Repository: smallstep/cli
Pull request #652 (2022-03-20 00:13:17)

Add optional SHA1 fingerprint output for certificates
Add optional SHA1 fingerprint output for certificates has requested in https://github.com/smallstep/cli/issues/611


Patch:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3929426c..f6194626 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-20.04
     strategy:
       matrix:
-        go: [ '1.17', '1.18' ]
+        go: [ '1.16', '1.17' ]
     steps:
       -
         name: Checkout
@@ -26,7 +26,7 @@ jobs:
         name: golangci-lint
         uses: golangci/golangci-lint-action@v2
         with:
-          version: 'v1.45.0'
+          version: 'v1.44.0'
           args: --timeout=30m
       -
         name: Test, Build
@@ -85,7 +85,7 @@ jobs:
         name: Set up Go
         uses: actions/setup-go@v2
         with:
-          go-version: 1.18
+          go-version: 1.17
       -
         name: Configure Go
         id: configure_go
@@ -129,7 +129,7 @@ jobs:
         name: Setup Go
         uses: actions/setup-go@v2
         with:
-          go-version: 1.18
+          go-version: 1.17
       -
         name: Install cosign
         uses: sigstore/cosign-installer@v1.1.0
@@ -165,7 +165,7 @@ jobs:
         name: Setup Go
         uses: actions/setup-go@v2
         with:
-          go-version: 1.18
+          go-version: 1.17
       -
         name: Build
         id: build
@@ -205,7 +205,7 @@ jobs:
         name: Setup Go
         uses: actions/setup-go@v2
         with:
-          go-version: 1.18
+          go-version: 1.17
       -
         name: Build
         id: build
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a7d14974..089ca290 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,7 +10,6 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 ### Added
 - Add flags to include subscription and object ids in the Azure provisioner.
 ### Changed
-- Support two latest versions of Go (1.17, 1.18)
 ### Deprecated
 ### Removed
 ### Fixed
diff --git a/command/certificate/fingerprint.go b/command/certificate/fingerprint.go
index e287a792..dfe85f68 100644
--- a/command/certificate/fingerprint.go
+++ b/command/certificate/fingerprint.go
@@ -18,7 +18,8 @@ func fingerprintCommand() cli.Command {
 		Action: cli.ActionFunc(fingerprintAction),
 		Usage:  "print the fingerprint of a certificate",
 		UsageText: `**step certificate fingerprint** <crt-file>
-[**--bundle**] [**--roots**=<root-bundle>] [**--servername**=<servername>] [**--format**=<format>]`,
+[**--bundle**] [**--roots**=<root-bundle>] [**--servername**=<servername>] 
+[**--format**=<format>] [**--sha1**] [**--insecure**]`,
 		Description: `**step certificate fingerprint** reads a certificate and prints to STDOUT the
 certificate SHA256 of the raw certificate.
 
@@ -80,6 +81,10 @@ debugging invalid certificates remotely.`,
 			},
 			flags.ServerName,
 			command.FingerprintFormatFlag("hex"),
+			cli.BoolFlag{
+				Name:  "sha1",
+				Usage: `Use the SHA-1 hash algorithm to hash the certificate. Requires **--insecure** flag.`,
+			},
 		},
 	}
 }
@@ -97,6 +102,7 @@ func fingerprintAction(ctx *cli.Context) error {
 		insecure   = ctx.Bool("insecure")
 		crtFile    = ctx.Args().First()
 		format     = ctx.String("format")
+		useSHA1    = ctx.Bool("sha1")
 	)
 
 	encoding, err := command.GetFingerprintEncoding(format)
@@ -124,7 +130,10 @@ func fingerprintAction(ctx *cli.Context) error {
 	}
 
 	for i, crt := range certs {
-		fp := x509util.EncodedFingerprint(crt, x509util.FingerprintEncoding(encoding))
+		fp, err := x509util.EncodedFingerprint(crt, x509util.FingerprintEncoding(encoding), useSHA1, insecure)
+		if err != nil {
+			return err
+		}
 		if bundle {
 			fmt.Printf("%d: %s\n", i, fp)
 		} else {
diff --git a/command/certificate/inspect.go b/command/certificate/inspect.go
index 2f39aa58..bdebbdd6 100644
--- a/command/certificate/inspect.go
+++ b/command/certificate/inspect.go
@@ -72,11 +72,6 @@ Inspect a remote certificate (using the default root certificate bundle to verif
 $ step certificate inspect https://smallstep.com
 '''
 
-Inspect a remote certificate (using the standard port derived from the URL prefix):
-'''
-$ step certificate inspect smtps://smtp.gmail.com
-'''
-
 Inspect an invalid remote certificate:
 '''
 $ step certificate inspect --insecure https://expired.badssl.com
diff --git a/command/certificate/remote.go b/command/certificate/remote.go
index f1d322a6..b070d6f2 100644
--- a/command/certificate/remote.go
+++ b/command/certificate/remote.go
@@ -5,20 +5,13 @@ import (
 	"crypto/x509"
 	"net"
 	"net/url"
-	"strconv"
 	"strings"
 
 	"github.com/pkg/errors"
 	"github.com/smallstep/cli/crypto/x509util"
 )
 
-var urlPrefixes = map[string]uint16{
-	"tcp://":   443,
-	"tls://":   443,
-	"https://": 443,
-	"smtps://": 465,
-	"ldaps://": 636,
-}
+var urlPrefixes = []string{"https://", "tcp://", "tls://"}
 
 // getPeerCertificates creates a connection to a remote server and returns the
 // list of server certificates.
@@ -63,27 +56,20 @@ func getPeerCertificates(addr, serverName, roots string, insecure bool) ([]*x509
 // trimURL returns the host[:port] if the input is a URL, otherwise returns an
 // empty string (and 'isURL:false').
 //
-// If the URL is valid and no port is specified, the default port determined
-// by the URL prefix is used.
-//
 // Examples:
-// trimURL("https://smallstep.com/onbaording") -> "smallstep.com:443", true, nil
+// trimURL("https://smallstep.com/onbaording") -> "smallstep.com", true, nil
 // trimURL("https://ca.smallSTEP.com:8080") -> "ca.smallSTEP.com:8080", true, nil
 // trimURL("./certs/root_ca.crt") -> "", false, nil
-// trimURL("hTtPs://sMaLlStEp.cOm") -> "sMaLlStEp.cOm:443", true, nil
+// trimURL("hTtPs://sMaLlStEp.cOm") -> "sMaLlStEp.cOm", true, nil
 // trimURL("hTtPs://sMaLlStEp.cOm hello") -> "", false, err{"invalid url"}
 func trimURL(ref string) (string, bool, error) {
 	tmp := strings.ToLower(ref)
-	for prefix := range urlPrefixes {
+	for _, prefix := range urlPrefixes {
 		if strings.HasPrefix(tmp, prefix) {
 			u, err := url.Parse(ref)
 			if err != nil {
 				return "", false, errors.Wrapf(err, "error parsing URL '%s'", ref)
 			}
-			if _, _, err := net.SplitHostPort(u.Host); err != nil {
-				port := strconv.FormatUint(uint64(urlPrefixes[prefix]), 10)
-				u.Host = net.JoinHostPort(u.Host, port)
-			}
 			return u.Host, true, nil
 		}
 	}
diff --git a/crypto/x509util/crt.go b/crypto/x509util/crt.go
index 377d79ca..a587d631 100644
--- a/crypto/x509util/crt.go
+++ b/crypto/x509util/crt.go
@@ -1,6 +1,7 @@
 package x509util
 
 import (
+	"crypto/sha1"
 	"crypto/sha256"
 	"crypto/x509"
 	"encoding/pem"
@@ -17,7 +18,8 @@ import (
 
 // Fingerprint returns the SHA-256 fingerprint of the certificate.
 func Fingerprint(cert *x509.Certificate) string {
-	return EncodedFingerprint(cert, HexFingerprint)
+	h, _ := EncodedFingerprint(cert, HexFingerprint, false, false)
+	return h
 }
 
 // FingerprintEncoding represents the fingerprint encoding type.
@@ -38,10 +40,19 @@ const (
 	EmojiFingerprint = FingerprintEncoding(fingerprint.EmojiFingerprint)
 )
 
-// EncodedFingerprint returns an encoded the SHA-256 fingerprint of the certificate. Defaults to hex encoding
-func EncodedFingerprint(cert *x509.Certificate, encoding FingerprintEncoding) string {
+// EncodedFingerprint returns an encoded fingerprint of the certificate.
+// Defaults to hex encoding and SHA-256.
+func EncodedFingerprint(cert *x509.Certificate, encoding FingerprintEncoding,
+	sha1Mode bool, insecure bool) (string, error) {
+	if sha1Mode {
+		if !insecure {
+			return "", errors.New("sha1 requires '--insecure' flag")
+		}
+		sum := sha1.Sum(cert.Raw)
+		return fingerprint.Fingerprint(sum[:], fingerprint.WithEncoding(fingerprint.Encoding(encoding))), nil
+	}
 	sum := sha256.Sum256(cert.Raw)
-	return fingerprint.Fingerprint(sum[:], fingerprint.WithEncoding(fingerprint.Encoding(encoding)))
+	return fingerprint.Fingerprint(sum[:], fingerprint.WithEncoding(fingerprint.Encoding(encoding))), nil
 }
 
 // SplitSANs splits a slice of Subject Alternative Names into slices of
diff --git a/make/common.mk b/make/common.mk
index 18999304..c2798f13 100644
--- a/make/common.mk
+++ b/make/common.mk
@@ -17,7 +17,7 @@ OUTPUT_ROOT=output/
 
 bootstra%:
 	# Using a released version of golangci-lint to take into account custom replacements in their go.mod
-	$Q curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $$(go env GOPATH)/bin v1.45.2
+	$Q curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $$(go env GOPATH)/bin v1.42.0
 
 .PHONY: bootstra%
 
diff --git a/token/parse.go b/token/parse.go
index 8a005481..afdad9d6 100644
--- a/token/parse.go
+++ b/token/parse.go
@@ -125,14 +125,13 @@ type AWSInstanceIdentityDocument struct {
 
 // azureXMSMirIDRegExp is the regular expression used to parse the xms_mirid claim.
 // Using case insensitive as resourceGroups appears as resourcegroups.
-var azureXMSMirIDRegExp = regexp.MustCompile(`(?i)^/subscriptions/([^/]+)/resourceGroups/([^/]+)/providers/Microsoft.(Compute/virtualMachines|ManagedIdentity/userAssignedIdentities)/([^/]+)$`)
+var azureXMSMirIDRegExp = regexp.MustCompile(`(?i)^/subscriptions/([^/]+)/resourceGroups/([^/]+)/providers/Microsoft.Compute/virtualMachines/([^/]+)$`)
 
 // AzurePayload contains the information in the xms_mirid claim.
 type AzurePayload struct {
 	SubscriptionID string
 	ResourceGroup  string
-	ResourceType   string
-	ResourceName   string
+	VirtualMachine string
 }
 
 // Parse parses the given token verifying the signature with the key.
@@ -176,8 +175,7 @@ func parseResponse(jwt *jose.JSONWebToken, p Payload) (*JSONWebToken, error) {
 			p.Azure = &AzurePayload{
 				SubscriptionID: re[1],
 				ResourceGroup:  re[2],
-				ResourceType:   strings.Split(re[3], "/")[1],
-				ResourceName:   re[4],
+				VirtualMachine: re[3],
 			}
 		}
 	}
diff --git a/utils/cautils/certificate_flow.go b/utils/cautils/certificate_flow.go
index 6cd664cb..6efc9aee 100644
--- a/utils/cautils/certificate_flow.go
+++ b/utils/cautils/certificate_flow.go
@@ -271,7 +271,7 @@ func (f *CertificateFlow) CreateSignRequest(ctx *cli.Context, tok, subject strin
 	case token.Azure:
 		if len(ips) == 0 && len(dnsNames) == 0 {
 			defaultSANs := []string{
-				jwt.Payload.Azure.ResourceName,
+				jwt.Payload.Azure.VirtualMachine,
 			}
 			if !sharedContext.DisableCustomSANs {
 				defaultSANs = append(defaultSANs, subject)


Test patch:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 73b0ed9b..0a321efd 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-20.04
     strategy:
       matrix:
-        go: [ '1.17', '1.18' ]
+        go: [ '1.16', '1.17' ]
     steps:
       -
         name: Checkout
@@ -28,7 +28,7 @@ jobs:
         name: golangci-lint
         uses: golangci/golangci-lint-action@v2
         with:
-          version: 'v1.45.2'
+          version: 'v1.44.0'
           args: --timeout=30m
       -
         name: Test, Build
@@ -37,7 +37,7 @@ jobs:
       -
         name: Codecov
         uses: codecov/codecov-action@v1.2.1
-        if: matrix.go == '1.18'
+        if: matrix.go == '1.17'
         with:
           file: ./coverage.out
           name: codecov-umbrella
diff --git a/command/certificate/remote_test.go b/command/certificate/remote_test.go
index 91037745..c46a502b 100644
--- a/command/certificate/remote_test.go
+++ b/command/certificate/remote_test.go
@@ -2,6 +2,7 @@ package certificate
 
 import (
 	"errors"
+	"fmt"
 	"net"
 	"testing"
 
@@ -15,12 +16,12 @@ func TestTrimURL(t *testing.T) {
 		err         error
 	}
 	tests := map[string]newTest{
-		"true-http":      {"https://smallstep.com", "smallstep.com:443", true, nil},
+		"true-http":      {"https://smallstep.com", "smallstep.com", true, nil},
 		"true-tcp":       {"tcp://smallstep.com:8080", "smallstep.com:8080", true, nil},
-		"true-tls":       {"tls://smallstep.com/onboarding", "smallstep.com:443", true, nil},
+		"true-tls":       {"tls://smallstep.com/onboarding", "smallstep.com", true, nil},
 		"false":          {"./certs/root_ca.crt", "", false, nil},
 		"false-err":      {"https://google.com hello", "", false, errors.New("error parsing URL 'https://google.com hello'")},
-		"true-http-case": {"hTtPs://sMaLlStEp.cOm", "sMaLlStEp.cOm:443", true, nil},
+		"true-http-case": {"hTtPs://sMaLlStEp.cOm", "sMaLlStEp.cOm", true, nil},
 	}
 
 	for name, tc := range tests {
@@ -65,7 +66,7 @@ func TestGetPeerCertificateServerName(t *testing.T) {
 	tests := map[string]newTest{
 		"sni-disabled-host": {host, "", nil},
 		"sni-enabled-host":  {host, serverName, nil},
-		"sni-disabled-ip":   {addr, "", errors.New("failed to connect")},
+		"sni-disabled-ip":   {addr, "", fmt.Errorf("failed to connect: x509: cannot validate certificate for %s because it doesn't contain any IP SANs", addr)},
 		"sni-enabled-ip":    {addr, serverName, nil},
 	}
 
diff --git a/crypto/x509util/crt_test.go b/crypto/x509util/crt_test.go
index e07a4415..45207b82 100644
--- a/crypto/x509util/crt_test.go
+++ b/crypto/x509util/crt_test.go
@@ -46,7 +46,7 @@ func TestEncodedFingerprint(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			cert := mustParseCertificate(t, tt.fn)
-			if got := EncodedFingerprint(cert, tt.encoding); got != tt.want {
+			if got, _ := EncodedFingerprint(cert, tt.encoding, false, false); got != tt.want {
 				t.Errorf("EncodedFingerprint() = %v, want %v", got, tt.want)
 			}
 		})
diff --git a/token/parse_test.go b/token/parse_test.go
index 6e20ecbc..caa7daf1 100644
--- a/token/parse_test.go
+++ b/token/parse_test.go
@@ -47,13 +47,9 @@ const (
 	  }
 	]
 }`
-	awsToken = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhbWF6b24iOnsiZG9jdW1lbnQiOiJld29nSUNKaFkyTnZkVzUwU1dRaU9pQWlTVzV0UWxOMGVuaDJjeUlzQ2lBZ0ltRnlZMmhwZEdWamRIVnlaU0k2SUNKNE9EWmZOalFpTEFvZ0lDSmhkbUZwYkdGaWFXeHBkSGxhYjI1bElqb2dJblZ6TFhkbGMzUXRNbUlpTEFvZ0lDSmlhV3hzYVc1blVISnZaSFZqZEhNaU9pQnVkV3hzTEFvZ0lDSmtaWFp3WVhsUWNtOWtkV04wUTI5a1pYTWlPaUJ1ZFd4c0xBb2dJQ0pwYldGblpVbGtJam9nSWxOQk5IaFpWVEZGWWtRaUxBb2dJQ0pwYm5OMFlXNWpaVWxrSWpvZ0lsb3pXRmRzV0VkT1dsSWlMQW9nSUNKcGJuTjBZVzVqWlZSNWNHVWlPaUFpZERJdWJXbGpjbThpTEFvZ0lDSnJaWEp1Wld4SlpDSTZJQ0lpTEFvZ0lDSndaVzVrYVc1blZHbHRaU0k2SUNJeU1ERTVMVEExTFRBNVZEQXhPakEwT2pJekxqVXlORFkyT1ZvaUxBb2dJQ0p3Y21sMllYUmxTWEFpT2lBaU1USTNMakF1TUM0eElpd0tJQ0FpY21GdFpHbHphMGxrSWpvZ0lpSXNDaUFnSW5KbFoybHZiaUk2SUNKMWN5MTNaWE4wTFRFaUxBb2dJQ0oyWlhKemFXOXVJam9nSWpJd01UY3RNRGt0TXpBaUNuMD0iLCJzaWduYXR1cmUiOiJKbkdlaWl2UzMrU1QxNGdFd2NCQS9MK0dHYkRyZm1iWmh3dU9tMjIrbFhqWjZzSUN4YUpRaFg1bmxyRDBrZUlvL2Y0dmRkT3FGTzhvUWNHd0J1YXl6aHFSVEt6cGpZVXBoSDFRMlJBUGl4dmcvZ0NSZG5YV0pETHpIRGhjTXdraCtvWnpFTkFuSTlhWGR4Vko4dGFKSlRHZ2lEVzdBcXYzK1JYZG4xcndiVVE9In0sImF1ZCI6WyJhd3M6TGdONHU4OUliNyJdLCJleHAiOjE1NTczNjQxNjMsImlhdCI6MTU1NzM2Mzg2MywiaXNzIjoiZWMyLmFtYXpvbmF3cy5jb20iLCJqdGkiOiI2ZDAyZDQ1MTEzODUzOTc3OTRmMmJkNjc0M2I1Nzc0MmIyNDMzYzE1Y2ZhNjEzZGNjYWYwNmNiMzUzOGY5YzJmIiwibmJmIjoxNTU3MzYzODYzLCJzYW5zIjpudWxsLCJzdWIiOiJaM1hXbFhHTlpSIn0.bP40Dk1YMQlNMK_XYVde93x53c92hCwYCsUp4tL7wrA"
-	// azureToken represents a token obtained by a VM from the Azure IMDS (where the resource type is Microsoft.Compute/virtualMachines)
+	awsToken   = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhbWF6b24iOnsiZG9jdW1lbnQiOiJld29nSUNKaFkyTnZkVzUwU1dRaU9pQWlTVzV0UWxOMGVuaDJjeUlzQ2lBZ0ltRnlZMmhwZEdWamRIVnlaU0k2SUNKNE9EWmZOalFpTEFvZ0lDSmhkbUZwYkdGaWFXeHBkSGxhYjI1bElqb2dJblZ6TFhkbGMzUXRNbUlpTEFvZ0lDSmlhV3hzYVc1blVISnZaSFZqZEhNaU9pQnVkV3hzTEFvZ0lDSmtaWFp3WVhsUWNtOWtkV04wUTI5a1pYTWlPaUJ1ZFd4c0xBb2dJQ0pwYldGblpVbGtJam9nSWxOQk5IaFpWVEZGWWtRaUxBb2dJQ0pwYm5OMFlXNWpaVWxrSWpvZ0lsb3pXRmRzV0VkT1dsSWlMQW9nSUNKcGJuTjBZVzVqWlZSNWNHVWlPaUFpZERJdWJXbGpjbThpTEFvZ0lDSnJaWEp1Wld4SlpDSTZJQ0lpTEFvZ0lDSndaVzVrYVc1blZHbHRaU0k2SUNJeU1ERTVMVEExTFRBNVZEQXhPakEwT2pJekxqVXlORFkyT1ZvaUxBb2dJQ0p3Y21sMllYUmxTWEFpT2lBaU1USTNMakF1TUM0eElpd0tJQ0FpY21GdFpHbHphMGxrSWpvZ0lpSXNDaUFnSW5KbFoybHZiaUk2SUNKMWN5MTNaWE4wTFRFaUxBb2dJQ0oyWlhKemFXOXVJam9nSWpJd01UY3RNRGt0TXpBaUNuMD0iLCJzaWduYXR1cmUiOiJKbkdlaWl2UzMrU1QxNGdFd2NCQS9MK0dHYkRyZm1iWmh3dU9tMjIrbFhqWjZzSUN4YUpRaFg1bmxyRDBrZUlvL2Y0dmRkT3FGTzhvUWNHd0J1YXl6aHFSVEt6cGpZVXBoSDFRMlJBUGl4dmcvZ0NSZG5YV0pETHpIRGhjTXdraCtvWnpFTkFuSTlhWGR4Vko4dGFKSlRHZ2lEVzdBcXYzK1JYZG4xcndiVVE9In0sImF1ZCI6WyJhd3M6TGdONHU4OUliNyJdLCJleHAiOjE1NTczNjQxNjMsImlhdCI6MTU1NzM2Mzg2MywiaXNzIjoiZWMyLmFtYXpvbmF3cy5jb20iLCJqdGkiOiI2ZDAyZDQ1MTEzODUzOTc3OTRmMmJkNjc0M2I1Nzc0MmIyNDMzYzE1Y2ZhNjEzZGNjYWYwNmNiMzUzOGY5YzJmIiwibmJmIjoxNTU3MzYzODYzLCJzYW5zIjpudWxsLCJzdWIiOiJaM1hXbFhHTlpSIn0.bP40Dk1YMQlNMK_XYVde93x53c92hCwYCsUp4tL7wrA"
 	azureToken = "eyJhbGciOiJFUzI1NiIsImtpZCI6IjY2YjQxZjFlOTNmYTM5YTQzMjVkNmFhYmNlZGYwODJhZjg0NGZiMjJlZTk1NDAzYmVmOWQ0ZGNmMzcwYjcxMGUiLCJ0eXAiOiJKV1QifQ.eyJhcHBpZCI6InRoZS1hcHBpZCIsImFwcGlkYWNyIjoidGhlLWFwcGlkYWNyIiwiYXVkIjpbImh0dHBzOi8vbWFuYWdlbWVudC5henVyZS5jb20vIl0sImV4cCI6MTU1NzM0NTY1OCwiaWF0IjoxNTU3MzQ1MzU4LCJpZHAiOiJ0aGUtaWRwIiwiaXNzIjoiaHR0cHM6Ly9zdHMud2luZG93cy5uZXQvUDg3aEFXVUUwYy8iLCJqdGkiOiJ0aGUtanRpIiwibmJmIjoxNTU3MzQ1MzU4LCJvaWQiOiJ0aGUtb2lkIiwic3ViIjoic3ViamVjdCIsInRpZCI6IlA4N2hBV1VFMGMiLCJ2ZXIiOiJ0aGUtdmVyc2lvbiIsInhtc19taXJpZCI6Ii9zdWJzY3JpcHRpb25zL3N1YnNjcmlwdGlvbklEL3Jlc291cmNlR3JvdXBzL3Jlc291cmNlR3JvdXAvcHJvdmlkZXJzL01pY3Jvc29mdC5Db21wdXRlL3ZpcnR1YWxNYWNoaW5lcy92aXJ0dWFsTWFjaGluZSJ9.U_NdLMXLztkYEn0RXYD394SiR-QpaJ8eoRFBu0FYQJ6zDflc-veAceFbLsTdihNE21zm7qYAkDqXlE0q3Y7Zdg"
-	// azureTokenMI represents a token obtained by a ManagedIdentity from the Azure IMDS
-	// This type of token has a different resource id (specifically the resource type is Microsoft.ManagedIdentity/userAssignedIdentities)
-	azureTokenMI = "eyJhbGciOiJFUzI1NiIsImtpZCI6IjY2YjQxZjFlOTNmYTM5YTQzMjVkNmFhYmNlZGYwODJhZjg0NGZiMjJlZTk1NDAzYmVmOWQ0ZGNmMzcwYjcxMGUiLCJ0eXAiOiJKV1QifQ.eyJhcHBpZCI6InRoZS1hcHBpZCIsImFwcGlkYWNyIjoidGhlLWFwcGlkYWNyIiwiYXVkIjpbImh0dHBzOi8vbWFuYWdlbWVudC5henVyZS5jb20vIl0sImV4cCI6MTU1NzM0NTY1OCwiaWF0IjoxNTU3MzQ1MzU4LCJpZHAiOiJ0aGUtaWRwIiwiaXNzIjoiaHR0cHM6Ly9zdHMud2luZG93cy5uZXQvUDg3aEFXVUUwYy8iLCJqdGkiOiJ0aGUtanRpIiwibmJmIjoxNTU3MzQ1MzU4LCJvaWQiOiJ0aGUtb2lkIiwic3ViIjoic3ViamVjdCIsInRpZCI6IlA4N2hBV1VFMGMiLCJ2ZXIiOiJ0aGUtdmVyc2lvbiIsInhtc19taXJpZCI6Ii9zdWJzY3JpcHRpb25zL3N1YnNjcmlwdGlvbklEL3Jlc291cmNlR3JvdXBzL3Jlc291cmNlR3JvdXAvcHJvdmlkZXJzL01pY3Jvc29mdC5NYW5hZ2VkSWRlbnRpdHkvdXNlckFzc2lnbmVkSWRlbnRpdGllcy9tYW5hZ2VkSWRlbnRpdHlOYW1lIn0K.U_NdLMXLztkYEn0RXYD394SiR-QpaJ8eoRFBu0FYQJ6zDflc-veAceFbLsTdihNE21zm7qYAkDqXlE0q3Y7Zdg"
-	badToken     = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyeyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
+	badToken   = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyeyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
 )
 
 func TestParse(t *testing.T) {
@@ -243,24 +239,7 @@ func TestParseInsecure(t *testing.T) {
 			Azure: &AzurePayload{
 				SubscriptionID: "subscriptionID",
 				ResourceGroup:  "resourceGroup",
-				ResourceType:   "virtualMachines",
-				ResourceName:   "virtualMachine",
-			},
-		}, false},
-		{"ok Azure", args{azureTokenMI}, Payload{
-			Claims:           mustJoseClaims(azureToken),
-			AppID:            "the-appid",
-			AppIDAcr:         "the-appidacr",
-			IdentityProvider: "the-idp",
-			ObjectID:         "the-oid",
-			TenantID:         "P87hAWUE0c",
-			Version:          "the-version",
-			XMSMirID:         "/subscriptions/subscriptionID/resourceGroups/resourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/managedIdentityName",
-			Azure: &AzurePayload{
-				SubscriptionID: "subscriptionID",
-				ResourceGroup:  "resourceGroup",
-				ResourceType:   "userAssignedIdentities",
-				ResourceName:   "managedIdentityName",
+				VirtualMachine: "virtualMachine",
 			},
 		}, false},
 		{"fail bad token", args{"foobarzar"}, Payload{}, true},