From 0357d5529563fddfff669d154502e85cb45aabe9 Mon Sep 17 00:00:00 2001 From: Missy Messa Date: Wed, 8 Jul 2026 13:00:33 -0700 Subject: [PATCH 1/2] Use WIF-based Entra auth for OneLocBuild ceapex feed access Cherry-pick of onelocbuild-wif-migration (main) to release/10.0. Replace PAT-based authentication with Entra token acquired via AzureCLI@2 and the dnceng-onelocbuild-ceapex service connection. Related: AzDO#10151 --- eng/common/core-templates/job/onelocbuild.yml | 26 +++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/eng/common/core-templates/job/onelocbuild.yml b/eng/common/core-templates/job/onelocbuild.yml index eefed3b667a..32dae2c04f3 100644 --- a/eng/common/core-templates/job/onelocbuild.yml +++ b/eng/common/core-templates/job/onelocbuild.yml @@ -8,6 +8,11 @@ parameters: CeapexPat: $(dn-bot-ceapex-package-r) # PAT for the loc AzDO instance https://dev.azure.com/ceapex GithubPat: $(BotAccount-dotnet-bot-repo-PAT) + # Service connection for WIF-based Entra authentication to ceapex feeds (replaces CeapexPat). + # When set, uses AzureCLI@2 to obtain an Entra token instead of a PAT. + # Set to '' to fall back to PAT-based auth via CeapexPat parameter. + CeapexServiceConnection: 'dnceng-onelocbuild-ceapex' + SourcesDirectory: $(System.DefaultWorkingDirectory) CreatePr: true AutoCompletePr: false @@ -73,7 +78,21 @@ jobs: displayName: Generate LocProject.json condition: ${{ parameters.condition }} - - task: OneLocBuild@2 + # Acquire Entra token for ceapex feed access when using WIF-based auth + - ${{ if ne(parameters.CeapexServiceConnection, '') }}: + - task: AzureCLI@2 + displayName: 'Acquire Entra token for ceapex feed access' + inputs: + azureSubscription: ${{ parameters.CeapexServiceConnection }} + scriptType: 'pscore' + scriptLocation: 'inlineScript' + inlineScript: | + $token = az account get-access-token --query accessToken --resource 499b84ac-1321-427f-aa17-267ca6975798 -o tsv + if (-not $token) { Write-Error "Failed to acquire AzDO token"; exit 1 } + Write-Host "##vso[task.setvariable variable=CeapexEntraToken;issecret=true]${token}" + condition: ${{ parameters.condition }} + + - task: OneLocBuild@3 displayName: OneLocBuild env: SYSTEM_ACCESSTOKEN: $(System.AccessToken) @@ -88,7 +107,10 @@ jobs: isUseLfLineEndingsSelected: ${{ parameters.UseLfLineEndings }} isShouldReusePrSelected: ${{ parameters.ReusePr }} packageSourceAuth: patAuth - patVariable: ${{ parameters.CeapexPat }} + ${{ if ne(parameters.CeapexServiceConnection, '') }}: + patVariable: $(CeapexEntraToken) + ${{ if eq(parameters.CeapexServiceConnection, '') }}: + patVariable: ${{ parameters.CeapexPat }} ${{ if eq(parameters.RepoType, 'gitHub') }}: repoType: ${{ parameters.RepoType }} gitHubPatVariable: "${{ parameters.GithubPat }}" From 26788b681da8f2626e6a5695e9c8aab90133fb02 Mon Sep 17 00:00:00 2001 From: Missy Messa Date: Wed, 15 Jul 2026 12:28:24 -0700 Subject: [PATCH 2/2] Address Copilot review: reuse shared token template, gate WIF to dnceng/internal only, PAT fallback elsewhere --- eng/common/core-templates/job/onelocbuild.yml | 30 ++++++++----------- 1 file changed, 13 insertions(+), 17 deletions(-) diff --git a/eng/common/core-templates/job/onelocbuild.yml b/eng/common/core-templates/job/onelocbuild.yml index 32dae2c04f3..c57d7b60902 100644 --- a/eng/common/core-templates/job/onelocbuild.yml +++ b/eng/common/core-templates/job/onelocbuild.yml @@ -9,8 +9,9 @@ parameters: GithubPat: $(BotAccount-dotnet-bot-repo-PAT) # Service connection for WIF-based Entra authentication to ceapex feeds (replaces CeapexPat). - # When set, uses AzureCLI@2 to obtain an Entra token instead of a PAT. - # Set to '' to fall back to PAT-based auth via CeapexPat parameter. + # When set, dnceng/internal builds acquire a federated Entra token instead of using a PAT. + # All other projects (e.g. DevDiv, public), where this dnceng-scoped service connection does not + # exist, and any pipeline that sets this to '' fall back to PAT-based auth via the CeapexPat parameter. CeapexServiceConnection: 'dnceng-onelocbuild-ceapex' SourcesDirectory: $(System.DefaultWorkingDirectory) @@ -78,19 +79,14 @@ jobs: displayName: Generate LocProject.json condition: ${{ parameters.condition }} - # Acquire Entra token for ceapex feed access when using WIF-based auth - - ${{ if ne(parameters.CeapexServiceConnection, '') }}: - - task: AzureCLI@2 - displayName: 'Acquire Entra token for ceapex feed access' - inputs: - azureSubscription: ${{ parameters.CeapexServiceConnection }} - scriptType: 'pscore' - scriptLocation: 'inlineScript' - inlineScript: | - $token = az account get-access-token --query accessToken --resource 499b84ac-1321-427f-aa17-267ca6975798 -o tsv - if (-not $token) { Write-Error "Failed to acquire AzDO token"; exit 1 } - Write-Host "##vso[task.setvariable variable=CeapexEntraToken;issecret=true]${token}" - condition: ${{ parameters.condition }} + # Acquire an Entra token for ceapex feed access via WIF (dnceng/internal only). + # All other projects use PAT-based auth, since the ceapex service connection is scoped to dnceng/internal. + - ${{ if and(ne(parameters.CeapexServiceConnection, ''), eq(variables['System.TeamProject'], 'internal')) }}: + - template: /eng/common/templates/steps/get-federated-access-token.yml + parameters: + federatedServiceConnection: ${{ parameters.CeapexServiceConnection }} + outputVariableName: 'CeapexEntraToken' + condition: ${{ parameters.condition }} - task: OneLocBuild@3 displayName: OneLocBuild @@ -107,9 +103,9 @@ jobs: isUseLfLineEndingsSelected: ${{ parameters.UseLfLineEndings }} isShouldReusePrSelected: ${{ parameters.ReusePr }} packageSourceAuth: patAuth - ${{ if ne(parameters.CeapexServiceConnection, '') }}: + ${{ if and(ne(parameters.CeapexServiceConnection, ''), eq(variables['System.TeamProject'], 'internal')) }}: patVariable: $(CeapexEntraToken) - ${{ if eq(parameters.CeapexServiceConnection, '') }}: + ${{ if or(eq(parameters.CeapexServiceConnection, ''), ne(variables['System.TeamProject'], 'internal')) }}: patVariable: ${{ parameters.CeapexPat }} ${{ if eq(parameters.RepoType, 'gitHub') }}: repoType: ${{ parameters.RepoType }}