Use MSGraph SDK and deprecate Autorest for rotate root operations

azure.go

@@ -21,15 +21,13 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v4"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources"
-	"github.com/Azure/go-autorest/autorest"
-	"github.com/Azure/go-autorest/autorest/azure"
-	"github.com/Azure/go-autorest/autorest/azure/auth"
 	"github.com/coreos/go-oidc"
 	"github.com/hashicorp/go-cleanhttp"
-	"github.com/hashicorp/vault-plugin-auth-azure/client"
 	"github.com/hashicorp/vault/sdk/helper/useragent"
 	"github.com/hashicorp/vault/sdk/logical"
 	"golang.org/x/oauth2"
+
+	"github.com/hashicorp/vault-plugin-auth-azure/client"
 )
 
 type computeClient interface {
@@ -246,40 +244,18 @@ func (p *azureProvider) getClientOptions() *arm.ClientOptions {
 	}
 }
 
-// getAuthorizer attempts to create an authorizer, preferring ClientID/Secret if present,
-// and falling back to MSI if not.
-func getAuthorizer(settings *azureSettings, resource string) (autorest.Authorizer, error) {
-	if settings.ClientID != "" && settings.ClientSecret != "" && settings.TenantID != "" {
-		config := auth.NewClientCredentialsConfig(settings.ClientID, settings.ClientSecret, settings.TenantID)
-		config.AADEndpoint = settings.Environment.ActiveDirectoryEndpoint
-		config.Resource = resource
-		return config.Authorizer()
-	}
-
-	config := auth.NewMSIConfig()
-	config.Resource = resource
-	return config.Authorizer()
-}
-
 func (p *azureProvider) MSGraphClient() (client.MSGraphClient, error) {
-	userAgent := useragent.PluginString(p.settings.PluginEnv, userAgentPluginName)
-
-	graphURI, err := client.GetGraphURI(p.settings.Environment.Name)
-	if err != nil {
-		return nil, err
-	}
-
-	graphApiAuthorizer, err := getAuthorizer(p.settings, graphURI)
-	if err != nil {
-		return nil, err
+	clientSettings := client.ClientSettings{
+		ClientID:     p.settings.ClientID,
+		ClientSecret: p.settings.ClientSecret,
+		TenantID:     p.settings.TenantID,
 	}
 
-	msGraphAppClient, err := client.NewMSGraphApplicationClient(userAgent, graphURI, graphApiAuthorizer)
+	msGraphClient, err := client.NewMSGraphApplicationClient(clientSettings)
 	if err != nil {
 		return nil, err
 	}
-
-	return msGraphAppClient, nil
+	return msGraphClient, nil
 }
 
 func (p *azureProvider) getTokenCredential() (azcore.TokenCredential, error) {
@@ -306,7 +282,6 @@ type azureSettings struct {
 	ClientSecret string
 	CloudConfig  cloud.Configuration
 	Resource     string
-	Environment  azure.Environment
 	PluginEnv    *logical.PluginEnvironment
 }
 
@@ -353,17 +328,12 @@ func (b *azureAuthBackend) getAzureSettings(ctx context.Context, config *azureCo
 	if environment == "" {
 		// use default values if no environment is provided
 		settings.CloudConfig = cloud.AzurePublic
-		settings.Environment = azure.PublicCloud
 	} else {
 		var err error
 		settings.CloudConfig, err = ConfigurationFromName(environment)
 		if err != nil {
 			return nil, err
 		}
-		settings.Environment, err = azure.EnvironmentFromName(environment)
-		if err != nil {
-			return nil, err
-		}
 	}
 
 	pluginEnv, err := b.System().PluginEnv(ctx)

azure_test.go

@@ -14,6 +14,7 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources"
 	"github.com/coreos/go-oidc"
+
 	"github.com/hashicorp/vault-plugin-auth-azure/client"
 )
 

backend.go

@@ -9,6 +9,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -135,16 +136,16 @@ func (b *azureAuthBackend) periodicFunc(ctx context.Context, sys *logical.Reques
 
 	app := apps[0]
 
-	credsToDelete := []string{}
-	for _, cred := range app.PasswordCredentials {
-		if *cred.KeyID != config.NewClientSecretKeyID {
-			credsToDelete = append(credsToDelete, *cred.KeyID)
+	credsToDelete := []*uuid.UUID{}
+	for _, cred := range app.GetPasswordCredentials() {
+		if cred.GetKeyId().String() != config.NewClientSecretKeyID {
+			credsToDelete = append(credsToDelete, cred.GetKeyId())
 		}
 	}
 
 	if len(credsToDelete) != 0 {
 		b.Logger().Debug("periodic func", "rotate-root", "removing old passwords from Azure")
-		err = removeApplicationPasswords(ctx, client, *app.ID, credsToDelete...)
+		err = removeApplicationPasswords(ctx, client, *app.GetId(), credsToDelete...)
 		if err != nil {
 			return err
 		}