|
| 1 | +#!/usr/bin/env bash |
| 2 | +# Assigns the Gateway.Access app role to the managed identity of each Arc-enabled server |
| 3 | +# in the environment, allowing the gateway to authenticate against the web API. |
| 4 | +# |
| 5 | +# This is intentionally a manual script rather than automated via Terraform because the |
| 6 | +# pipeline managed identity (mi-manbrs-<env>-adotoaz-uks) lacks the AppRoleAssignment.ReadWrite.All |
| 7 | +# Graph application permission required to create app role assignments. In the delegated auth |
| 8 | +# context (user running this script), ownership of the service principal is sufficient. |
| 9 | +# |
| 10 | +# Run this script after onboarding new Arc-enabled servers to assign the Gateway.Access role |
| 11 | +# to their managed identities. |
| 12 | +# |
| 13 | +# Usage: ./scripts/bash/assign_arc_app_roles.sh <env> <subscription> |
| 14 | +# Example: ./scripts/bash/assign_arc_app_roles.sh review "Breast Screening - Manage Breast Screening - Dev" |
| 15 | +set -eu |
| 16 | + |
| 17 | +ENV_CONFIG="$1" |
| 18 | +SUBSCRIPTION="$2" |
| 19 | + |
| 20 | +enterpriseAppName="spn-manbrs-web-api-${ENV_CONFIG}" |
| 21 | +rgName="rg-mbsgw-${ENV_CONFIG}-uks-arc-enabled-servers" |
| 22 | +appRoleValue="Gateway.Access" |
| 23 | + |
| 24 | +az extension add --name connectedmachine --allow-preview true --yes 2>/dev/null || true |
| 25 | + |
| 26 | +echo "Fetching enterprise app details for: $enterpriseAppName" |
| 27 | +spObjectId=$(az ad sp list --filter "displayName eq '${enterpriseAppName}'" --query "[0].id" -o tsv) |
| 28 | +appRoleId=$(az ad sp list --filter "displayName eq '${enterpriseAppName}'" --query "[0].appRoles[?value=='${appRoleValue}'].id | [0]" -o tsv) |
| 29 | + |
| 30 | +if [ -z "$spObjectId" ]; then |
| 31 | + echo "Error: Enterprise app '$enterpriseAppName' not found" |
| 32 | + exit 1 |
| 33 | +fi |
| 34 | + |
| 35 | +echo "SP object ID: $spObjectId" |
| 36 | +echo "App role ($appRoleValue): $appRoleId" |
| 37 | + |
| 38 | +echo "Listing Arc machines in: $rgName" |
| 39 | +arcMachines=$(az connectedmachine list --resource-group "$rgName" --subscription "$SUBSCRIPTION" --query "[].name" -o tsv) |
| 40 | + |
| 41 | +if [ -z "$arcMachines" ]; then |
| 42 | + echo "No Arc machines found in $rgName" |
| 43 | + exit 0 |
| 44 | +fi |
| 45 | + |
| 46 | +while IFS= read -r machine; do |
| 47 | + [ -z "$machine" ] && continue |
| 48 | + |
| 49 | + miPrincipalId=$(az connectedmachine show \ |
| 50 | + --resource-group "$rgName" \ |
| 51 | + --name "$machine" \ |
| 52 | + --subscription "$SUBSCRIPTION" \ |
| 53 | + --query "identity.principalId" -o tsv) |
| 54 | + |
| 55 | + if [ -z "$miPrincipalId" ]; then |
| 56 | + echo " Warning: $machine has no managed identity principal ID, skipping." |
| 57 | + continue |
| 58 | + fi |
| 59 | + |
| 60 | + echo "Assigning $appRoleValue to $machine (MI: $miPrincipalId)..." |
| 61 | + if ! output=$(az rest --method POST \ |
| 62 | + --uri "https://graph.microsoft.com/v1.0/servicePrincipals/${spObjectId}/appRoleAssignedTo" \ |
| 63 | + --headers "Content-Type=application/json" \ |
| 64 | + --body "{\"principalId\": \"${miPrincipalId}\", \"resourceId\": \"${spObjectId}\", \"appRoleId\": \"${appRoleId}\"}" 2>&1); then |
| 65 | + if echo "$output" | grep -q "Permission being assigned already exists"; then |
| 66 | + echo " Already assigned, skipping." |
| 67 | + else |
| 68 | + echo "Error: $output" |
| 69 | + exit 1 |
| 70 | + fi |
| 71 | + else |
| 72 | + echo " Successfully assigned." |
| 73 | + fi |
| 74 | +done <<< "$arcMachines" |
| 75 | + |
| 76 | +echo "Done." |
0 commit comments