Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

106893 - fix to avoid using plain text in powershell script #3907

Merged
merged 1 commit into from
Oct 7, 2024
Merged

106893 - fix to avoid using plain text in powershell script #3907

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions build/jobs/add-aad-test-environment.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,8 @@ steps:
ScriptType: inlineScript
Inline: |
Install-Module -Name AzureAD -Force -Verbose -Scope CurrentUser
Install-Module -Name Microsoft.PowerShell.SecretManagement -Force -Verbose -Scope CurrentUser

$module = Get-Module -Name AzureAD
Write-Host $module.version

Expand Down
6 changes: 4 additions & 2 deletions release/scripts/PowerShell/FhirServerRelease/Private/Set-FhirServerApiUsers.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,8 @@ function Set-FhirServerApiUsers {

Add-Type -AssemblyName System.Web
$password = [System.Web.Security.Membership]::GeneratePassword(16, 5)
$passwordSecureString = ConvertTo-SecureString $password -AsPlainText -Force
Set-Secret -Name passwordSecure -Secret $password
$passwordSecureString = Get-Secret -Name passwordSecure

if ($aadUser) {
Set-AzureADUserPassword -ObjectId $aadUser.ObjectId -Password $passwordSecureString -EnforceChangePasswordPolicy $false -ForceChangePasswordNextLogin $false
Expand All @@ -77,7 +78,8 @@ function Set-FhirServerApiUsers {
$aadUser = New-AzureADUser -DisplayName $userId -PasswordProfile $PasswordProfile -UserPrincipalName $userUpn -AccountEnabled $true -MailNickName $userId
}

$upnSecureString = ConvertTo-SecureString -string $userUpn -AsPlainText -Force
Set-Secret -Name upnSecure -Secret $userUpn
$upnSecureString = Get-Secret -Name upnSecure
Set-AzKeyVaultSecret -VaultName $KeyVaultName -Name "user--$($user.id)--id" -SecretValue $upnSecureString | Out-Null
Set-AzKeyVaultSecret -VaultName $KeyVaultName -Name "user--$($user.id)--secret" -SecretValue $passwordSecureString | Out-Null

Expand Down
22 changes: 19 additions & 3 deletions release/scripts/PowerShell/FhirServerRelease/Public/Add-AadTestAuthEnvironment.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,19 @@ function Add-AadTestAuthEnvironment {

$keyVaultResourceId = (Get-AzKeyVault -VaultName $KeyVaultName -ResourceGroupName $ResourceGroupName).ResourceId

$parameters = @{
Name = 'AzureVault'
ModuleName = 'Az.KeyVault'
VaultParameters = @{
AZKVaultName = $KeyVaultName
SubscriptionId = (Get-AzContext).Subscription.Id
}
DefaultVault = $true
}

# Register the vault to store the secret values
Register-SecretVault @parameters

Write-Host "Setting permissions on keyvault for current context"
if ($azContext.Account.Type -eq "User") {
Write-Host "Current context is user: $($azContext.Account.Id)"
Expand Down Expand Up @@ -160,14 +173,16 @@ function Add-AadTestAuthEnvironment {

$aadClientApplication = New-FhirServerClientApplicationRegistration -ApiAppId $application.AppId -DisplayName "$displayName" -PublicClient:$publicClient

$secretSecureString = ConvertTo-SecureString $aadClientApplication.AppSecret -AsPlainText -Force
Set-Secret -Name secretSecure -Secret $aadClientApplication.AppSecret
$secretSecureString = Get-Secret -Name secretSecure

}
else {
$existingPassword = Get-AzureADApplicationPasswordCredential -ObjectId $aadClientApplication.ObjectId | Remove-AzureADApplicationPasswordCredential -ObjectId $aadClientApplication.ObjectId
$newPassword = New-AzureADApplicationPasswordCredential -ObjectId $aadClientApplication.ObjectId

$secretSecureString = ConvertTo-SecureString $newPassword.Value -AsPlainText -Force
Set-Secret -Name secretSecure -Secret $newPassword.Value
$secretSecureString = Get-Secret -Name secretSecure
}

if ($publicClient) {
Expand All @@ -183,7 +198,8 @@ function Add-AadTestAuthEnvironment {
appId = $aadClientApplication.AppId
}

$appIdSecureString = ConvertTo-SecureString -String $aadClientApplication.AppId -AsPlainText -Force
Set-Secret -Name appIdSecure -Secret $aadClientApplication.AppId
$appIdSecureString = Get-Secret -Name appIdSecure
Set-AzKeyVaultSecret -VaultName $KeyVaultName -Name "app--$($clientApp.Id)--id" -SecretValue $appIdSecureString | Out-Null
Set-AzKeyVaultSecret -VaultName $KeyVaultName -Name "app--$($clientApp.Id)--secret" -SecretValue $secretSecureString | Out-Null

Expand Down
Loading