Skip to content

Commit 6d73072

Browse files
igorseigorse
authored
Merge pull request #86 from shriramnat/master
Identity Module
2 parents ea6b284 + 606ea34 commit 6d73072

2 files changed

Lines changed: 155 additions & 0 deletions

File tree

‎Identity/AzureStack.Identity.psm1‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
# Copyright (c) Microsoft Corporation. All rights reserved.
2+
# See LICENSE.txt in the project root for license information.
3+
4+
<#
5+
.Synopsis
6+
Get the Guid of the directory tenant
7+
.DESCRIPTION
8+
This function fetches the OpenID configuration metadata from the identity system and parses the Directory TenantID out of it.
9+
Azure Stack AD FS is configured to be a single tenanted identity system with a TenantID.
10+
.EXAMPLE
11+
Get-DirectoryTenantIdentifier -authority https://login.windows.net/microsoft.onmicrosoft.com
12+
.EXAMPLE
13+
Get-DirectoryTenantIdentifier -authority https://adfs.local.azurestack.external/adfs
14+
#>
15+
function Get-DirectoryTenantIdentifier
16+
{
17+
[CmdletBinding()]
18+
Param
19+
(
20+
# Param1 help description
21+
[Parameter(Mandatory=$true,
22+
Position=0)]
23+
$Authority
24+
)
25+
26+
return $(Invoke-RestMethod $("{0}/.well-known/openid-configuration" -f $authority.TrimEnd('/'))).issuer.TrimEnd('/').Split('/')[-1]
27+
}
28+
29+
<#
30+
.Synopsis
31+
This function is used to create a Service Principal on teh AD Graph
32+
.DESCRIPTION
33+
The command creates a certificate in the cert store of the local user and uses that certificate to create a Service Principal in the Azure Stack Stamp Active Directory.
34+
.EXAMPLE
35+
$servicePrincipal = New-ADGraphServicePrincipal -DisplayName "mySPApp" -AdminCredential $(Get-Credential) -Verbose
36+
.EXAMPLE
37+
$servicePrincipal = New-ADGraphServicePrincipal -DisplayName "mySPApp" -AdminCredential $(Get-Credential) -DeleteAndCreateNew -Verbose
38+
#>
39+
function New-ADGraphServicePrincipal
40+
{
41+
[CmdletBinding()]
42+
Param
43+
(
44+
# Display Name of the Service Principal
45+
[Parameter(Mandatory=$true,
46+
Position=0)]
47+
[ValidatePattern(“[a-zA-Z0-9-]{3,}”)]
48+
$DisplayName,
49+
50+
# Adfs Machine name
51+
[Parameter(Mandatory=$false,
52+
Position=1)]
53+
[string]
54+
$AdfsMachineName = "mas-adfs01.azurestack.local",
55+
56+
# Domain Administrator Credential to create Service Principal
57+
[Parameter(Mandatory=$true,
58+
Position=2)]
59+
[System.Management.Automation.PSCredential]
60+
$AdminCredential,
61+
62+
# Switch to delete existing Service Principal with Provided Display Name and recreate
63+
[Parameter(Mandatory=$false)]
64+
[switch]
65+
$DeleteAndCreateNew
66+
)
67+
Write-Verbose "Creating a Certificate for the Service Principal.."
68+
$clientCertificate = New-SelfSignedCertificate -CertStoreLocation "cert:\CurrentUser\My" -Subject "CN=$DisplayName" -KeySpec KeyExchange
69+
$scriptBlock = {
70+
param ([string] $DisplayName, [System.Security.Cryptography.X509Certificates.X509Certificate2] $ClientCertificate, [bool] $DeleteAndCreateNew)
71+
$VerbosePreference="Continue"
72+
$ErrorActionPreference = "stop"
73+
74+
Import-Module 'ActiveDirectory' -Verbose:$false 4> $null
75+
76+
# Application Group Name
77+
$applicationGroupName = $DisplayName+"-AppGroup"
78+
$applicationGroupDescription = "Application group for $DisplayName"
79+
$shellSiteDisplayName = $DisplayName
80+
$shellSiteRedirectUri = "https://localhost/".ToLowerInvariant()
81+
$shellSiteApplicationId = [guid]::NewGuid().ToString()
82+
$shellSiteClientDescription = "Client for $DisplayName"
83+
$defaultTimeOut = New-TimeSpan -Minutes 5
84+
85+
if($DeleteAndCreateNew)
86+
{
87+
$applicationGroup = Get-GraphApplicationGroup -ApplicationGroupName $applicationGroupName -Timeout $defaultTimeOut
88+
Write-Verbose $applicationGroup
89+
if ($applicationGroup)
90+
{
91+
Write-Warning -Message "Deleting existing application group with name '$applicationGroupName'."
92+
Remove-GraphApplicationGroup -TargetApplicationGroup $applicationGroup -Timeout $defaultTimeOut
93+
}
94+
}
95+
96+
Write-Verbose -Message "Creating new application group with name '$applicationGroupName'."
97+
$applicationParameters = @{
98+
Name = $applicationGroupName
99+
Description = $applicationGroupDescription
100+
ClientType = 'Confidential'
101+
ClientId = $shellSiteApplicationId
102+
ClientDisplayName = $shellSiteDisplayName
103+
ClientRedirectUris = $shellSiteRedirectUri
104+
ClientDescription = $shellSiteClientDescription
105+
ClientCertificates = $ClientCertificate
106+
}
107+
$defaultTimeOut = New-TimeSpan -Minutes 10
108+
$applicationGroup = New-GraphApplicationGroup @applicationParameters -PassThru -Timeout $defaultTimeOut
109+
110+
Write-Verbose -Message "Shell Site ApplicationGroup: $($applicationGroup | ConvertTo-Json)"
111+
return [pscustomobject]@{
112+
ObjectId = $applicationGroup.Identifier
113+
ApplicationId = $applicationParameters.ClientId
114+
Thumbprint = $ClientCertificate.Thumbprint
115+
}
116+
}
117+
$domainAdminSession = New-PSSession -ComputerName $AdfsMachineName -Credential $AdminCredential -Authentication Credssp -Verbose
118+
$output = Invoke-Command -Session $domainAdminSession -ScriptBlock $scriptBlock -ArgumentList @($DisplayName, $ClientCertificate, $DeleteAndCreateNew.IsPresent) -Verbose -ErrorAction Stop
119+
Write-Verbose "AppDetails: $(ConvertTo-Json $output -Depth 2)"
120+
return $output
121+
}

‎Identity/README.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Azure Stack Identity
2+
3+
```powershell
4+
Install-Module -Name AzureRM -RequiredVersion 1.2.8 -Scope CurrentUser
5+
Install-Module -Name AzureStack
6+
```
7+
Then make sure the following modules are imported:
8+
9+
```powershell
10+
Import-Module ..\Connect\AzureStack.Connect.psm1
11+
Import-Module .\AzureStack.Identity.psm1
12+
```
13+
## Getting the directory tenant identifier from the Identity System
14+
15+
This function is used to get the Directory Tenant Guid. This method works for both AAD and AD FS.
16+
17+
```powershell
18+
$directoryTenantId = Get-DirectoryTenantIdentifier -Authority "<DirectoryTenantUrl>"
19+
```
20+
An example of an authority for AAD is `https://login.windows.net/microsoft.onmicrosoft.com`
21+
and for AD FS is `https://adfs.local.azurestack.global/adfs`.
22+
23+
## Creating a Service Principal in a disconnected (AD FS) topology
24+
You can create a Service Principal by executing the following command after importing the Identity module
25+
26+
```powershell
27+
$servicePrincipal = New-ADGraphServicePrincipal -DisplayName "<YourServicePrincipalName>" -AdminCredential $(Get-Credential) -Verbose
28+
```
29+
30+
After the Service Principal is created, you should open your Azure Stack Portal to provide the appropriate level of RBAC to it. You can do this from the Access Control (IAM) tab of any resource. After the RBAC is given, you can login using the service principal as follows:
31+
32+
```powershell
33+
Add-AzureRmAccount -EnvironmentName "<AzureStackEnvironmentName>" -ServicePrincipal -CertificateThumbprint $servicePrincipal.Thumbprint -ApplicationId $servicePrincipal.ApplicationId -TenantId $directoryTenantId
34+
```

0 commit comments

Comments
 (0)