How to authenticate with AAD access token

[PSanetra]

It is easy to get an AAD access token via the azidentity package in azure-sdk-for-go. Is there any example how to use `oras-go? with such a token to authenticate with a Azure Container Registry?

As far as I know it is needed to exchange the AAD access token with for an Azure Container Registry refresh token. See ACR docs.

Also as far as I know the AAD access token needs to be issued for the https://management.core.windows.net/.default scope, although i don't know if this is documented somewhere, but this is the scope which is used by the azcontainerregistry package.

Does the oras-go library support such a token exchange or are there any examples available how to do this?

I guess when you have such a refresh token you can just use the StaticCredential like this:

client := &auth.Client{
	Client: retry.DefaultClient,
	Cache:  auth.DefaultCache,
	Credential: auth.StaticCredential(registry.Endpoint, auth.Credential{
		RefreshToken: acrRefreshToken,
	}),
}

[Wwwsylvia]

Hi @PSanetra,

As far as I know it is needed to exchange the AAD access token with for an Azure Container Registry refresh token. See ACR docs.

Yes I think the ExchangeAADAccessTokenForACRRefreshToken function provided in azure-sdk-for-go can help on this.
Once you get the ACR refresh token you can do

client := &auth.Client{
	Client: retry.DefaultClient,
	Cache:  auth.DefaultCache,
	Credential: auth.StaticCredential(registry.Endpoint, auth.Credential{
		RefreshToken: acrRefreshToken,
	}),
}

Does the oras-go library support such a token exchange or are there any examples available how to do this?

oras-go is a vendor-neutral product and does not support any vendor-specific APIs such as ACR exchange API.
You may leverage the package azcontainerregistry in azure-sdk-for-go for ACR specific operations.

[PSanetra]

@Wwwsylvia Thank you for having a look at this issue! Sadly that function does not seem to be exposed as the authenticationClient struct is package private, or am I missing something? 😕

[Wwwsylvia]

Sadly that function does not seem to be exposed as the authenticationClient struct is package private

Ohhh indeed it is private🫤. It looks like you have to implement the exchange logic on your own since it is out of the scopes of oras-go.
Currently the ACR doc and the ExchangeAADAccessTokenForACRRefreshToken function are the only references that I'm aware of.