Azure / Azure/azure-powershell
Support Windows Integrated Auth in Login-AzureRMAccount
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
## Description
The issue is against azure stack environment configured with ADFS. In this environment, the users do not have usernames or passwords; they have a secure workstation to which they authenticate with a pin and smart card, and when they navigate to the portal, it redirects to ADFS and there is some implicit auth exchange that occurs, signing them into the portal. When run in an incognito browser, or using the interactive prompts produced from AzurePowerShell cmdlet Login-AzureRmAccount, the redirection prompts them for a username and password, which the users does not have.
While using powershell, it prompts for the username and password and the users do not have one.
## Workaround
We worked around the issue by creating a token explicitly with ADAL call with PromptBehaviour as Never.
```powershell
function Initialize-AzureRmAccount
{
[CmdletBinding()]
param
(
[Parameter(ValueFromPipeline=$true)]
[ValidateNotNull()]
[Microsoft.Azure.Commands.Profile.Models.PSAzureEnvironment] $AzureEnvironment = (Get-AzureRmEnvironment -Name 'AzureStackAdmin' -ErrorAction Stop),
[Parameter()]
[Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior] $Prompt = [Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Never
)
$ErrorActionPreference='Stop'
$ctx = [Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext]::new(
$AzureEnvironment.ActiveDirectoryAuthority,
$false,
[Microsoft.IdentityModel.Clients.ActiveDirectory.TokenCache]::new())
function GetToken($resource)
{
$ErrorActionPreference='Stop'
$cred = [Microsoft.IdentityModel.Clients.ActiveDirectory.UserCredential]::new()
#return $ctx.AcquireToken($resource, '1950a258-227b-4e31-a9cf-717495945fc2', [Microsoft.IdentityModel.Clients.ActiveDirectory.UserCredential]::new())
return $ctx.AcquireToken($resource, '1950a258-227b-4e31-a9cf-717495945fc2', 'urn:ietf:wg:oauth:2.0:oob', $Prompt)
}
$params = @{
AccessToken = (GetToken $AzureEnvironment.ActiveDirectoryServiceEndpointResourceId).AccessToken
GraphAccessToken = (GetToken $AzureEnvironment.GraphEndpointResourceId).AccessToken
EnvironmentName = $AzureEnvironment.Name
AccountId = $env:USERNAME
}
Add-AzureRmAccount @params -Force -Verbose
}
Initialize-AzureRmAccount
```
## Module versions
AzureRM.Profile 5.8.3
Contributor guide
Assessment
This issue has not been assessed yet.