Documentation
¶
Overview ¶
Package cloudenv describes the Microsoft national cloud environments this plugin supports (commercial, US Government GCC High, and US Government DoD) and maps each to the endpoints, scopes, and domains that differ between clouds.
GCC (moderate) is intentionally not a separate environment: it rides on the commercial endpoints and is therefore covered by Commercial. China (21Vianet) and air-gapped classified clouds are out of scope.
Note: cloud.AzureGovernment selects the login authority (login.microsoftonline.us) for both GCC High and DoD, but does not distinguish their Graph hosts (graph.microsoft.us vs dod-graph.microsoft.us), so GraphBaseURL is set explicitly.
Index ¶
Constants ¶
const ( Commercial = "commercial" GCCHigh = "gcchigh" DoD = "dod" )
Recognized cloud names. These are the accepted values for the plugin's national_cloud setting and the azure-setup --cloud flag.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Environment ¶
type Environment struct {
// Name is the recognized cloud name (see the constants above).
Name string
// LoginAuthorityHost is the Microsoft Entra host used to build OAuth
// authorize/token URLs (e.g. login.microsoftonline.com).
LoginAuthorityHost string
// GraphHost is the Microsoft Graph service host (e.g. graph.microsoft.com).
GraphHost string
// GraphBaseURL is the Microsoft Graph service root, including the version
// segment (e.g. https://graph.microsoft.com/v1.0). It is set explicitly on
// the Graph SDK adapter because DoD uses a different Graph host than GCC High.
GraphBaseURL string
// GraphScope is the OAuth .default scope for Microsoft Graph
// (e.g. https://graph.microsoft.com/.default).
GraphScope string
// JWKSURL serves the signing keys used to validate Teams SSO tokens.
JWKSURL string
// AzureCloud is the azcore cloud configuration passed to the Azure SDK
// credentials so tokens are acquired from the correct authority.
AzureCloud cloud.Configuration
// TeamsDomain is the Microsoft Teams client host, used for activity-feed
// deep links and for embedding (e.g. teams.microsoft.com).
TeamsDomain string
// PortalHost is the Azure portal host, used for admin-consent links
// (e.g. portal.azure.com).
PortalHost string
// FrameAncestors lists the domains added to the Mattermost server's
// frame-ancestors so the plugin iframe can be embedded in this cloud's
// Microsoft 365 clients.
//
// The Teams client domain is authoritative. The Outlook/M365 gov domains
// below are best-effort and may need refinement once verified against a
// gov tenant (tracked as a verification item in the implementation plan).
FrameAncestors []string
// CSPConnectSrc is the connect-src value for the iframe Content Security
// Policy. The script-src is intentionally not per-cloud: the Teams JS SDK
// is served from the same res.cdn.office.net CDN across all clouds.
CSPConnectSrc string
}
Environment holds all cloud-specific endpoints and domains for a Microsoft national cloud.
func EnvironmentFor ¶
func EnvironmentFor(name string) Environment
EnvironmentFor returns the cloud environment for the given name, defaulting to the commercial cloud for empty or unrecognized names. Matching is case-insensitive and ignores surrounding whitespace.
Source Files