From 5ccebcdb3f2d8db76b3b559d070d667b903e1358 Mon Sep 17 00:00:00 2001 From: Julien Pivotto <291750+roidelapluie@users.noreply.github.com> Date: Mon, 27 Apr 2026 12:16:46 +0200 Subject: [PATCH] remote/azuread: use Secret type for OAuth client_secret The ClientSecret field in OAuthConfig was typed as plain string, causing it to be exposed in plaintext via the /-/config HTTP endpoint. Change it to config_util.Secret so Prometheus redacts it as . Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com> --- storage/remote/azuread/azuread.go | 5 +++-- storage/remote/azuread/azuread_test.go | 11 ++++++----- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/storage/remote/azuread/azuread.go b/storage/remote/azuread/azuread.go index 1ba55420f8..751d7d6c45 100644 --- a/storage/remote/azuread/azuread.go +++ b/storage/remote/azuread/azuread.go @@ -27,6 +27,7 @@ import ( "github.com/Azure/azure-sdk-for-go/sdk/azidentity" "github.com/google/uuid" "github.com/grafana/regexp" + config_util "github.com/prometheus/common/config" ) // Clouds. @@ -75,7 +76,7 @@ type OAuthConfig struct { ClientID string `yaml:"client_id,omitempty"` // ClientSecret is the clientSecret of the azure active directory application that is being used to authenticate. - ClientSecret string `yaml:"client_secret,omitempty"` + ClientSecret config_util.Secret `yaml:"client_secret,omitempty"` // TenantID is the tenantId of the azure active directory application that is being used to authenticate. TenantID string `yaml:"tenant_id,omitempty"` @@ -357,7 +358,7 @@ func newWorkloadIdentityTokenCredential(clientOpts *azcore.ClientOptions, worklo // newOAuthTokenCredential returns new OAuth token credential. func newOAuthTokenCredential(clientOpts *azcore.ClientOptions, oAuthConfig *OAuthConfig) (azcore.TokenCredential, error) { opts := &azidentity.ClientSecretCredentialOptions{ClientOptions: *clientOpts} - return azidentity.NewClientSecretCredential(oAuthConfig.TenantID, oAuthConfig.ClientID, oAuthConfig.ClientSecret, opts) + return azidentity.NewClientSecretCredential(oAuthConfig.TenantID, oAuthConfig.ClientID, string(oAuthConfig.ClientSecret), opts) } // newSDKTokenCredential returns new SDK token credential. diff --git a/storage/remote/azuread/azuread_test.go b/storage/remote/azuread/azuread_test.go index 857ecdba8a..4493cef10d 100644 --- a/storage/remote/azuread/azuread_test.go +++ b/storage/remote/azuread/azuread_test.go @@ -25,6 +25,7 @@ import ( "github.com/Azure/azure-sdk-for-go/sdk/azcore/policy" "github.com/google/uuid" "github.com/prometheus/client_golang/prometheus/promhttp" + config_util "github.com/prometheus/common/config" "github.com/stretchr/testify/mock" "github.com/stretchr/testify/require" "github.com/stretchr/testify/suite" @@ -32,11 +33,11 @@ import ( ) const ( - dummyAudience = "dummyAudience" - dummyClientID = "00000000-0000-0000-0000-000000000000" - dummyClientSecret = "Cl1ent$ecret!" - dummyTenantID = "00000000-a12b-3cd4-e56f-000000000000" - testTokenString = "testTokenString" + dummyAudience = "dummyAudience" + dummyClientID = "00000000-0000-0000-0000-000000000000" + dummyClientSecret config_util.Secret = "Cl1ent$ecret!" + dummyTenantID = "00000000-a12b-3cd4-e56f-000000000000" + testTokenString = "testTokenString" ) func testTokenExpiry() time.Time { return time.Now().Add(5 * time.Second) }