rage.fail

azure-sf-app-token-service

Code in a managed-identity-enabled SF service can mint a bearer token for the app's MI from the per-node localhost token service.

derived azure emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'app': None} ExecutesAs {'mi': None}

where

node_type(?app) == ApplicationPlatform # SF application resource

emit

source	`<serviceFabric application>`
target	`<managed identity assigned to the app>`
conditions	`service_state`

Narrative

Code in a service of {app.name} can request a bearer token for {mi.name} from the localhost Managed Identity Token Service (IDENTITY_ENDPOINT + IDENTITY_HEADER).

Raw rule rules/derived/azure/servicefabric.yaml

id: azure-sf-app-token-service
emits: CanRetrieveToken
description: Code in a managed-identity-enabled SF service can mint a bearer token for the app's MI from
  the per-node localhost token service.
match:
- - app: null
  - ExecutesAs
  - mi: null
where:
- 'node_type(?app) == ApplicationPlatform   # SF application resource'
emit:
  source: <serviceFabric application>
  target: <managed identity assigned to the app>
  permissions: []
  conditions:
  - service_state
  note: Service env carries IDENTITY_ENDPOINT (e.g. https://localhost:2377/metadata/identity/oauth2/token),
    IDENTITY_HEADER (per-activation secret sent as 'Secret' header), IDENTITY_SERVER_THUMBPRINT. GET <endpoint>?api-version=2019-07-01-preview&resource=<aud>.
    The companion ExposesCredential(app -> mi) edge is produced by azure-sf-app-exposes-mi-credential.
  false_positive_note: Only fires when the application actually has a managed identity (identity.type
    != None) AND the cluster ManagedIdentityTokenService is enabled (auto-enabled on first MI-app deploy).
    No MI or service without ManagedIdentityTokenService => no token; do NOT emit. This is the APP MI,
    distinct from any node/VMSS MI.
  narrative: Code in a service of {app.name} can request a bearer token for {mi.name} from the localhost
    Managed Identity Token Service (IDENTITY_ENDPOINT + IDENTITY_HEADER).