationClientId: '${{parameters.appRegistrationClientId }}'
3551
AppRegistrationTenantId: '${{parameters.appRegistrationTenantId }}'
36-
AuthAKVName: SqlClientDrivers
37-
AuthCertName: 'ESRP-Release-Auth'
52+
EsrpClientId: '${{parameters.EsrpClientId }}'
53+
UseMSIAuthentication: true
3854
FolderPath: '${{parameters.sourceRoot }}'
3955
Pattern: '*.dll'
4056
CleanupTempStorage: 1
4157
VerboseLogin: 1
4258
- task: EsrpCodeSigning@5
4359
displayName: 'ESRP CodeSigning'
4460
inputs:
45-
ConnectedServiceName: 'ESRP Workload Identity federation service-ADO.Net'
61+
ConnectedServiceName: '${{parameters.ESRPConnectedServiceName }}'
4662
AppRegistrationClientId: '${{parameters.appRegistrationClientId }}'
4763
AppRegistrationTenantId: '${{parameters.appRegistrationTenantId }}'
48-
AuthAKVName: SqlClientDrivers
49-
AuthCertName: 'ESRP-Release-Auth'
50-
AuthSignCertName: 'ESRP-Release-Sign2'
64+
EsrpClientId: '${{parameters.EsrpClientId }}'
65+
UseMSIAuthentication: true
66+
AuthAKVName: '${{parameters.AuthAKVName }}'
67+
AuthSignCertName: '${{parameters.AuthSignCertName }}'
5168
FolderPath: '${{parameters.sourceRoot }}'
5269
Pattern: '*.dll'
5370
signConfigType: inlineSignParams
@@ -94,11 +111,11 @@ steps:
94111
- task: EsrpMalwareScanning@5
95112
displayName: 'ESRP MalwareScanning Nuget Package'
96113
inputs:
97-
ConnectedServiceName: 'ESRP Workload Identity federation service-ADO.Net'
114+
ConnectedServiceName: '${{parameters.ESRPConnectedServiceName }}'
98115
AppRegistrationClientId: '${{parameters.appRegistrationClientId }}'
99116
AppRegistrationTenantId: '${{parameters.appRegistrationTenantId }}'
100-
AuthAKVName: SqlClientDrivers
101-
AuthCertName: 'ESRP-Release-Auth'
117+
EsrpClientId: '${{parameters.EsrpClientId }}'
118+
UseMSIAuthentication: true
102119
FolderPath: '${{parameters.artifactDirectory }}'
103120
Pattern: '*.*nupkg'
104121
CleanupTempStorage: 1
@@ -107,12 +124,13 @@ steps:
107124
displayName: 'ESRP CodeSigning Nuget Package'
108125
inputs:
109126
inputs:
110-
ConnectedServiceName: 'ESRP Workload Identity federation service-ADO.Net'
127+
ConnectedServiceName: '${{parameters.ESRPConnectedServiceName }}'
111128
AppRegistrationClientId: '${{parameters.appRegistrationClientId }}'
112129
AppRegistrationTenantId: '${{parameters.appRegistrationTenantId }}'
113-
AuthAKVName: SqlClientDrivers
114-
AuthCertName: 'ESRP-Release-Auth'
115-
AuthSignCertName: 'ESRP-Release-Sign2'
130+
EsrpClientId: '${{parameters.EsrpClientId }}'
131+
UseMSIAuthentication: true
132+
AuthAKVName: '${{parameters.AuthAKVName }}'
133+
AuthSignCertName: '${{parameters.AuthSignCertName }}'
116134
FolderPath: '${{parameters.artifactDirectory }}'
117135
Pattern: '*.*nupkg'
118136
signConfigType: inlineSignParams

‎eng/pipelines/jobs/build-akv-official-job.yml

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -26,22 +26,22 @@ parameters:
2626
- name: publishSymbols
2727
type: boolean
2828

29-
- name: signingAppRegistrationClientId
29+
- name: ESRPConnectedServiceName
3030
type: string
3131

32-
- name: signingAppRegistrationTenantId
32+
- name: AppRegistrationClientId
3333
type: string
3434

35-
- name: signingAkvName
35+
- name: AppRegistrationTenantId
3636
type: string
3737

38-
- name: signingAuthCertName
38+
- name: EsrpClientId
3939
type: string
4040

41-
- name: signingConnectedServiceName
41+
- name: AuthAkvName
4242
type: string
4343

44-
- name: signingSignCertName
44+
- name: AuthSignCertName
4545
type: string
4646

4747
- name: symbolsAzureSubscription
@@ -108,13 +108,13 @@ jobs:
108108

109109
- template: ../steps/compound-esrp-code-signing-step.yml@self
110110
parameters:
111-
akvName: '${{ parameters.signingAkvName }}'
112-
appRegistrationClientId: '${{ parameters.signingAppRegistrationClientId }}'
113-
appRegistrationTenantId: '${{ parameters.signingAppRegistrationTenantId }}'
111+
ESRPConnectedServiceName: '${{ parameters.ESRPConnectedServiceName }}'
112+
appRegistrationClientId: '${{ parameters.AppRegistrationClientId }}'
113+
appRegistrationTenantId: '${{ parameters.AppRegistrationTenantId }}'
114+
EsrpClientId: '${{ parameters.EsrpClientId }}'
115+
AuthAkvName: '${{ parameters.AuthAkvName }}'
116+
AuthSignCertName: '${{ parameters.AuthSignCertName }}'
114117
artifactType: 'dll'
115-
authCertName: '${{ parameters.signingAuthCertName }}'
116-
connectedServiceName: '${{ parameters.signingConnectedServiceName }}'
117-
signingCertName: '${{ parameters.signingSignCertName }}'
118118

119119
- template: ../steps/compound-nuget-pack-step.yml@self
120120
parameters:
@@ -127,13 +127,13 @@ jobs:
127127

128128
- template: ../steps/compound-esrp-code-signing-step.yml@self
129129
parameters:
130-
akvName: '${{ parameters.signingAkvName }}'
131-
appRegistrationClientId: '${{ parameters.signingAppRegistrationClientId }}'
132-
appRegistrationTenantId: '${{ parameters.signingAppRegistrationTenantId }}'
130+
ESRPConnectedServiceName: '${{ parameters.ESRPConnectedServiceName }}'
131+
appRegistrationClientId: '${{ parameters.AppRegistrationClientId }}'
132+
appRegistrationTenantId: '${{ parameters.AppRegistrationTenantId }}'
133+
EsrpClientId: '${{ parameters.EsrpClientId }}'
134+
AuthAkvName: '${{ parameters.AuthAkvName }}'
135+
AuthSignCertName: '${{ parameters.AuthSignCertName }}'
133136
artifactType: 'pkg'
134-
authCertName: '${{ parameters.signingAuthCertName }}'
135-
connectedServiceName: '${{ parameters.signingConnectedServiceName }}'
136-
signingCertName: '${{ parameters.signingSignCertName }}'
137137

138138
- ${{ if parameters.publishSymbols }}:
139139
- template: ../steps/compound-publish-symbols-step.yml@self

‎eng/pipelines/libraries/common-variables.yml

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,14 @@
55
#################################################################################
66

77
variables:
8+
- group: ESRP Federated Creds (AME)
9+
# ESRPConnectedServiceName
10+
# ESRPClientId
11+
# AppRegistrationClientId
12+
# AppRegistrationTenantId
13+
# AuthAKVName
14+
# AuthSignCertName
15+
816
- name: Configuration
917
value: Release
1018
- name: CommitHead
@@ -17,7 +25,3 @@ variables:
1725
value: $(REPOROOT)/symbols
1826
- name: artifactDirectory
1927
value: '$(REPOROOT)/packages'
20-
- name: appRegistrationClientId
21-
value: 'a0d18a38-fde1-4ba7-92e1-15be16cb6a8e'
22-
- name: appRegistrationTenantId
23-
value: '72f988bf-86f1-41af-91ab-2d7cd011db47'

‎eng/pipelines/steps/compound-esrp-code-signing-step.yml

Lines changed: 23 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,7 @@
55
#################################################################################
66

77
parameters:
8-
- # Name of the Azure Key Vault to retrieve certificates from.
9-
# note: This has nothing to do with the AKV provider package.
10-
name: akvName
8+
- name: ESRPConnectedServiceName
119
type: string
1210

1311
- name: appRegistrationClientId
@@ -16,45 +14,47 @@ parameters:
1614
- name: appRegistrationTenantId
1715
type: string
1816

19-
- name: artifactType
17+
- name: EsrpClientId
2018
type: string
21-
values:
22-
- dll
23-
- pkg
2419

25-
- name: authCertName
20+
- # Name of the Azure Key Vault to retrieve ESRP Code Signing certificate from.
21+
name: AuthAkvName
2622
type: string
2723

28-
- name: connectedServiceName
24+
- name: authSignCertName
2925
type: string
3026

31-
- name: signingCertName
27+
- name: artifactType
3228
type: string
29+
values:
30+
- dll
31+
- pkg
3332

3433
steps:
3534
- ${{ if eq(parameters.artifactType, 'dll') }}:
3635
- task: EsrpMalwareScanning@5
3736
displayName: 'ESRP Malware Scanning Code'
3837
inputs:
38+
ConnectedServiceName: '${{ parameters.ESRPConnectedServiceName }}'
3939
AppRegistrationClientId: '${{ parameters.appRegistrationClientId }}'
4040
AppRegistrationTenantId: '${{ parameters.appRegistrationTenantId }}'
41+
EsrpClientId: '${{ parameters.EsrpClientId }}'
42+
UseMSIAuthentication: true
4143
CleanupTempStorage: 1
42-
ConnectedServiceName: '${{ parameters.connectedServiceName }}'
43-
AuthAKVName: '${{ parameters.akvName }}'
44-
AuthCertName: '${{ parameters.authCertName }}'
4544
FolderPath: '$(BUILD_OUTPUT)'
4645
Pattern: '*.dll'
4746
VerboseLogin: 1
4847

4948
- task: EsrpCodeSigning@5
5049
displayName: 'ESRP Signing Code'
5150
inputs:
51+
ConnectedServiceName: '${{ parameters.ESRPConnectedServiceName }}'
5252
AppRegistrationClientId: '${{ parameters.appRegistrationClientId }}'
5353
AppRegistrationTenantId: '${{ parameters.appRegistrationTenantId }}'
54+
EsrpClientId: '${{ parameters.EsrpClientId }}'
55+
UseMSIAuthentication: true
5456
AuthAKVName: '${{ parameters.akvName }}'
55-
AuthCertName: '${{ parameters.authCertName }}'
56-
AuthSignCertName: '${{ parameters.signingCertName }}'
57-
ConnectedServiceName: '${{ parameters.connectedServiceName }}'
57+
AuthSignCertName: '${{ parameters.AuthSignCertName }}'
5858
FolderPath: '$(BUILD_OUTPUT)'
5959
Pattern: '*.dll'
6060
signConfigType: 'inlineSignParams'
@@ -102,25 +102,26 @@ steps:
102102
- task: EsrpMalwareScanning@5
103103
displayName: 'ESRP Malware Scanning NuGet Package'
104104
inputs:
105+
ConnectedServiceName: '${{ parameters.ESRPConnectedServiceName }}'
105106
AppRegistrationClientId: '${{ parameters.appRegistrationClientId }}'
106107
AppRegistrationTenantId: '${{ parameters.appRegistrationTenantId }}'
108+
EsrpClientId: '${{ parameters.EsrpClientId }}'
109+
UseMSIAuthentication: true
107110
CleanupTempStorage: 1
108-
ConnectedServiceName: '${{ parameters.connectedServiceName }}'
109-
AuthAKVName: '${{ parameters.akvName }}'
110-
AuthCertName: '${{ parameters.authCertName }}'
111111
FolderPath: '$(ARTIFACT_PATH)'
112112
Pattern: '*.*nupkg'
113113
VerboseLogin: 1
114114

115115
- task: EsrpCodeSigning@5
116116
displayName: 'ESRP Signing NuGet Package'
117117
inputs:
118+
ConnectedServiceName: '${{ parameters.ESRPConnectedServiceName }}'
118119
AppRegistrationClientId: '${{ parameters.appRegistrationClientId }}'
119120
AppRegistrationTenantId: '${{ parameters.appRegistrationTenantId }}'
121+
EsrpClientId: '${{ parameters.EsrpClientId }}'
122+
UseMSIAuthentication: true
120123
AuthAKVName: '${{ parameters.akvName }}'
121-
AuthCertName: '${{ parameters.authCertName }}'
122-
AuthSignCertName: '${{ parameters.signingCertName }}'
123-
ConnectedServiceName: '${{ parameters.connectedServiceName }}'
124+
AuthSignCertName: '${{ parameters.AuthSignCertName }}'
124125
FolderPath: '$(ARTIFACT_PATH)'
125126
Pattern: '*.*nupkg'
126127
signConfigType: 'inlineSignParams'

‎eng/pipelines/variables/akv-official-variables.yml

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,8 @@
77
# @TODO: These seem to only really apply to official builds. Name should probably be adjusted to match.
88

99
variables:
10+
# @TODO: Rename to something more appropriate for symbols
1011
- group: 'akv-variables-v2'
11-
# SigningAppRegistrationClientId
12-
# SigningAppRegistrationTenantId
13-
# SigningAkvName
14-
# SigningAuthCertName
15-
# SigningConnectedServiceName
16-
# SigningSignCertName
1712
# SymbolsAzureSubscription
1813
# SymbolsPublishProjectName
1914
# SymbolsPublishServer

0 commit comments

Comments
 (0)