Skip to content

Add file based Azure Arc detection #955

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: dev
Choose a base branch
from
Open

Add file based Azure Arc detection #955

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
54e1800
Add file based Azure Arc detection
Avery-Dunn May 14, 2025
1a12e5b
Merge branch 'dev' into avdunn/arc-fix
Avery-Dunn May 20, 2025
8e66e62
Address PR feedback
Avery-Dunn May 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/AzureArcManagedIdentitySource.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,13 +26,20 @@ class AzureArcManagedIdentitySource extends AbstractManagedIdentitySource{
private static final String FILE_EXTENSION = ".key";
private static final int MAX_FILE_SIZE_BYTES = 4096;
private static final String WWW_AUTHENTICATE_HEADER = "WWW-Authenticate";
private static final String FALLBACK_IDENTITY_ENDPOINT = "http://127.0.0.1:40342/metadata/identity/oauth2/token";
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
private static final String FALLBACK_IDENTITY_ENDPOINT = "http://127.0.0.1:40342/metadata/identity/oauth2/token";
private static final String FALLBACK_AZURE_ARC_IDENTITY_ENDPOINT = "http://127.0.0.1:40342/metadata/identity/oauth2/token";

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it's a nit, you can choose to ignore


private final URI MSI_ENDPOINT;

static AbstractManagedIdentitySource create(MsalRequest msalRequest, ServiceBundle serviceBundle)
{
IEnvironmentVariables environmentVariables = getEnvironmentVariables();
String identityEndpoint = environmentVariables.getEnvironmentVariable(Constants.IDENTITY_ENDPOINT);

if (StringHelper.isNullOrBlank(identityEndpoint)) {
LOG.info("[Managed Identity] Azure Arc was detected through file based detection but the environment variables were not found. Defaulting to known azure arc endpoint.");
identityEndpoint = FALLBACK_IDENTITY_ENDPOINT;
}

String imdsEndpoint = environmentVariables.getEnvironmentVariable(Constants.IMDS_ENDPOINT);
Comment on lines +37 to 43
Copy link

@Robbie-Microsoft Robbie-Microsoft May 28, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't you also need to check that imdsEndpoint doesn't exist before using FALLBACK_IDENTITY_ENDPOINT?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

and if neither exists, also set imdsEndpoint = "N/A: himds executable exists";


URI validatedUri = validateAndGetUri(identityEndpoint, imdsEndpoint);
Expand Down
36 changes: 34 additions & 2 deletions msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/ManagedIdentityClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,15 @@
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import java.io.File;

/**
* Class to initialize a managed identity and identify the service.
*/
class ManagedIdentityClient {
private static final Logger LOG = LoggerFactory.getLogger(ManagedIdentityClient.class);
private static final String WINDOWS_HIMDS_FILEPATH = "%Programfiles%\\AzureConnectedMachineAgent\\himds.exe";
private static final String LINUX_HIMDS_FILEPATH = "/opt/azcmagent/bin/himds";

static ManagedIdentitySourceType getManagedIdentitySource() {
IEnvironmentVariables environmentVariables = AbstractManagedIdentitySource.getEnvironmentVariables();
Expand All @@ -24,8 +28,7 @@ static ManagedIdentitySourceType getManagedIdentitySource() {
}
} else if (!StringHelper.isNullOrBlank(environmentVariables.getEnvironmentVariable(Constants.MSI_ENDPOINT))) {
return ManagedIdentitySourceType.CLOUD_SHELL;
} else if (!StringHelper.isNullOrBlank(environmentVariables.getEnvironmentVariable(Constants.IDENTITY_ENDPOINT)) &&
!StringHelper.isNullOrBlank(environmentVariables.getEnvironmentVariable(Constants.IMDS_ENDPOINT))) {
} else if (validateAzureArcEnvironment(environmentVariables)) {
return ManagedIdentitySourceType.AZURE_ARC;
} else {
return ManagedIdentitySourceType.DEFAULT_TO_IMDS;
Expand Down Expand Up @@ -65,4 +68,33 @@ private static AbstractManagedIdentitySource createManagedIdentitySource(MsalReq
return new IMDSManagedIdentitySource(msalRequest, serviceBundle);
}
}

static boolean validateAzureArcEnvironment(IEnvironmentVariables environmentVariables) {
if (!StringHelper.isNullOrBlank(environmentVariables.getEnvironmentVariable(Constants.IDENTITY_ENDPOINT)) &&
!StringHelper.isNullOrBlank(environmentVariables.getEnvironmentVariable(Constants.IMDS_ENDPOINT))) {
LOG.debug("[Managed Identity] Azure Arc managed identity is available through environment variables.");
return true;
}

String osName = System.getProperty("os.name").toLowerCase();

if (osName.contains("windows")) {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can "windows" and "linux" be saved as constants in a constants file? Surely they are used elsewhere, or will be? Otherwise, if you implement my suggestion above, you could get the file path via:

// get the expected Windows or Linux file path of the himds executable
const fileDetectionPath: string =
    AZURE_ARC_FILE_DETECTION[process.platform as keyof FilePathMap];

File windowsFile = new File(WINDOWS_HIMDS_FILEPATH);
if (windowsFile.exists()) {
LOG.debug("[Managed Identity] Azure Arc managed identity is available through file detection.");
return true;
}
} else if (osName.contains("linux")) {
File linuxFile = new File(LINUX_HIMDS_FILEPATH);
if (linuxFile.exists()) {
LOG.debug("[Managed Identity] Azure Arc managed identity is available through file detection.");
return true;
}
} else {
LOG.warn("[Managed Identity] Azure Arc managed identity cannot be configured on a platform other than Windows and Linux.");
}

LOG.debug("[Managed Identity] Azure Arc managed identity is not available.");
return false;
}
}
Loading