Comments (5)
Hello, at the moment this authentication method is not embedded in the DefaultAzureCredential
which is the function used inside azuredns
provider.
For that we need to implement the logic to retrieve OIDC token like the one used inside azrerm
terraform provider.
@ldez I can add it in a new PR
from lego.
Hello,
I think it's better to open an issue inside the repo https://github.com/vancluever/terraform-provider-acme
from lego.
@pchanvallon do you have an idea?
from lego.
Testing on local machine bypassing Terraform ACME provider
Ensure cli is logged out
az logout
Export environment variables (Values taken from Terraform Cloud agent runner)
export AZURE_SUBSCRIPTION_ID=******-****-****-****-********
export AZURE_RESOURCE_GROUP=*********
export AZURE_TENANT_ID=******-****-****-****-********
export AZURE_CLIENT_ID=******-****-****-****-********
export AZURE_USE_OIDC=true
export AZURE_OIDC_TOKEN="**************************"
Also exported last two envs as ARM_OIDC_TOKEN
& ARM_USE_OIDC
since this is the syntax they are actually exported by Terraform Cloud.
lego --domains example.****.com --email [email protected] --dns azuredns run
2023/10/05 13:18:38 [INFO] [example.****.com] acme: Obtaining bundled SAN certificate
2023/10/05 13:18:39 [INFO] [example.****.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/*******
2023/10/05 13:18:39 [INFO] [example.****.com] acme: Could not find solver for: tls-alpn-01
2023/10/05 13:18:39 [INFO] [example.****.com] acme: Could not find solver for: http-01
2023/10/05 13:18:39 [INFO] [example.****.com] acme: use dns-01 solver
2023/10/05 13:18:39 [INFO] [example.****.com] acme: Preparing to solve DNS-01
2023/10/05 13:18:44 [INFO] [example.****.com] acme: Cleaning DNS-01 challenge
2023/10/05 13:18:47 [WARN] [example.****.com] acme: cleaning up failed: azuredns: DefaultAzureCredential: failed to acquire a token.
Attempted credentials:
EnvironmentCredential: incomplete environment variable configuration. Only AZURE_TENANT_ID and AZURE_CLIENT_ID are set
WorkloadIdentityCredential: no token file specified. Check pod configuration or set TokenFilePath in the options
ManagedIdentityCredential: managed identity timed out
AzureCLICredential: ERROR: Please run 'az login' to setup account.
What seems to work is putting the AZURE_OIDC_TOKEN
value in a file and then exporting AZURE_FEDERATED_TOKEN_FILE=token.txt
.
I will see if I can do this in Terraform but would prefer if it works out of the box.
2023/10/05 13:41:10 [INFO] [example.****.com] acme: Obtaining bundled SAN certificate
2023/10/05 13:41:11 [INFO] [example.****.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/********
2023/10/05 13:41:11 [INFO] [example.****.com] acme: Could not find solver for: tls-alpn-01
2023/10/05 13:41:11 [INFO] [example.****.com] acme: Could not find solver for: http-01
2023/10/05 13:41:11 [INFO] [example.****.com] acme: use dns-01 solver
2023/10/05 13:41:11 [INFO] [example.****.com] acme: Preparing to solve DNS-01
2023/10/05 13:41:15 [INFO] [example.****.com] acme: Trying to solve DNS-01
2023/10/05 13:41:15 [INFO] [example.****.com] acme: Checking DNS record propagation using [*****]
2023/10/05 13:41:17 [INFO] Wait for propagation [timeout: 2m0s, interval: 2s]
2023/10/05 13:41:24 [INFO] [example.****.com] The server validated our request
2023/10/05 13:41:24 [INFO] [example.****.com] acme: Cleaning DNS-01 challenge
2023/10/05 13:41:26 [INFO] [example.****.com] acme: Validations succeeded; requesting certificates
2023/10/05 13:41:27 [INFO] [example.****.com] Server responded with a certificate.
Thanks!
from lego.
Yes this case is working because it is the mechanism used by Workload Identity Authentication as described in this doc.
But we still need to handle the other cases.
from lego.
Related Issues (20)
- cloudflare: can't obtain certificates from LE with dns challenge HOT 4
- inwx: local DNS doesn't answer to SOA calls HOT 4
- BlueCat cleanup fails so no cert created HOT 11
- Support for provider: nsd HOT 4
- Helmchart for lego HOT 1
- On success, print a message that contains the absolute path of the .lego directory.
- Tencent cloud cannot be successfully generated through DNS HOT 5
- Fails to obtain/renew certificate using godaddy HOT 2
- Liquidweb documentation is wrong HOT 1
- Propagation Time Limit exceeded HOT 1
- nifcloud: bug between v4.16.1 and v4.17.3 HOT 3
- Support for provider: lima-city HOT 4
- Support for provider: mijn.host HOT 3
- Allow setting wait time manually before DNS propagation is assumed complete HOT 1
- Support ACME device attestation
- Also need to provide an email when using EAB HOT 2
- epik: returns 404 HOT 1
- GoDaddy API Limitations HOT 18
- lego allows you to rename the requested certificate HOT 1
- websupport: fails on windows HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from lego.