I recently was tasked to propose a way to use linked templates, especially how to refer to templates stored in a private repository. The Azure Resource Manager (ARM) engine accepts a URI to access and deploy linked templates, hence the URI must be accessible by ARM. If you store your templates in a public repository, ARM can access them fine, but what if you use a private repository? This post will show you how.
In this example, I use Bitbucket – a Git-based source control product by Atlassian. The free version (hosted in the cloud) allows you to have up to 5 private repositories. I will describe the process for obtaining a Bitbucket OAuth 2.0 token using PowerShell and how we can use the access token in Azure linked templates.
Some Basics
If you store your code in a private repository, you can access the stored code after logging into Bitbucket. Alternatively, you can use an access token instead of user credentials to log in. Access tokens allow apps or programs to access private repositories hence, they are secret in nature, just like passwords or cash.
Bitbucket access token expires in one hour. Once the token expires, you can either request for a new access token or renew using a refresh token. Bitbucket supports all 4 of the RFC-6749 standard to grant access/bearer token – in this example; we will use the password grant method. Note that this method will not work when you have a two-factor authentication enabled.
Getting into actions
First thing first, you must have a private repository in Bitbucket. To obtain access tokens, we will create a consumer in Bitbucket which will generate a consumer key and a secret. This key/secret pair is used to grant access token. See Bitbucket documentation for more detailed instructions.
Before I describe the process to grant access token in PowerShell, let’s examine how we can use get Bitbucket access token using the curl command.
[code lang=”bash”]
curl -X POST -u "client_id:secret"
https://bitbucket.org/site/oauth2/access_token -d grant_type=password
-d username={username} -d password={password}
[/code]
- -X POST = specifies a POST method over HTTP, the request method that is passed to the Bitbucket server.
- -u “client_id:secret” = specifies the user name and password used for basic authentication. Note that this does not refer to the bitbucket user login details but rather the consumer key/secret pair.
- -d this is the body of the HTTP request – in this case, it specifies the grant_type method to be used, which is password grant. In addition to Bitbucket login details – username and password.
To replicate the same command in PowerShell, we can use the Invoke-RestMethod cmdlet. This cmdlet is an REST-compliant, a method that sends HTTP/HTTPS requests which return structured data.
[code language=”powershell”]
# Construct BitBucket request
$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f $bbCredentials.bbConsumerKey,$bbCredentials.bbConsumersecret)))
$data = @{
grant_type = ‘password’
username=$bbCredentials.bbUsername
password=$bbCredentials.bbPassword
}
# Perform the request to BB OAuth2.0
$tokens=Invoke-RestMethod -Uri $accessCodeURL -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)} -Method Post -Body $data
[/code]
The base64AuthInfo variable creates a base64 encoded string for HTTP basic authentication and the HTTP body request encapsulated in the data variable. Both variables are used to construct the Bitbucket OAuth 2.0 request.
When successfully executed, an access token is produced (an example is below). This access token is valid for 1 hour by default and you can either renew it with a refresh token or request a new access token.
access_token :g-9dXI3aa3upn0KpXIBGfq5FfUE7UXqHAiBeYD4j_mf383YD2drOEf8Y7CCfAv3yxv2GFlODC8hmhwXUhL8= scopes : repository expires_in : 3600 refresh_token : Vj3AYYcebM8TGnle8K token_type : bearer
Use in Azure Linked Templates
Once you have obtained the access token, we can use it in our Azure linked templates by including it as part of the URL query string.
(For ways how we can implement linked templates, refer to my previous blog post)
{
"apiVersion": "2015-01-01",
"name": "dbserverLinked",
"type": "Microsoft.Resources/deployments",
"properties": {
"mode": "Incremental",
"templateLink": {
"uri": "https://api.bitbucket.org/1.0/repositories/swappr/azurerm/raw/e1db69add5d62f64120b06a3179828a37b7f166c/azuredeploy.json?accesstoken=g-9dXI3aa3upn0KpXIBGfq5FfUE7UXqHAiBeYD4j_mf383YD2drOEf8Y7CCfAv3yxv2GFlODC8hmhwXUhL8=",
"contentVersion": "1.0.0.0"
},
"parametersLink": {
"uri": "https://api.bitbucket.org/1.0/repositories/swappr/azurerm/raw/6208359175c99bb892c2097901b0ed7bd723ae56/azuredeploy.parameters.json?access_token=g-9dXI3aa3upn0KpXIBGfq5FfUE7UXqHAiBeYD4j_mf383YD2drOEf8Y7CCfAv3yxv2GFlODC8hmhwXUhL8=",
"contentVersion": "1.0.0.0"
}
}
}
Summary
We have described a way to obtain an access token to a private Bitbucket repository. With this token, your app can access resources, code, or any other artifacts stored in your private repository. You can also use the access token in your build server so it can get required code, build/compile it, or perform other things.
Comments are closed.