没有客户端ID和客户端机密的Azure应用资源管理授权

Question

I'm trying to create an application where the user can manage their Azure resources (sql databases, storage). How can I authorize the user without needing their client ID and client secret.

I've looked at their documentation: https://godoc.org/github.com/Azure/go-autorest/autorest/azure/auth, however all of them requires environment variables and/or clientID/clientSecret. Is there a way where a user can provide username/password and I can get back an authorizer

type Client struct {
    ServersClient postgresql.ServersClient
}

func NewCloudClient() *Client {
    return &Client{}
}

func (c *Client) Init(config map[string]string) error {
    var (
        subscriptionID = config["subscriptionID"]
        // tenantID       = config["tenantID"]
        // clientID       = config["clientID"]
        // clientSecret   = config["clientSecret"]
        // resourceGroup  = config["resourceGroup"]
    )
    // oauthConfig, err := adal.NewOAuthConfig(azure.PublicCloud.ActiveDirectoryEndpoint, tenantID)
    // if err != nil {
    //  return errors.Wrap(err, "error getting OAuthConfig")
    // }
    // spt, err := adal.NewServicePrincipalToken(*oauthConfig, clientID, clientSecret, resourceGroup)
    serversClient := postgresql.NewServersClient(subscriptionID)

    //serversClient.BaseClient.Authorizer = autorest.NewBearerAuthorizer(spt)
    c.ServersClient = serversClient
    return nil
}

Answer 1

In all cases of authorization flow you will need at least client id. In some you will need more like client secret.

You can read about OAuth authorization here https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-app-types

but in general what you are aiming for is either of two cases

1. Authorize as user without internaction using username and password (this would be client resource owner flow
   • https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth-ropc
2. Authorize as user with his interaction
   • if this is code that can't get postback URL then use device code flow https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code
   • or for anything in the browser use standard implicit grant flow https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-implicit-grant-flow

You will quickly notice that in all cases you NEED to have client ID. This is because how Azure Authentication works.