0j}~ddlZddlZddlZddlZddlZddlZddlZddlmZddl m Z ddl m Z m Z mZddlmZddlmZddlmZmZdd lmZdd lmZmZejeZGd d eZ Gd de Z!Gdde!Z"Gdde!Z#GddeZ$Gdde%Z&dZ'dZ(e%Z)e%Z*e%Z+e%Z,e%Z-e%Z.dZ/dddde e0de e e0fdZ1d)dZ2dZ3d Z4d!Z5dddde0de e e0fd"Z6d#ej78d$d%Z9Gd&d'e Z:d(Z;dS)*N)urlparse)UserDict)ListOptionalUnion) TokenCache)_IndividualCache)ThrottledHttpClientBaseRetryAfterParser)_is_running_in_cloud_shell)SKU __version__ceZdZdS)ManagedIdentityErrorN__name__ __module__ __qualname__]/home/rurouni/.hermes/hermes-agent/venv/lib/python3.11/site-packages/msal/managed_identity.pyrrDrrceZdZdZdZdZdZdZdZdZ eded ed iZ e d Z e d Z e d Zdfd ZxZS)ManagedIdentityzFeed an instance of this class to :class:`msal.ManagedIdentityClient` to acquire token for the specified managed identity. ManagedIdentityIdTypeIdClientId ResourceIdObjectIdSystemAssigned client_id msi_res_id object_idct|tp)||p||SN) isinstanceris_system_assignedis_user_assignedclsunknowns ris_managed_identityz#ManagedIdentity.is_managed_identity1s@7O44-%%g..-##G,, .rct|tp7t|to"||j|jkSr&)r'SystemAssignedManagedIdentitydictgetID_TYPESYSTEM_ASSIGNEDr*s rr(z"ManagedIdentity.is_system_assigned7sH'#@AAA w % % @ CK((C,?? Arct|tpOt|to:||j|jvo||jSr&)r'UserAssignedManagedIdentityr0r1r2_types_mappingIDr*s rr)z ManagedIdentity.is_user_assigned=s['#>??% w % % $ CK((C,>> $ CF## %rNcttt||j||j|idSr&)superr__init__r2r7)self identifierid_type __class__s rr:zManagedIdentity.__init__DsB ot$$-- L' GZ/      r)NN)rrr__doc__r2r7 CLIENT_ID RESOURCE_ID OBJECT_IDr3r6 classmethodr-r(r)r: __classcell__r>s@rrrs&G BIKI&O ;\;N ..[. AA[A %%[%           rrc"eZdZdZfdZxZS)r/zRepresent a system-assigned managed identity. It is equivalent to a Python dict of:: {"ManagedIdentityIdType": "SystemAssigned", "Id": None} or a JSON blob of:: {"ManagedIdentityIdType": "SystemAssigned", "Id": null} cdtt||jdS)N)r=)r9r/r:r3)r;r>s rr:z&SystemAssignedManagedIdentity.__init__Ws. +T22;;DDX;YYYYYrrrrr?r:rDrEs@rr/r/LsK  ZZZZZZZZZrr/c,eZdZdZddddfd ZxZS)r5a9Represent a user-assigned managed identity. Depends on the id you provided, the outcome is equivalent to one of the below:: {"ManagedIdentityIdType": "ClientId", "Id": "foo"} {"ManagedIdentityIdType": "ResourceId", "Id": "foo"} {"ManagedIdentityIdType": "ObjectId", "Id": "foo"} N)r" resource_idr$cl|r5|s3|s1tt||j|dS|s5|r3|s1tt||j|dS|s5|s3|r1tt||j|dSt d)N)r=r<zPYou shall specify one of the three parameters: client_id, resource_id, object_id)r9r5r:r@rArBr)r;r"rJr$r>s rr:z$UserAssignedManagedIdentity.__init__ds  5[ 5 5 -t 4 4 = =9 > > > > > > 5{ 59 5 -t 4 4 = =([ > B B B B B 5; 59 5 -t 4 4 = =9 > > > > > >'455 5rrHrEs@rr5r5[sU%)dd 5 5 5 5 5 5 5 5 5 5 5rr5ceZdZfdZxZS)_ThrottledHttpClientcttj|i|tjfdt djj_dS)Nc d|dt|dt|dzS)Nz"REQ {} hash={} 429/5xx/Retry-Afterrparamsdata)format_hashstrr1)funcargskwargsr;s rz/_ThrottledHttpClient.__init__..ysd1U1\1\Q  8,,--FJJv4F4F0G0GGII22r)mapping key_maker expires_in)r9rMr:IndividualCache_expiring_mappingr parser1)r;rVrWr>s` rr:z_ThrottledHttpClient.__init__us2"D))2DCFCCC ?*(**0   h  r)rrrr:rDrEs@rrMrMts8         rrMceZdZdZdZdZdZdZdZddddde e e e e fd eeefd Zdd d ed eefdZdS)ManagedIdentityClienta*This API encapsulates multiple managed identity back-ends: VM, App Service, Azure Automation (Runbooks), Azure Function, Service Fabric, and Azure Arc. It also provides token cache support. .. note:: Cloud Shell support is NOT implemented in this class. Since MSAL Python 1.18 in May 2022, it has been implemented in :func:`PublicClientApplication.acquire_token_interactive` via calling pattern ``PublicClientApplication(...).acquire_token_interactive(scopes=[...], prompt="none")``. That is appropriate, because Cloud Shell yields a token with delegated permissions for the end user who has signed in to the Azure Portal (like what a ``PublicClientApplication`` does), not a token with application permissions for an app. localhostmanaged_identity token_sourceidentity_providercacheN) token_cache http_cacheclient_capabilitiesrict|std|||_t |||_|p t |_||_dS)a Create a managed identity client. :param managed_identity: It accepts an instance of :class:`SystemAssignedManagedIdentity` or :class:`UserAssignedManagedIdentity`. They are equivalent to a dict with a certain shape, which may be loaded from a JSON configuration file or an env var. :param http_client: An http client object. For example, you can use ``requests.Session()``, optionally with exponential backoff behavior demonstrated in this recipe:: import msal, requests from requests.adapters import HTTPAdapter, Retry s = requests.Session() retries = Retry(total=3, backoff_factor=0.1, status_forcelist=[ 429, 500, 501, 502, 503, 504]) s.mount('https://', HTTPAdapter(max_retries=retries)) managed_identity = ... client = msal.ManagedIdentityClient(managed_identity, http_client=s) :param token_cache: Optional. It accepts a :class:`msal.TokenCache` instance to store tokens. It will use an in-memory token cache by default. :param http_cache: Optional. It has the same characteristics as the :paramref:`msal.ClientApplication.http_cache`. :param list[str] client_capabilities: (optional) Allows configuration of one or more client capabilities, e.g. ["CP1"]. Client capability is meant to inform the Microsoft identity platform (STS) what this client is capable for, so STS can decide to turn on certain features. Implementation details: Client capability in Managed Identity is relayed as-is via ``xms_cc`` parameter on the wire. Recipe 1: Hard code a managed identity for your app:: import msal, requests client = msal.ManagedIdentityClient( msal.UserAssignedManagedIdentity(client_id="foo"), http_client=requests.Session(), ) token = client.acquire_token_for_client("resource") Recipe 2: Write once, run everywhere. If you use different managed identity on different deployment, you may use an environment variable (such as MY_MANAGED_IDENTITY_CONFIG) to store a json blob like ``{"ManagedIdentityIdType": "ClientId", "Id": "foo"}`` or ``{"ManagedIdentityIdType": "SystemAssigned", "Id": null}``. The following app can load managed identity configuration dynamically:: import json, os, msal, requests config = os.getenv("MY_MANAGED_IDENTITY_CONFIG") assert config, "An ENV VAR with value should exist" client = msal.ManagedIdentityClient( json.loads(config), http_client=requests.Session(), ) token = client.acquire_token_for_client("resource") zIncorrect managed_identity: )rhN) rr-r_managed_identityrM _http_clientr _token_cache_client_capabilities)r;rc http_clientrgrhris rr:zManagedIdentityClient.__init__s`223CDD C&A/?AACC C!10 !    (7:<<$7!!!r)claims_challengeresourcerpc d}d}|jtjd}t j} |j|jjj|gt||j |j d}|D]}t|d|z } | dkr!|r |s |d}ntd d |dd |d d d t| |j|ji}d|vr3t|d|d<t|d|krn|cS t#|j|j||r9t'j|dnd|j} d | vr| d d} d| vr| dkrt| dz | d<|jt||gd|j |j | iid| vrt|| dz| d<|j| |j<| rd| vs|s| Sn #|sYnxYw|S)aEAcquire token for the managed identity. The result will be automatically cached. Subsequent calls will automatically search from cache first. :param resource: The resource for which the token is acquired. :param claims_challenge: Optional. It is a string representation of a JSON object (which contains lists of claims being requested). The tenant admin may choose to revoke all Managed Identity tokens, and then a *claims challenge* will be returned by the target resource, as a `claims_challenge` directive in the `www-authenticate` header, even if the app developer did not opt in for the "CP1" client capability. Upon receiving a `claims_challenge`, MSAL will attempt to acquire a new token. .. note:: Known issue: When an Azure VM has only one user-assigned managed identity, and your app specifies to use system-assigned managed identity, Azure VM may still return a token for your user-assigned identity. This is a service-side behavior that cannot be changed by this library. `Azure VM docs `_ N SYSTEM_ASSIGNED_MANAGED_IDENTITYT)r" environmentrealmhome_account_id)targetquery expires_oni,secretzCache hit an AT access_token token_typeBearerr\ refresh_onzutf-8access_token_sha256_to_refreshrii refresh_ini z https://{}/{})r"scopetoken_endpointresponserPrQerror)rkr1rr7timermsearchCredentialType ACCESS_TOKENr0 _ManagedIdentityClient__instance_tenantintloggerdebug _TOKEN_SOURCE_TOKEN_SOURCE_CACHE _obtain_tokenrlhashlibsha256encode hexdigestrnaddrR_TOKEN_SOURCE_IDP) r;rqrpaccess_token_to_refreshaccess_token_from_cacheclient_id_in_cachenowmatchesentryr\results racquire_token_for_clientz.ManagedIdentityClient.acquire_token_for_clients B#'"&!377   BDDikk /'..!0= z0 $,$( /  G! / / |!455; $$#,C/4Ho+E .///"E(O %))L("C"C #j//&(@ +'  5((+>F<(!%%d0#*#2#9#9$7$7#''' 6))+.sVL5I/I+J+JF<(-1-Ct)* 7&00:Q0 1 *   &&s DI$$I+)rrrr?rrrrrrr0rr/r5rrrTr:rrrrraras"J!G"M+!37c8c8c8   ) ' )c8&d3i0c8c8c8c8R+/ e'e'e'e'#3- e'e'e'e'e'e'rracrt|}|jr d|j|jS|S)Nz{}://{})rschemerRnetloc)rus r_scope_to_resourcerks6Ax4!(333 Lrc`dtjvr dtjvrtjdStjdkrtjdsLtjdkr>tjtjdrdSdSdS)NIDENTITY_ENDPOINT IMDS_ENDPOINTlinuxz/opt/azcmagent/bin/himdswin32z4${ProgramFiles}\AzureConnectedMachineAgent\himds.exez5http://localhost:40342/metadata/identity/oauth2/token)osenvironsysplatformpathexists expandvarsrrr_get_arc_endpointrrsbj((_ -J-Jz-.. BGNN3M$N$N <7 " "rw~~bg6H6H C7 7 ( ( " GF # " " "rcRdtjvr#dtjvrdtjvrtSdtjvrdtjvrtSdtjvrdtjvrtSt rt StrtStS)zDetect the current environment and return the likely identity source. When this function returns ``CLOUD_SHELL``, you should use :func:`msal.PublicClientApplication.acquire_token_interactive` with ``prompt="none"`` to obtain a token. rIDENTITY_HEADERIDENTITY_SERVER_THUMBPRINT MSI_ENDPOINT MSI_SECRET) rrSERVICE_FABRIC APP_SERVICEMACHINE_LEARNINGr AZURE_ARCr CLOUD_SHELL DEFAULT_TO_VMrrrget_managed_identity_sourcers rz)).?2:.M.M, ::bj((->"*-L-L##  (B(B!## rrrric  dtjvr~dtjvrpdtjvrb|rtdt |tjdtjdtjd|||SdtjvrAdtjvr3t |tjdtjd||SdtjvrAdtjvr3t |tjdtjd||St}|r:t |rtdt|||St|||S) NrrrzIgnoring managed_identity parameter. Managed Identity in Service Fabric is configured in the cluster, not during runtime. See also https://learn.microsoft.com/en-us/azure/service-fabric/configure-existing-cluster-enable-managed-identity-token-servicerrrzInvalid managed_identity parameter. Azure Arc supports only system-assigned managed identity, See also https://learn.microsoft.com/en-us/azure/service-fabric/configure-existing-cluster-enable-managed-identity-token-service) rrrr_obtain_token_on_service_fabric_obtain_token_on_app_service!_obtain_token_on_machine_learningrrr)r_obtain_token_on_arc_obtain_token_on_azure_vm)rorcrqrri arc_endpoints rrrs rz)).?2:.M.M, ::  K LLJ K K K /  J* + J( ) J3 4 +I 3    bj((->"*-L-L+  J* + J( )      ##  (B(B0  J~ & J| $      %&&LI  + +,< = = K&JKK K $KxHHH $[2BH M MMrc|p tj|tj}|r|tj||<dSdSr&)rr6r1r2r7)rPrc types_mappingid_names r _adjust_paramrsZ> >CC_45577G?*?+=>w??rc tdd|d}t|||t jddddz|dttttj d  } tj |j}|d r\|d rG|d t|d |d |dddS|S#tjj$r"td|jwxYw)Nz0Obtaining token via managed identity on Azure VMz 2018-02-01 api-versionrq!AZURE_POD_IDENTITY_AUTHORITY_HOSTzhttp://169.254.169.254/z/metadata/identity/oauth2/tokentrue)Metadataz x-client-SKUz x-client-Verzx-ms-client-request-idrPheadersr{r\rqr|r}r{r\rqr|!IMDS emits unexpected payload: %s)rrrr1rgetenvstriprrrTuuiduuid4jsonloadstextrdecoderJSONDecodeError)rorcrqrPresppayloads rrrsh LLCDDD#  F&*+++ ?? /1I  eCjj< ='&)$*,,&7&7   D *TY'' ;;~ & & 7;;|+D+D  ' 7!',"788#KK 33%kk,AA    < ' 8$)DDD sB D+)D++6E!c *tdd|d}t||tjdtjdtjdi||||dd  } tj |j }|d r}|d rh|d t|d ttj z |d |dddSdd |d|ddS#tjj$r"td|j wxYw)zObtains token for `App Service `_, Azure Functions, and Azure Automation. z9Obtaining token via managed identity on Azure App Servicez 2019-08-01rr" mi_res_idr$)rr)zX-IDENTITY-HEADERrrr{ryrqr|r}r invalid_scopez{}, {} statusCodemessagererror_descriptionr)rrrrr@rArBr1rrrrrrRrr)roendpointidentity_headerrcrqrPrrs rrrs LLLMMM#  F&*!;#[!;; ??!0  D*TY'' ;;~ & & 7;;|+D+D  ' 7!',"7883ty{{;K;KK#KK 33%kk,AA  %!) L))7;;y+A+A"C"C  < ' 8$)DDD s2B*E>E6Fctdd|d}t|||ddkrd|vr|d|d<|||d|i} t j|j}|d r}|d rh|d t|d ttj z |d |d d dSdd |dS#t j j $r"td|jwxYw)Nz>Obtaining token via managed identity on Azure Machine Learningz 2017-09-01rrr"clientidrzrr{ryrqr|r}rrz{}rr) rrrpopr1rrrrrrRrr)rorrzrcrqrPrrs rrr+s  LLQRRR)x @ @F&*+++ m ,,1F1F#ZZ 44z ??6"   D *TY'' ;;~ & & 7;;|+D+D  ' 7!',"7883ty{{;K;KK#KK 33%kk,AA  %!%W!5!5  < ' 8$)DDD s3B*D6D666E,c "td||dd|||rd|nddDd|i} t j|j}|d ro|d rZ|d t|d ttj z |d |d d S|di} dddd} | | dd|jdS#t j j $r"td|jwxYw)zfObtains token for `Service Fabric `_ zz3_obtain_token_on_service_fabric..\s.(((A  1 'rz2019-07-01-preview,N)rrqtoken_sha256_to_refreshxms_ccSecretrr{ryrqr|rrunauthorized_clientinvalid_clientr)SecretHeaderNotFoundManagedIdentityNotFoundArgumentNullOrEmptycodeinvalid_requestrr) rrr1joinitemsrrrrrrr) rorrserver_thumbprintrqrrirrr error_mappings rrrMs LLOPPP ??((/ 'E7JTchh2333PT "" egg ((( ?+  D*TY'' ;;~ & & 7;;|+D+D  ' 7!L)DIKK(()$KK 33%l3   GR(($9'7#2 #&&uyy'8'8:KLL!%  < ' 8$)DDD s.BE A E6Fz/var/opt/azcmagent/tokensz/%ProgramData%\AzureConnectedMachineAgent\Tokens)rrceZdZdS)ArcPlatformNotSupportedErrorNrrrrrrrrrc  td||d|dddi}d fd|jD d d }t |d kr|d d ks'td |jtj tvrtdtj dtjttj tjtj|dd dz}tj|jdkrtdt+|5}|}dddn #1swxYwY||d|ddd |d} t/j|j} | dr\| drG| dt5| d| dd| ddSn#t.jj$rYnwxYwd|jdS)Nz1Obtaining token via managed identity on Azure Arcz 2020-06-01rrrrzwww-authenticatecpi|]2\}}|k||3Sr)lower)rrrwww_auths rrz(_obtain_token_on_arc..sB   Ah9N9N 19N9N9Nr=rrz basic realmz*Unrecognizable WWW-Authenticate header: {}z Platform z was undefined and unsupportedrz.keyiz+Local key file shall not be larger than 4KBzBasic {})r Authorizationr{r\r|r}rq)r{r\r|rqrr)rrr1rrsplitlenrrrRrr+_supported_arc_platforms_and_their_prefixesrrrrsplitextbasenamestatst_sizeopenreadrrrrrr) rorrqr challengefilenamefrzrrrs @rrrs LLDEEE ??+BBV$   D "H    "&!3!3!5!5    #h  EE#JJ   NNa  IaL$6$6$8$8M$I$I" 8 ? ? M MOO O |FFF* D D D DFF Fw||3CLA )))A,7788;fDFFH wx 4''"#PQQQ h1+BB#j6G6G6O6OPP  H  *X]++ ;;~ & & 7;;|+D+D !( 7!',"788%kk,AA#KK 33   < '     #%]   s%G))G-0G-&B J11KKr&)r!s   !!!!!! ((((((((((######AAAAAALLLLLLLL222222!!!!!!!!  8 $ $     :   , , , , , h, , , ^ Z Z Z Z ZO Z Z Z55555/5552     2    d'd'd'd'd'Fd'd'd'N G G Gfhh FHH fhh 688 259/3 2N2N2N%-SM2N"$s), 2N2N2N2Nj????   D///bJ+//3 ...%(."$s), ....d) W   R S S//+      #7   1 1 1 1 1 r