diff --git a/go.mod b/go.mod index 8de9a8cc51..bc32e90361 100644 --- a/go.mod +++ b/go.mod @@ -60,7 +60,7 @@ require ( github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect github.com/Azure/msi-dataplane v0.4.3 // indirect - github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 // indirect + github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 // indirect github.com/NYTimes/gziphandler v1.1.1 // indirect github.com/antlr4-go/antlr/v4 v4.13.1 // indirect github.com/beorn7/perks v1.0.1 // indirect diff --git a/go.sum b/go.sum index 0b29519a37..b1742b6ba7 100644 --- a/go.sum +++ b/go.sum @@ -46,8 +46,8 @@ github.com/Azure/msi-dataplane v0.4.3 h1:dWPWzY4b54tLIR9T1Q014Xxd/1DxOsMIp6EjRFA github.com/Azure/msi-dataplane v0.4.3/go.mod h1:yAfxdJyvcnvSDfSyOFV9qm4fReEQDl+nZLGeH2ZWSmw= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE= -github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 h1:XkkQbfMyuH2jTSjQjSoihryI8GINRcs4xp8lNawg0FI= -github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= +github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 h1:oygO0locgZJe7PpYPXT5A29ZkwJaPqcva7BVeemZOZs= +github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI= github.com/NYTimes/gziphandler v1.1.1 h1:ZUDjpQae29j0ryrS0u/B8HZfJBtBQHjqw2rQ2cqUQ3I= github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c= github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ= diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/local/server.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/local/server.go index c6baf20947..cda678e334 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/local/server.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/local/server.go @@ -143,10 +143,9 @@ func (s *Server) handler(w http.ResponseWriter, r *http.Request) { headerErr := q.Get("error") if headerErr != "" { desc := html.EscapeString(q.Get("error_description")) - escapedHeaderErr := html.EscapeString(headerErr) // Note: It is a little weird we handle some errors by not going to the failPage. If they all should, // change this to s.error() and make s.error() write the failPage instead of an error code. - _, _ = w.Write([]byte(fmt.Sprintf(failPage, escapedHeaderErr, desc))) + _, _ = w.Write([]byte(fmt.Sprintf(failPage, headerErr, desc))) s.putResult(Result{Err: fmt.Errorf("%s", desc)}) return diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authority.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authority.go index 3f40374640..c3c4a96fc3 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authority.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authority.go @@ -46,11 +46,9 @@ type jsonCaller interface { JSONCall(ctx context.Context, endpoint string, headers http.Header, qv url.Values, body, resp interface{}) error } -// For backward compatibility, accept both old and new China endpoints for a transition period. var aadTrustedHostList = map[string]bool{ "login.windows.net": true, // Microsoft Azure Worldwide - Used in validation scenarios where host is not this list - "login.partner.microsoftonline.cn": true, // Microsoft Azure China (new) - "login.chinacloudapi.cn": true, // Microsoft Azure China (legacy, backward compatibility) + "login.partner.microsoftonline.cn": true, // Microsoft Azure China "login.microsoftonline.de": true, // Microsoft Azure Blackforest "login-us.microsoftonline.com": true, // Microsoft Azure US Government - Legacy "login.microsoftonline.us": true, // Microsoft Azure US Government @@ -100,41 +98,6 @@ func (r *TenantDiscoveryResponse) Validate() error { return nil } -// ValidateIssuerMatchesAuthority validates that the issuer in the TenantDiscoveryResponse matches the authority. -// This is used to identity security or configuration issues in authorities and the OIDC endpoint -func (r *TenantDiscoveryResponse) ValidateIssuerMatchesAuthority(authorityURI string, aliases map[string]bool) error { - - if authorityURI == "" { - return errors.New("TenantDiscoveryResponse: empty authorityURI provided for validation") - } - - // Parse the issuer URL - issuerURL, err := url.Parse(r.Issuer) - if err != nil { - return fmt.Errorf("TenantDiscoveryResponse: failed to parse issuer URL: %w", err) - } - - // Even if it doesn't match the authority, issuers from known and trusted hosts are valid - if aliases != nil && aliases[issuerURL.Host] { - return nil - } - - // Parse the authority URL for comparison - authorityURL, err := url.Parse(authorityURI) - if err != nil { - return fmt.Errorf("TenantDiscoveryResponse: failed to parse authority URL: %w", err) - } - - // Check if the scheme and host match (paths can be ignored when validating the issuer) - if issuerURL.Scheme == authorityURL.Scheme && issuerURL.Host == authorityURL.Host { - return nil - } - - // If we get here, validation failed - return fmt.Errorf("TenantDiscoveryResponse: issuer from OIDC discovery '%s' does not match authority '%s' or a known pattern", - r.Issuer, authorityURI) -} - type InstanceDiscoveryMetadata struct { PreferredNetwork string `json:"preferred_network"` PreferredCache string `json:"preferred_cache"` @@ -391,8 +354,6 @@ type Info struct { Tenant string Region string InstanceDiscoveryDisabled bool - // InstanceDiscoveryMetadata stores the metadata from AAD instance discovery - InstanceDiscoveryMetadata []InstanceDiscoveryMetadata } // NewInfoFromAuthorityURI creates an AuthorityInfo instance from the authority URL provided. diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/resolvers.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/resolvers.go index d220a99466..4030ec8d8f 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/resolvers.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/resolvers.go @@ -21,12 +21,10 @@ import ( type cacheEntry struct { Endpoints authority.Endpoints ValidForDomainsInList map[string]bool - // Aliases stores host aliases from instance discovery for quick lookup - Aliases map[string]bool } func createcacheEntry(endpoints authority.Endpoints) cacheEntry { - return cacheEntry{endpoints, map[string]bool{}, map[string]bool{}} + return cacheEntry{endpoints, map[string]bool{}} } // AuthorityEndpoint retrieves endpoints from an authority for auth and token acquisition. @@ -73,15 +71,10 @@ func (m *authorityEndpoint) ResolveEndpoints(ctx context.Context, authorityInfo m.addCachedEndpoints(authorityInfo, userPrincipalName, endpoints) - if err := resp.ValidateIssuerMatchesAuthority(authorityInfo.CanonicalAuthorityURI, - m.cache[authorityInfo.CanonicalAuthorityURI].Aliases); err != nil { - return authority.Endpoints{}, fmt.Errorf("ResolveEndpoints(): %w", err) - } - return endpoints, nil } -// cachedEndpoints returns the cached endpoints if they exist. If not, we return false. +// cachedEndpoints returns a the cached endpoints if they exists. If not, we return false. func (m *authorityEndpoint) cachedEndpoints(authorityInfo authority.Info, userPrincipalName string) (authority.Endpoints, bool) { m.mu.Lock() defer m.mu.Unlock() @@ -120,13 +113,6 @@ func (m *authorityEndpoint) addCachedEndpoints(authorityInfo authority.Info, use } } - // Extract aliases from instance discovery metadata and add to cache - for _, metadata := range authorityInfo.InstanceDiscoveryMetadata { - for _, alias := range metadata.Aliases { - updatedCacheEntry.Aliases[alias] = true - } - } - m.cache[authorityInfo.CanonicalAuthorityURI] = updatedCacheEntry } @@ -141,14 +127,12 @@ func (m *authorityEndpoint) openIDConfigurationEndpoint(ctx context.Context, aut if err != nil { return "", err } - authorityInfo.InstanceDiscoveryMetadata = resp.Metadata return resp.TenantDiscoveryEndpoint, nil } else if authorityInfo.Region != "" { resp, err := m.rest.Authority().AADInstanceDiscovery(ctx, authorityInfo) if err != nil { return "", err } - authorityInfo.InstanceDiscoveryMetadata = resp.Metadata return resp.TenantDiscoveryEndpoint, nil } diff --git a/vendor/modules.txt b/vendor/modules.txt index 4c9a03bedb..e960394362 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -82,7 +82,7 @@ github.com/Azure/go-ansiterm/winterm github.com/Azure/msi-dataplane/pkg/dataplane github.com/Azure/msi-dataplane/pkg/dataplane/internal/challenge github.com/Azure/msi-dataplane/pkg/dataplane/internal/client -# github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 +# github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 ## explicit; go 1.18 github.com/AzureAD/microsoft-authentication-library-for-go/apps/cache github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential