azkv: enable specifying some auth methods directly, and add cachable user authentication methods

Author: daytime-saxophone

azkv/keysource.go

@@ -9,13 +9,19 @@ import (
 	"context"
 	"encoding/base64"
 	"fmt"
+	"path/filepath"
 	"regexp"
 	"strings"
 	"time"
 
+	"encoding/json"
+	"os"
+
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
 	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
+	azidentitycache "github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache"
 	"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys"
 	"github.com/sirupsen/logrus"
 
@@ -25,6 +31,8 @@ import (
 const (
 	// KeyTypeIdentifier is the string used to identify an Azure Key Vault MasterKey.
 	KeyTypeIdentifier = "azure_kv"
+
+	sopsAzureAuthMethod = "SOPS_AZURE_AUTH_METHOD"
 )
 
 var (
@@ -230,7 +238,132 @@ func (key *MasterKey) TypeToIdentifier() string {
 // azidentity.NewDefaultAzureCredential.
 func (key *MasterKey) getTokenCredential() (azcore.TokenCredential, error) {
 	if key.tokenCredential == nil {
-		return azidentity.NewDefaultAzureCredential(nil)
+
+		authMethod := strings.ToUpper(os.Getenv(sopsAzureAuthMethod))
+		switch authMethod {
+		case "BROWSER":
+
+			return cachedInteractiveBrowserCredentials()
+
+		case "DEVICE_CODE":
+			return cachedDeviceCodeCredentials()
+		case "AZURE_CLI":
+			return azidentity.NewAzureCLICredential(nil)
+		case "MSI":
+			return azidentity.NewManagedIdentityCredential(nil)
+		// If "DEFAULT" or not explicitly specified then use the default authentication chain.
+		case "", "DEFAULT":
+			return azidentity.NewDefaultAzureCredential(nil)
+		default:
+			return nil, fmt.Errorf("Value `%s` is unsupported for `%s`, to resolve this either leave it unset or use one of DEFAULT/MSI/BROWSER/DEVICE_CODE", authMethod, sopsAzureAuthMethod)
+		}
 	}
 	return key.tokenCredential, nil
 }
+
+func sopsCacheDir() (string, error) {
+	userCacheDir, err := os.UserCacheDir()
+	if err != nil {
+		return "", err
+	}
+
+	cacheDir := filepath.Join(userCacheDir, "/sops")
+
+	if err = os.MkdirAll(cacheDir, 0o700); err != nil {
+		return "", err
+	}
+
+	return cacheDir, nil
+}
+
+type CachableTokenCredential interface {
+	Authenticate(ctx context.Context, opts *policy.TokenRequestOptions) (azidentity.AuthenticationRecord, error)
+	GetToken(ctx context.Context, opts policy.TokenRequestOptions) (azcore.AccessToken, error)
+}
+
+func cacheStoreRecord(cachePath string, record azidentity.AuthenticationRecord) error {
+	b, err := json.Marshal(record)
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(cachePath, b, 0600)
+}
+
+func cacheLoadRecord(cachePath string) (azidentity.AuthenticationRecord, error) {
+	var record azidentity.AuthenticationRecord
+
+	b, err := os.ReadFile(cachePath)
+	if err != nil {
+		return record, err
+	}
+
+	err = json.Unmarshal(b, &record)
+	if err != nil {
+		return record, err
+	}
+
+	return record, nil
+}
+
+func cacheTokenCredential(cachePath string, tokenCredentialFn func(cache azidentity.Cache, record azidentity.AuthenticationRecord) (CachableTokenCredential, error)) (azcore.TokenCredential, error) {
+	cache, err := azidentitycache.New(nil)
+	// Errors if persistent caching is not supported by the current runtime
+	if err != nil {
+		return nil, err
+	}
+
+	cachedRecord, cacheLoadErr := cacheLoadRecord(cachePath)
+
+	credential, err := tokenCredentialFn(cache, cachedRecord)
+	if err != nil {
+		return nil, err
+	}
+
+	// If loading the authenticationRecord from the cachePath failed for any reason (validation, file doesn't exist, not encoded using json, etc.)
+	if cacheLoadErr != nil {
+		record, err := credential.Authenticate(context.Background(), nil)
+		if err != nil {
+			return nil, err
+		}
+
+		if err = cacheStoreRecord(cachePath, record); err != nil {
+			return nil, err
+		}
+	}
+
+	return credential, nil
+}
+
+func cachedInteractiveBrowserCredentials() (azcore.TokenCredential, error) {
+	cacheDir, err := sopsCacheDir()
+	if err != nil {
+		return nil, err
+	}
+	return cacheTokenCredential(
+		filepath.Join(cacheDir, "azure_auth_record_browser.json"),
+		func(cache azidentity.Cache, record azidentity.AuthenticationRecord) (CachableTokenCredential, error) {
+			return azidentity.NewInteractiveBrowserCredential(&azidentity.InteractiveBrowserCredentialOptions{
+				AuthenticationRecord: record,
+				Cache:                cache,
+			})
+		},
+	)
+}
+
+func cachedDeviceCodeCredentials() (azcore.TokenCredential, error) {
+	cacheDir, err := sopsCacheDir()
+	if err != nil {
+		return nil, err
+	}
+
+	return cacheTokenCredential(
+		filepath.Join(cacheDir, "azure_auth_record_device_code.json"),
+		func(cache azidentity.Cache, record azidentity.AuthenticationRecord) (CachableTokenCredential, error) {
+			return azidentity.NewDeviceCodeCredential(&azidentity.DeviceCodeCredentialOptions{
+				AuthenticationRecord: record,
+				Cache:                cache,
+			})
+		},
+	)
+}

go.mod

@@ -1,14 +1,16 @@
 module github.com/getsops/sops/v3
 
-go 1.22
-toolchain go1.23.6
+go 1.23.0
+
+toolchain go1.24.0
 
 require (
 	cloud.google.com/go/kms v1.21.0
 	cloud.google.com/go/storage v1.50.0
 	filippo.io/age v1.2.1
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.2
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.1
 	github.com/ProtonMail/go-crypto v1.1.5
 	github.com/aws/aws-sdk-go-v2 v1.36.2
@@ -60,6 +62,7 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
+	github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.3.3 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.25.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.49.0 // indirect
@@ -112,6 +115,7 @@ require (
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/keybase/go-keychain v0.0.0-20231219164618-57a3676c3af6 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect