Fix for managed tokens (#93)

* handle managed token url containing '/token'

* update news

* update ver no

* fixup documentation

Author: hongooi73

DESCRIPTION

@@ -1,6 +1,6 @@
 Package: AzureAuth
 Title: Authentication Services for Azure Active Directory
-Version: 1.3.4
+Version: 1.3.5
 Authors@R: c(
     person("Hong", "Ooi", , "hongooi73@gmail.com", role = c("aut", "cre")),
     person("Tyler", "Littlefield", role="ctb"),
@@ -33,5 +33,6 @@ Suggests:
     shinyjs,
     AzureRMR,
     AzureGraph
+Encoding: UTF-8
 Roxygen: list(markdown=TRUE, r6=FALSE)
-RoxygenNote: 7.3.2
+Config/roxygen2/version: 8.1.0

NAMESPACE

@@ -1,11 +1,18 @@
 # Generated by roxygen2: do not edit by hand
 
+S3method(build_assertion,cert_assertion)
+S3method(build_assertion,character)
+S3method(build_assertion,default)
+S3method(build_assertion,stored_cert)
 S3method(decode_jwt,AzureToken)
 S3method(decode_jwt,Token)
 S3method(decode_jwt,character)
 S3method(extract_jwt,AzureToken)
 S3method(extract_jwt,Token)
 S3method(extract_jwt,character)
+S3method(sign_assertion,character)
+S3method(sign_assertion,openssl_cert_pair)
+S3method(sign_assertion,stored_cert)
 export(AzureManualToken)
 export(AzureR_dir)
 export(AzureToken)

NEWS.md

@@ -1,3 +1,7 @@
+# AzureAuth 1.3.5
+
+- Fix to `get_managed_token` to handle host URLs that already have the `/token` endpoint included.
+
 # AzureAuth 1.3.4
 
 - New `get_manual_token` function to create a token object from an external token string. Thanks to @falbukrek.

R/cert_creds.R

@@ -39,19 +39,22 @@ build_assertion <- function(assertion, ...)
 }
 
 
+#' @export
 build_assertion.stored_cert <- function(assertion, ...)
 {
     build_assertion(cert_assertion(assertion), ...)
 }
 
 
+#' @export
 build_assertion.character <- function(assertion, ...)
 {
     pair <- read_cert_pair(assertion)
     build_assertion(cert_assertion(pair), ...)
 }
 
 
+#' @export
 build_assertion.cert_assertion <- function(assertion, tenant, app, aad_host, version, ...)
 {
     url <- httr::parse_url(aad_host)
@@ -72,6 +75,7 @@ build_assertion.cert_assertion <- function(assertion, tenant, app, aad_host, ver
 }
 
 
+#' @export
 build_assertion.default <- function(assertion, ...)
 {
     if(is.null(assertion))
@@ -86,6 +90,7 @@ sign_assertion <- function(certificate, claim, size)
 }
 
 
+#' @export
 sign_assertion.stored_cert <- function(certificate, claim, size)
 {
     kty <- certificate$policy$key_props$kty  # key type determines signing alg
@@ -100,6 +105,7 @@ sign_assertion.stored_cert <- function(certificate, claim, size)
 }
 
 
+#' @export
 sign_assertion.openssl_cert_pair <- function(certificate, claim, size)
 {
     alg <- if(inherits(certificate$key, "rsa"))
@@ -115,6 +121,7 @@ sign_assertion.openssl_cert_pair <- function(certificate, claim, size)
 }
 
 
+#' @export
 sign_assertion.character <- function(certificate, claim, size)
 {
     pair <- read_cert_pair(certificate)

R/managed_token.R

@@ -3,5 +3,9 @@
 get_managed_token <- function(resource, token_args=list(), use_cache=NULL)
 {
     aad_host <- Sys.getenv("MSI_ENDPOINT", "http://169.254.169.254/metadata/identity/oauth2")
+
+    # deal with situation where host url string already contains '/token'
+    aad_host <- sub("/token$", "", aad_host)
+
     AzureTokenManaged$new(resource, aad_host, token_args=token_args, use_cache=use_cache)
 }

R/token_manual.R

@@ -2,17 +2,18 @@
 #'
 #' Create an Azure token object from a pre-existing access token string. This is useful
 #' when you have obtained a token externally (e.g., via Azure CLI, Python, or another
-#' authentication mechanism) and want to use it with the AzureR ecosystem.
+#' authentication mechanism) and want to use it with the AzureR ecosystem. Rather than
+#' calling the new() method directly, tokens should be created via [get_manual_token()].
 #'
 #' @docType class
 #' @section Methods:
-#' \itemize{
-#'   \item \code{new(token, type, tenant, resource)}: Initialize a new manual token object.
-#'   \item \code{refresh()}: Cannot refresh a manual token; issues a warning and returns self.
-#'   \item \code{validate()}: Checks if the token has expired based on JWT claims.
-#'   \item \code{can_refresh()}: Returns FALSE since manual tokens cannot be refreshed.
-#'   \item \code{cache()}: No-op; manual tokens are not cached.
-#' }
+#'
+#' This section documents how the methods for manual tokens differ from other token objects.
+#'
+#' - `refresh`: Manual tokens cannot be refreshed; you must create a new token object.
+#' - `can_refresh`: Always returns FALSE for manual tokens.
+#' - `cache`: Manual tokens are not cached; this method does nothing.
+#' - `hash`: The hash is based on the token string itself, rather than the R-level metadata.
 #'
 #' @details
 #' The \code{AzureManualToken} class provides a way to wrap an externally-obtained access
@@ -58,11 +59,6 @@ AzureManualToken <- R6::R6Class("AzureManualToken", inherit = AzureToken,
 
 public = list(
 
-    #' @description Initialize a manual token from a raw access token string.
-    #' @param token A character string containing the access token.
-    #' @param type The token type, usually "Bearer".
-    #' @param tenant Optional tenant ID. If NULL, extracted from JWT claims.
-    #' @param resource Optional resource/audience. If NULL, extracted from JWT claims.
     initialize = function(token, type = "Bearer", tenant = NULL, resource = NULL)
     {
         if(missing(token) || is.null(token) || !is.character(token) || nchar(token) == 0)
@@ -173,30 +169,22 @@ public = list(
         invisible(self)
     },
 
-    #' @description Refresh the token. Manual tokens cannot be refreshed.
-    #' @return Returns self invisibly.
     refresh = function()
     {
         invisible(self)
     },
 
-    #' @description Check if this token can be refreshed.
-    #' @return Always returns FALSE for manual tokens.
     can_refresh = function()
     {
         FALSE
     },
 
-    #' @description Cache the token. Manual tokens are not cached.
-    #' @return Returns NULL invisibly.
     cache = function()
     {
         # Do not cache manual tokens - they are managed externally
         invisible(NULL)
     },
 
-    #' @description Compute a hash for this token.
-    #' @return An MD5 hash string based on the token content.
     hash = function()
     {
         # Hash based on the token string itself
@@ -209,7 +197,6 @@ public = list(
         paste(openssl::md5(msg[-(1:14)]), collapse = "")
     },
 
-    #' @description Print the token object.
     print = function()
     {
         cat(format_auth_header(self))