Require ARM endpoint for Azure Stack login validation

README.md

@@ -58,6 +58,7 @@ Azure Login Action supports different ways of authentication with Azure.
 |creds|false|string||a json string for login with an Azure service principal|
 |enable-AzPSSession|false|boolean|false|if Azure PowerShell login is enabled|
 |environment|false|string|azurecloud|the Azure Cloud environment. For cloud environments other than the public cloud, the `audience` will also need to be updated.|
+|resource-manager-endpoint|false|string||required when `environment` is `azurestack`; ARM endpoint of the Azure Stack instance|
 |allow-no-subscriptions|false|boolean|false|if login without subscription is allowed|
 |audience|false|string|api://AzureADTokenExchange|the audience to get the JWT ID token from GitHub OIDC provider|
 |auth-type|false|string|SERVICE_PRINCIPAL|the auth type|

__tests__/LoginConfig.test.ts

@@ -245,21 +245,37 @@ describe("LoginConfig Test", () => {
 
         let loginConfig = new LoginConfig();
         await loginConfig.initialize();
-        testValidateWithErrorMessage(loginConfig, "Ensure 'subscription-id' is supplied or 'allow-no-subscriptions' is 'true'.");
-    });
-
+        testValidateWithErrorMessage(loginConfig, "Ensure 'subscription-id' is supplied or 'allow-no-subscriptions' is 'true'.");
+    });
+
+    test('validate with azurestack without resourceManagerEndpointUrl', async () => {
+        setEnv('environment', 'azurestack');
+        setEnv('enable-AzPSSession', 'false');
+        setEnv('allow-no-subscriptions', 'true');
+        setEnv('auth-type', 'SERVICE_PRINCIPAL');
+
+        setEnv('tenant-id', 'tenant-id');
+        setEnv('subscription-id', 'subscription-id');
+        setEnv('client-id', 'client-id');
+
+        let loginConfig = new LoginConfig();
+        await loginConfig.initialize();
+        testValidateWithErrorMessage(loginConfig, "Using environment: azurestack. Ensure 'resourceManagerEndpointUrl' is supplied.");
+    });
+
     test('validate without subscriptionId and allowNoSubscriptionsLogin=true', async () => {
-        setEnv('environment', 'azurestack');
-        setEnv('enable-AzPSSession', 'true');
-        setEnv('allow-no-subscriptions', 'true');
-        setEnv('auth-type', 'IDENTITY');
-
-        // setEnv('subscription-id', 'subscription-id');
-
-        let loginConfig = new LoginConfig();
-        await loginConfig.initialize();
-        loginConfig.validate();
-        expect(loginConfig.environment).toBe("azurestack");
+        setEnv('environment', 'azurestack');
+        setEnv('enable-AzPSSession', 'true');
+        setEnv('allow-no-subscriptions', 'true');
+        setEnv('auth-type', 'IDENTITY');
+
+        // setEnv('subscription-id', 'subscription-id');
+        setEnv('resource-manager-endpoint', 'https://management.azurestack.example.com');
+
+        let loginConfig = new LoginConfig();
+        await loginConfig.initialize();
+        loginConfig.validate();
+        expect(loginConfig.environment).toBe("azurestack");
         expect(loginConfig.enableAzPSSession).toBeTruthy();
         expect(loginConfig.allowNoSubscriptionsLogin).toBeTruthy();
         expect(loginConfig.authType).toBe("IDENTITY");
@@ -269,4 +285,4 @@ describe("LoginConfig Test", () => {
         expect(loginConfig.subscriptionId).toBe("");
     });
 
-});
+});

action.yml

@@ -18,14 +18,17 @@ inputs:
     description: 'Set this value to true to enable Azure PowerShell Login in addition to Azure CLI login'
     required: false
     default: false
-  environment:
-    description: 'Name of the environment. Supported values are azurecloud, azurestack, azureusgovernment, azurechinacloud, azuregermancloud. Default being azurecloud'
-    required: false
-    default: azurecloud
-  allow-no-subscriptions:
-    description: 'Set this value to true to enable support for accessing tenants without subscriptions'
-    required: false
-    default: false
+  environment:
+    description: 'Name of the environment. Supported values are azurecloud, azurestack, azureusgovernment, azurechinacloud, azuregermancloud. Default being azurecloud'
+    required: false
+    default: azurecloud
+  resource-manager-endpoint:
+    description: 'Required when using environment=azurestack. ARM resource manager endpoint for the Azure Stack instance.'
+    required: false
+  allow-no-subscriptions:
+    description: 'Set this value to true to enable support for accessing tenants without subscriptions'
+    required: false
+    default: false
   audience:
     description: 'Provide audience field for access-token. Default value is api://AzureADTokenExchange'
     required: false

src/common/LoginConfig.ts

@@ -30,14 +30,15 @@ export class LoginConfig {
         this.environment = core.getInput("environment").toLowerCase();
         this.enableAzPSSession = core.getInput('enable-AzPSSession').toLowerCase() === "true";
         this.allowNoSubscriptionsLogin = core.getInput('allow-no-subscriptions').toLowerCase() === "true";
-        this.authType = core.getInput('auth-type').toUpperCase();
+        this.authType = core.getInput('auth-type').toUpperCase();
+        this.resourceManagerEndpointUrl = core.getInput('resource-manager-endpoint', { required: false });
 
         this.servicePrincipalId = core.getInput('client-id', { required: false });
         this.servicePrincipalSecret = null;
         this.tenantId = core.getInput('tenant-id', { required: false });
         this.subscriptionId = core.getInput('subscription-id', { required: false });
 
-        this.readParametersFromCreds();
+        this.readParametersFromCreds();
 
         this.audience = core.getInput('audience', { required: false });
         this.federatedToken = null;
@@ -102,11 +103,14 @@ export class LoginConfig {
             if (!this.servicePrincipalId || !this.tenantId) {
                 throw new Error(`Using auth-type: ${LoginConfig.AUTH_TYPE_SERVICE_PRINCIPAL}. Not all values are present. Ensure 'client-id' and 'tenant-id' are supplied.`);
             }
-        }
-        if (!this.subscriptionId && !this.allowNoSubscriptionsLogin) {
-            throw new Error("Ensure 'subscription-id' is supplied or 'allow-no-subscriptions' is 'true'.");
-        }
-    }
+        }
+        if (!this.subscriptionId && !this.allowNoSubscriptionsLogin) {
+            throw new Error("Ensure 'subscription-id' is supplied or 'allow-no-subscriptions' is 'true'.");
+        }
+        if (this.environment === "azurestack" && !this.resourceManagerEndpointUrl) {
+            throw new Error("Using environment: azurestack. Ensure 'resourceManagerEndpointUrl' is supplied.");
+        }
+    }
 
     mask(parameterValue: string) {
         if (parameterValue) {