WIP Entra External Auth for ADO

alexwilcox9 · alexwilcox9 · commit 4a74886ecfd1 · 2024-02-18T19:04:59.000Z
diff --git a/coderd/externalauth/externalauth.go b/coderd/externalauth/externalauth.go
@@ -703,7 +703,7 @@ var staticDefaults = map[codersdk.EnhancedExternalAuthProvider]codersdk.External
 		DisplayName: "Azure DevOps",
 		DisplayIcon: "/icon/azure-devops.svg",
 		Regex:       `^(https?://)?dev\.azure\.com(/.*)?$`,
-		Scopes:      []string{"vso.code_write"},
+		Scopes:      []string{"https://app.vssps.visualstudio.com/vso.code_write"},
 	},
 	codersdk.EnhancedExternalAuthProviderBitBucketCloud: {
 		AuthURL:     "https://bitbucket.org/site/oauth2/authorize",
@@ -753,26 +753,31 @@ type jwtConfig struct {
 }
 
 func (c *jwtConfig) AuthCodeURL(state string, opts ...oauth2.AuthCodeOption) string {
-	return c.Config.AuthCodeURL(state, append(opts, oauth2.SetAuthURLParam("response_type", "Assertion"))...)
+	// return c.Config.AuthCodeURL(state, append(opts, oauth2.SetAuthURLParam("response_type", "Assertion"))...)
+	return c.Config.AuthCodeURL(state, opts...)
 }
 
 func (c *jwtConfig) Exchange(ctx context.Context, code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error) {
-	v := url.Values{
-		"client_assertion_type": {},
-		"client_assertion":      {c.ClientSecret},
-		"assertion":             {code},
-		"grant_type":            {},
-	}
-	if c.RedirectURL != "" {
-		v.Set("redirect_uri", c.RedirectURL)
-	}
+	// 	v := url.Values{
+	// 		"client_assertion_type": {},
+	// 		"client_assertion":      {c.ClientSecret},
+	// 		"assertion":             {code},
+	// 		"grant_type":            {},
+	// 	}
+	// 	if c.RedirectURL != "" {
+	// 		v.Set("redirect_uri", c.RedirectURL)
+	// 	}
+
 	return c.Config.Exchange(ctx, code,
 		append(opts,
-			oauth2.SetAuthURLParam("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),
-			oauth2.SetAuthURLParam("client_assertion", c.ClientSecret),
-			oauth2.SetAuthURLParam("assertion", code),
-			oauth2.SetAuthURLParam("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer"),
-			oauth2.SetAuthURLParam("code", ""),
+			// oauth2.SetAuthURLParam("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),
+			// oauth2.SetAuthURLParam("client_assertion", c.ClientSecret),
+			// oauth2.SetAuthURLParam("assertion", code),
+			// oauth2.SetAuthURLParam("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer"),
+			// oauth2.SetAuthURLParam("code", ""),
+			oauth2.SetAuthURLParam("client_id", c.ClientID),
+			oauth2.SetAuthURLParam("scope", "https://app.vssps.visualstudio.com/vso.code_write"),
+			oauth2.SetAuthURLParam("client_secret", c.ClientSecret),
 		)...,
 	)
 }
