Conversation
3805f20 to
a62085f
Compare
a62085f to
0c1c6c4
Compare
|
@pavel-purma Still need this? |
eng/publishing/v3/publish.yml
Outdated
| SYSTEM_ACCESSTOKEN: $(System.AccessToken) | ||
| inputs: | ||
| azureSubscription: maestro-build-promotion | ||
| addSpnToEnvironment: true |
There was a problem hiding this comment.
How does the pipeline credential get access to publish blobs?
There was a problem hiding this comment.
It will use AzurePipelinesCredential when SYSTEM_ACCESSTOKEN environment variable provided. If not, ManagedIdentity/AzureCliCredential would be configured to ChainedTokenCredential
75530cf to
5078af8
Compare
|
@mmitche, this PR switches from DefaultAzureCredential to AzurePipelineCredential (DefaultIdentityTokenCredential standard pipeline authentication) which can issue tokens even after 10 minutes expiration issue of federated token. Authentication mechanism is also faster than in cases when DefaultAzureCredential falls to AzureCliCredential. In blob publishing this is already in use. Here, this code enables it also for symbols publishing. |
| var ret = new ChainedTokenCredential(tokenCredentials.ToArray()); | ||
| return ret; |
There was a problem hiding this comment.
| var ret = new ChainedTokenCredential(tokenCredentials.ToArray()); | |
| return ret; | |
| return new ChainedTokenCredential(tokenCredentials.ToArray()); |
src/Microsoft.DotNet.ArcadeAzureIntegration/DefaultIdentityTokenCredentialOptions.cs
Show resolved
Hide resolved
src/Microsoft.DotNet.ArcadeAzureIntegration/DefaultIdentityTokenCredential.cs
Show resolved
Hide resolved
Co-authored-by: Pavel Purma <pavelpurma@microsoft.com> # Conflicts: # src/Microsoft.DotNet.Build.Tasks.Feed/src/PublishArtifactsInManifestBase.cs
Update Azure Identity Credentials