Merge pull request #4585 from Hazhzeng/hazeng-pr1-gettoken

Add admin/host/token endpoint

Author: Hanzhang Zeng (Roger)

src/WebJobs.Script.WebHost/Controllers/HostController.cs

@@ -19,6 +19,7 @@
 using Microsoft.Azure.WebJobs.Script.WebHost.Filters;
 using Microsoft.Azure.WebJobs.Script.WebHost.Management;
 using Microsoft.Azure.WebJobs.Script.WebHost.Models;
+using Microsoft.Azure.WebJobs.Script.WebHost.Security;
 using Microsoft.Azure.WebJobs.Script.WebHost.Security.Authorization;
 using Microsoft.Azure.WebJobs.Script.WebHost.Security.Authorization.Policies;
 using Microsoft.Extensions.Logging;
@@ -229,6 +230,28 @@ public async Task<IActionResult> SetState([FromBody] string state)
             return Accepted();
         }
 
+        /// <summary>
+        /// This endpoint generates a temporary x-ms-site-restricted-token for core tool
+        /// to access KuduLite zipdeploy endpoint in Linux Consumption
+        /// </summary>
+        /// <returns>
+        /// 200 on token generated
+        /// 400 on non-Linux container environment
+        /// </returns>
+        [HttpGet]
+        [Route("admin/host/token")]
+        [Authorize(Policy = PolicyNames.AdminAuthLevel)]
+        public IActionResult GetAdminToken()
+        {
+            if (!_environment.IsLinuxContainerEnvironment())
+            {
+                return BadRequest("Endpoint is only available when running in Linux Container");
+            }
+
+            string requestHeaderToken = SimpleWebTokenHelper.CreateToken(DateTime.UtcNow.AddMinutes(5));
+            return Ok(requestHeaderToken);
+        }
+
         [AcceptVerbs("GET", "POST", "DELETE")]
         [Authorize(AuthenticationSchemes = AuthLevelAuthenticationDefaults.AuthenticationScheme)]
         [Route("runtime/webhooks/{name}/{*extra}")]

test/WebJobs.Script.Tests/Controllers/Admin/HostControllerTests.cs

@@ -4,10 +4,12 @@
 using System.IO;
 using System.Net;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Azure.WebJobs.Script.WebHost.Controllers;
 using Microsoft.Azure.WebJobs.Script.WebHost.Management;
+using Microsoft.Azure.WebJobs.Script.WebHost.Security;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using Microsoft.WebJobs.Script.Tests;
@@ -90,5 +92,45 @@ public async Task SetState_Succeeds(string desiredState, ScriptHostState current
                 Assert.False(fileExists);
             }
         }
+
+        [Fact]
+        public void GetAdminToken_Succeeds()
+        {
+            // Arrange
+            _mockEnvironment.Setup(p => p.GetEnvironmentVariable(It.Is<string>(k => k == EnvironmentSettingNames.ContainerName))).Returns<string>(v => v = "ContainerName");
+
+            var key = TestHelpers.GenerateKeyBytes();
+            var stringKey = TestHelpers.GenerateKeyHexString(key);
+            using (new TestScopedEnvironmentVariable(EnvironmentSettingNames.WebSiteAuthEncryptionKey, stringKey))
+            {
+                // Act
+                ObjectResult result = (ObjectResult)_hostController.GetAdminToken();
+                HttpStatusCode resultStatus = (HttpStatusCode)result.StatusCode;
+                string token = (string)result.Value;
+
+                // Assert
+                Assert.Equal(HttpStatusCode.OK, resultStatus);
+                Assert.True(SimpleWebTokenHelper.ValidateToken(token, new SystemClock()));
+            }
+        }
+
+        [Fact]
+        public void GetAdminToken_Fails_NotLinuxContainer()
+        {
+            // Arrange
+            _mockEnvironment.Setup(p => p.GetEnvironmentVariable(It.Is<string>(k => k == EnvironmentSettingNames.ContainerName))).Returns<string>(v => v = null);
+
+            var key = TestHelpers.GenerateKeyBytes();
+            var stringKey = TestHelpers.GenerateKeyHexString(key);
+            using (new TestScopedEnvironmentVariable(EnvironmentSettingNames.WebSiteAuthEncryptionKey, stringKey))
+            {
+                // Act
+                ObjectResult result = (ObjectResult)_hostController.GetAdminToken();
+                HttpStatusCode resultStatus = (HttpStatusCode)result.StatusCode;
+
+                // Assert
+                Assert.Equal(HttpStatusCode.BadRequest, resultStatus);
+            }
+        }
     }
 }