Skip to content

Commit 164a302

Browse files
aremo-msaremo-ms
committed
reverting certificates CsharpConfigurations support, Automated Deply function
1 parent afc68bb commit 164a302

File tree

8 files changed

+219
-199
lines changed

8 files changed

+219
-199
lines changed

‎4-WebApp-your-API/4-1-MyOrg/AppCreationScripts-withCert/Cleanup.ps1

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
1+
22
[CmdletBinding()]
33
param(
44
[Parameter(Mandatory=$False, HelpMessage='Tenant ID (This is a GUID which represents the "Directory ID" of the AzureAD tenant into which you want to create the apps')]
@@ -103,7 +103,7 @@ Function Cleanup
103103
}
104104
# remove self-signed certificate
105105
Write-Host "Removing CN=TodoListClient-aspnetcore-webapi certificate from Cert:/CurrentUser/My"
106-
Get-ChildItem -Path Cert:/CurrentUser/My | where { $_.subject -eq "CN=TodoListClient-aspnetcore-webapi" } | Remove-Item
106+
Get-ChildItem -Path Cert:\CurrentUser\My | where { $_.subject -eq "CN=TodoListClient-aspnetcore-webapi" } | Remove-Item
107107
}
108108

109109
if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Applications")) {
@@ -117,4 +117,3 @@ Cleanup -tenantId $tenantId -environment $azureEnvironmentName
117117

118118
Write-Host "Disconnecting from tenant"
119119
Disconnect-MgGraph
120-

‎4-WebApp-your-API/4-1-MyOrg/AppCreationScripts-withCert/Configure.ps1

Lines changed: 62 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
1+

22
[CmdletBinding()]
33
param(
44
[Parameter(Mandatory=$False, HelpMessage='Tenant ID (This is a GUID which represents the "Directory ID" of the AzureAD tenant into which you want to create the apps')]
@@ -170,8 +170,6 @@ Function CreateOptionalClaim([string] $name)
170170

171171
Function ConfigureApplications
172172
{
173-
$isOpenSSl = 'N' #temporary disable open certificate creation
174-
175173
<#.Description
176174
This function creates the Azure AD applications for the sample in the provided Azure AD tenant and updates the
177175
configuration files in the client and service project of the visual studio solution (App.Config and Web.Config)
@@ -199,19 +197,19 @@ Function ConfigureApplications
199197

200198
# create the application
201199
$serviceAadApplication = New-MgApplication -DisplayName "TodoListService-aspnetcore-webapi" `
202-
-Web `
203-
@{ `
200+
-Web `
201+
@{ `
204202
HomePageUrl = "https://localhost:44351"; `
205-
} `
206-
-Api `
207-
@{ `
208-
RequestedAccessTokenVersion = 2 `
209-
} `
210-
-SignInAudience AzureADMyOrg `
203+
} `
204+
-Api `
205+
@{ `
206+
RequestedAccessTokenVersion = 2 `
207+
} `
208+
-SignInAudience AzureADMyOrg `
211209
#end of command
212210
$serviceIdentifierUri = 'api://'+$serviceAadApplication.AppId
213211
Update-MgApplication -ApplicationId $serviceAadApplication.Id -IdentifierUris @($serviceIdentifierUri)
214-
212+
215213
# create the service principal of the newly created application
216214
$currentAppId = $serviceAadApplication.AppId
217215
$serviceServicePrincipal = New-MgServicePrincipal -AppId $currentAppId -Tags {WindowsAzureActiveDirectoryIntegratedApp}
@@ -224,7 +222,6 @@ Function ConfigureApplications
224222
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($serviceServicePrincipal.DisplayName)'"
225223
}
226224

227-
228225
# Add Claims
229226

230227
$optionalClaims = New-Object Microsoft.Graph.PowerShell.Models.MicrosoftGraphOptionalClaims
@@ -254,16 +251,16 @@ Function ConfigureApplications
254251
$scopes = New-Object System.Collections.Generic.List[Microsoft.Graph.PowerShell.Models.MicrosoftGraphPermissionScope]
255252
$scope = $serviceAadApplication.Api.Oauth2PermissionScopes | Where-Object { $_.Value -eq "User_impersonation" }
256253

257-
if($scope -ne $null)
258-
{
259-
# disable the scope
260-
$scope.IsEnabled = $false
261-
$scopes.Add($scope)
262-
Update-MgApplication -ApplicationId $serviceAadApplication.Id -Api @{Oauth2PermissionScopes = @($scopes)}
263-
264-
# clear the scope
265-
Update-MgApplication -ApplicationId $serviceAadApplication.Id -Api @{Oauth2PermissionScopes = @()}
266-
}
254+
if($scope -ne $null)
255+
{
256+
# disable the scope
257+
$scope.IsEnabled = $false
258+
$scopes.Add($scope)
259+
Update-MgApplication -ApplicationId $serviceAadApplication.Id -Api @{Oauth2PermissionScopes = @($scopes)}
260+
261+
# clear the scope
262+
Update-MgApplication -ApplicationId $serviceAadApplication.Id -Api @{Oauth2PermissionScopes = @()}
263+
}
267264

268265
$scopes = New-Object System.Collections.Generic.List[Microsoft.Graph.PowerShell.Models.MicrosoftGraphPermissionScope]
269266
$scope = CreateScope -value ToDoList.Read `
@@ -283,7 +280,6 @@ Function ConfigureApplications
283280

284281
# add/update scopes
285282
Update-MgApplication -ApplicationId $serviceAadApplication.Id -Api @{Oauth2PermissionScopes = @($scopes)}
286-
287283
Write-Host "Done creating the service application (TodoListService-aspnetcore-webapi)"
288284

289285
# URL of the AAD application in the Azure portal
@@ -293,61 +289,60 @@ Function ConfigureApplications
293289

294290
# Create the client AAD application
295291
Write-Host "Creating the AAD application (TodoListClient-aspnetcore-webapi)"
296-
# Get a 6 months application key for the client Application
297-
$fromDate = [DateTime]::Now;
298-
$key = CreateAppKey -fromDate $fromDate -durationInMonths 6
292+
# Get a 6 months application key for the client Application
293+
$fromDate = [DateTime]::Now;
294+
$key = CreateAppKey -fromDate $fromDate -durationInMonths 6
295+
299296

300297
# create the application
301298
$clientAadApplication = New-MgApplication -DisplayName "TodoListClient-aspnetcore-webapi" `
302-
-Web `
303-
@{ `
299+
-Web `
300+
@{ `
304301
RedirectUris = "https://localhost:44321/signin-oidc"; `
305302
HomePageUrl = "https://localhost:44321/"; `
306303
LogoutUrl = "https://localhost:44321/signout-oidc"; `
307-
} `
308-
-SignInAudience AzureADMyOrg `
304+
} `
305+
-SignInAudience AzureADMyOrg `
309306
#end of command
310307
#add a secret to the application
311308
$pwdCredential = Add-MgApplicationPassword -ApplicationId $clientAadApplication.Id -PasswordCredential $key
312309
$clientAppKey = $pwdCredential.SecretText
313310

314311
$tenantName = (Get-MgApplication -ApplicationId $clientAadApplication.Id).PublisherDomain
315312
Update-MgApplication -ApplicationId $clientAadApplication.Id -IdentifierUris @("https://$tenantName/TodoListClient-aspnetcore-webapi")
316-
# generate required certificates for the App registration
317-
318-
Write-Host "Creating the CN=TodoListClient-aspnetcore-webapi certificate for application (TodoListClient-aspnetcore-webapi)"
313+
# Generate a certificate
314+
Write-Host "Creating the client application (TodoListClient-aspnetcore-webapi)"
319315

320-
$certificateName = 'CN=TodoListClient-aspnetcore-webapi' #name of format CN=<Cert Name> as specified in sample.json
321-
$certificateName = $certificateName.Split("=")[1]; #take the name only
322-
323-
# temporarily disable the option and procees to certificate creation
324-
#$isOpenSSL = Read-Host ' By default certificate is generated using New-SelfSignedCertificate. Do you want to generate cert using OpenSSL(Y/N)?'
325-
if($isOpenSSL -eq 'Y')
326-
{
327-
$certificate=openssl req -x509 -newkey rsa:2048 -days 365 -keyout "$certificateName.key" -out "$certificateName.cer" -subj "/CN=$certificateName.com" -nodes
328-
openssl pkcs12 -export -out "$certificateName.pfx" -inkey $certificateName.key -in "$certificateName.cer"
329-
}
330-
else
331-
{
332-
$certificate=New-SelfSignedCertificate -Subject $certificateName `
333-
-CertStoreLocation "Cert:/CurrentUser/My" `
334-
-KeyExportPolicy Exportable `
335-
-KeySpec Signature
336-
337-
$thumbprint = $certificate.Thumbprint
338-
$certificatePassword = Read-Host -Prompt "Enter password for your certificate (Please remember the password, you will need it when uploading to KeyVault): " -AsSecureString
339-
Write-Host "Exporting certificate as a PFX file"
340-
Export-PfxCertificate -Cert "Cert:/CurrentUser/My/$thumbprint" -FilePath "$pwd\$certificateName.pfx" -ChainOption EndEntityCertOnly -NoProperties -Password $certificatePassword
341-
Write-Host "PFX written to:"
342-
Write-Host "$pwd\$certificateName.pfx"
343-
344-
# Add a Azure Key Credentials from the certificate for the application
345-
$clientKeyCredentials = Update-MgApplication -ApplicationId $clientAadApplication.Id `
346-
-KeyCredentials @(@{Type = "AsymmetricX509Cert"; Usage = "Verify"; Key= $certificate.RawData; StartDateTime = $certificate.NotBefore; EndDateTime = $certificate.NotAfter;})
347-
}
316+
$certificateName = 'TodoListClient-aspnetcore-webapi'
348317

318+
# temporarily disable the option and procees to certificate creation
319+
#$isOpenSSL = Read-Host ' By default certificate is generated using New-SelfSignedCertificate. Do you want to generate cert using OpenSSL(Y/N)?'
320+
$isOpenSSl = 'N'
321+
if($isOpenSSL -eq 'Y')
322+
{
323+
$certificate=openssl req -x509 -newkey rsa:2048 -days 365 -keyout "$certificateName.key" -out "$certificateName.cer" -subj "/CN=$certificateName.com" -nodes
324+
openssl pkcs12 -export -out "$certificateName.pfx" -inkey $certificateName.key -in "$certificateName.cer"
325+
}
326+
else
327+
{
328+
$certificate=New-SelfSignedCertificate -Subject $certificateName `
329+
-CertStoreLocation "Cert:\CurrentUser\My" `
330+
-KeyExportPolicy Exportable `
331+
-KeySpec Signature
332+
333+
$thumbprint = $certificate.Thumbprint
334+
$certificatePassword = Read-Host -Prompt "Enter password for your certificate (Please remember the password, you will need it when uploading to KeyVault): " -AsSecureString
335+
Write-Host "Exporting certificate as a PFX file"
336+
Export-PfxCertificate -Cert "Cert:\Currentuser\My\$thumbprint" -FilePath "$pwd\$certificateName.pfx" -ChainOption EndEntityCertOnly -NoProperties -Password $certificatePassword
337+
Write-Host "PFX written to:"
338+
Write-Host "$pwd\$certificateName.pfx"
339+
340+
# Add a Azure Key Credentials from the certificate for the application
341+
$clientKeyCredentials = Update-MgApplication -ApplicationId $clientAadApplication.Id `
342+
-KeyCredentials @(@{Type = "AsymmetricX509Cert"; Usage = "Verify"; Key= $certificate.RawData; StartDateTime = $certificate.NotBefore; EndDateTime = $certificate.NotAfter;})
343+
344+
}
349345

350-
351346
# create the service principal of the newly created application
352347
$currentAppId = $clientAadApplication.AppId
353348
$clientServicePrincipal = New-MgServicePrincipal -AppId $currentAppId -Tags {WindowsAzureActiveDirectoryIntegratedApp}
@@ -359,8 +354,6 @@ Function ConfigureApplications
359354
New-MgApplicationOwnerByRef -ApplicationId $clientAadApplication.Id -BodyParameter = @{"@odata.id" = "htps://graph.microsoft.com/v1.0/directoryObjects/$user.ObjectId"}
360355
Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($clientServicePrincipal.DisplayName)'"
361356
}
362-
363-
364357
Write-Host "Done creating the client application (TodoListClient-aspnetcore-webapi)"
365358

366359
# URL of the AAD application in the Azure portal
@@ -374,20 +367,23 @@ Function ConfigureApplications
374367
$requiredPermissions = GetRequiredPermissions -applicationDisplayName "TodoListService-aspnetcore-webapi" `
375368
-requiredDelegatedPermissions "ToDoList.Read|ToDoList.ReadWrite" `
376369

370+
377371
$requiredResourcesAccess.Add($requiredPermissions)
378372
Update-MgApplication -ApplicationId $clientAadApplication.Id -RequiredResourceAccess $requiredResourcesAccess
379373
Write-Host "Granted permissions."
380374

381375
# Update config file for 'service'
382376
$configFile = $pwd.Path + "\..\TodoListService\appsettings.json"
383377
$dictionary = @{ "Domain" = $tenantName;"TenantId" = $tenantId;"ClientId" = $serviceAadApplication.AppId };
378+
384379
Write-Host "Updating the sample code ($configFile)"
385380

386381
UpdateTextFile -configFilePath $configFile -dictionary $dictionary
387382

388383
# Update config file for 'client'
389384
$configFile = $pwd.Path + "\..\Client\appsettings.json"
390385
$dictionary = @{ "Domain" = $tenantName;"TenantId" = $tenantId;"ClientId" = $clientAadApplication.AppId;"KeyVaultCertificateName" = $certificateName;"TodoListScopes" = "api://$($serviceAadApplication.AppId)/ToDoList.Read api://$($serviceAadApplication.AppId)/ToDoList.ReadWrite";"TodoListBaseAddress" = $serviceAadApplication.Web.HomePageUrl };
386+
391387
Write-Host "Updating the sample code ($configFile)"
392388

393389
UpdateTextFile -configFilePath $configFile -dictionary $dictionary
@@ -397,8 +393,7 @@ Function ConfigureApplications
397393
Write-Host " - Navigate to $servicePortalUrl"
398394
Write-Host " - Application 'service' publishes application permissions. Do remember to navigate to any client app(s) registration in the app portal and consent for those, if required" -ForegroundColor Red
399395
Write-Host -ForegroundColor Green "------------------------------------------------------------------------------------------------"
400-
401-
if($isOpenSSL -eq 'Y')
396+
if($isOpenSSL -eq 'Y')
402397
{
403398
Write-Host -ForegroundColor Green "------------------------------------------------------------------------------------------------"
404399
Write-Host "You have generated certificate using OpenSSL so follow below steps: "

‎4-WebApp-your-API/4-1-MyOrg/AppCreationScripts-withCert/sample.json

Lines changed: 2 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@
6565

6666
/* It either can be a text or link to another readme file */
6767
"ReadmeAzureDeploy": {
68-
"IncludeFilePath": "../ReadmeFiles/ReadmeAzureDeploy.md"
68+
"IncludeFilePath": ""
6969
},
7070

7171
/* It either can be a text or link to another readme file */
@@ -125,23 +125,7 @@
125125
"DelegatedPermissions": [ "ToDoList.Read", "ToDoList.ReadWrite" ]
126126
}
127127
],
128-
"Certificate":"",
129-
"CustomersConfigurations": [
130-
{
131-
"AppSettingsJson": {
132-
"AzureAd": {
133-
"ClientCertificates": [
134-
{
135-
"SourceType": "StoreWithDistinguishedName",
136-
"CertificateStorePath": "CurrentUser/My",
137-
"CertificateDistinguishedName": "CN=TodoListClient-aspnetcore-webapi"
138-
}
139-
]
140-
}
141-
}
142-
}
143-
],
144-
128+
"Certificate":"the name will be assigned automatically by PowerShell script and it will be equal to the Application name",
145129
"ManualSteps": [],
146130
"Sample": {
147131
"SampleSubPath": "4-WebApp-Your-API\\4-1-MyOrg",

‎4-WebApp-your-API/4-1-MyOrg/AppCreationScripts/Cleanup.ps1

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
1+
22
[CmdletBinding()]
33
param(
44
[Parameter(Mandatory=$False, HelpMessage='Tenant ID (This is a GUID which represents the "Directory ID" of the AzureAD tenant into which you want to create the apps')]
@@ -114,4 +114,3 @@ Cleanup -tenantId $tenantId -environment $azureEnvironmentName
114114

115115
Write-Host "Disconnecting from tenant"
116116
Disconnect-MgGraph
117-

0 commit comments

Comments
 (0)