Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updates to require recent version of Az PowerShell AAD cmdlets #479

Merged
merged 2 commits into from
Dec 20, 2022
Merged

Updates to require recent version of Az PowerShell AAD cmdlets #479

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
326a4ad
Updates to require recent version of Az PowerShell AAD cmdlets
JamesDawson Dec 19, 2022
ee8ca12
Fix securestring issue
JamesDawson Dec 20, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 7 additions & 15 deletions Solutions/Marain.Tenancy.Deployment/Marain-PreDeploy.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@ use it directly.)

#>

#Requires -Modules @{ ModuleName = "Az.Resources"; ModuleVersion = "5.4.0" }

# Marain.Instance expects us to define just this one function.
Function MarainDeployment([MarainServiceDeploymentContext] $ServiceDeploymentContext) {

Expand All @@ -35,11 +37,6 @@ Function MarainDeployment([MarainServiceDeploymentContext] $ServiceDeploymentCon
$tenantAdminSecretName = "DefaultTenantAdminPassword"
$defaultTenantAdminSpName = '{0}{1}tenantadmin' -f $ServiceDeploymentContext.InstanceContext.Prefix, $ServiceDeploymentContext.InstanceContext.EnvironmentSuffix

# Handle the breaking changes for versions of Azure PowerShell that use Microsoft Graph for its AAD interactions
# ref: https://docs.microsoft.com/en-us/powershell/azure/azps-msgraph-migration-changes
$appIdPropertyName = (Get-Module Az.Resources).Version.Major -ge 5 ? "AppId" : "ApplicationId"
$objectIdPropertyName = (Get-Module Az.Resources).Version.Major -ge 5 ? "Id" : "ObjectId"

# Ensure a default tenancy administrator principal is setup/available
if ($ServiceDeploymentContext.InstanceContext.AadAppIds.ContainsKey($defaultTenantAdminSpName)) {
# Use AadAppId provided on the command-line
Expand All @@ -49,24 +46,19 @@ Function MarainDeployment([MarainServiceDeploymentContext] $ServiceDeploymentCon
# look-up from AAD directly, if we have access
$existingSp = Get-AzADServicePrincipal -DisplayName $defaultTenantAdminSpName
if ($existingSp) {
$ServiceDeploymentContext.InstanceContext.TenantAdminAppId = $existingSp.$appIdPropertyName
$ServiceDeploymentContext.InstanceContext.TenantAdminAppId = $existingSp.AppId
}
else {
Write-Host "Creating default tenancy administrator service principal"
$newSpParams = @{
DisplayName = $defaultTenantAdminSpName
}
if ((Get-Module Az.Resources).Version.Major -lt 5) {
# Earlier versions of Azure PowerShell grant the 'Contributor' role by default, however, current versions
# do not and the 'SkipAssignment' switch has been removed (i.e. it is no longer valid)
# ref: https://docs.microsoft.com/en-us/powershell/azure/azps-msgraph-migration-changes
$newSpParams += @{ SkipAssignment = $true }
}
$newSp = New-AzADServicePrincipal @newSpParams

$ServiceDeploymentContext.InstanceContext.TenantAdminAppId = $newSp.$appIdPropertyName
$ServiceDeploymentContext.InstanceContext.TenantAdminObjectId = $newSp.$objectIdPropertyName
Set-AzKeyVaultSecret -VaultName $keyVaultName -Name $tenantAdminSecretName -SecretValue $newSp.SecretValue | Out-Null
$ServiceDeploymentContext.InstanceContext.TenantAdminAppId = $newSp.AppId
$ServiceDeploymentContext.InstanceContext.TenantAdminObjectId = $newSp.Id
$spSecret = ConvertTo-SecureString $newSp.PasswordCredentials[0].SecretText -AsPlainText
Set-AzKeyVaultSecret -VaultName $keyVaultName -Name $tenantAdminSecretName -SecretValue $spSecret | Out-Null
}
}
else {
Expand Down