Skip to content

Commit ab5127c

Browse files
author
Felix Zieger
committed
feat: sso app registration
1 parent f6f9df1 commit ab5127c

File tree

8 files changed

+126
-5
lines changed

8 files changed

+126
-5
lines changed

‎TERRAFORM_DOCS.md

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@
1010

1111
| Name | Version |
1212
|------|---------|
13-
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 2.12.0 |
13+
| <a name="provider_azuread"></a> [azuread](#provider\_azuread) | 2.18.0 |
14+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 2.97.0 |
1415

1516
## Modules
1617

@@ -25,6 +26,7 @@
2526

2627
| Name | Type |
2728
|------|------|
29+
| [azuread_client_config.current](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/data-sources/client_config) | data source |
2830
| [azurerm_management_group.root](https://registry.terraform.io/providers/hashicorp/azurerm/2.97.0/docs/data-sources/management_group) | data source |
2931

3032
## Inputs
@@ -44,6 +46,7 @@
4446

4547
| Name | Description |
4648
|------|-------------|
49+
| <a name="output_azure_ad_tenant_id"></a> [azure\_ad\_tenant\_id](#output\_azure\_ad\_tenant\_id) | The Azure AD tenant id. |
4750
| <a name="output_idp_lookup_spp"></a> [idp\_lookup\_spp](#output\_idp\_lookup\_spp) | IDP Lookup Service Principal. |
4851
| <a name="output_idp_lookup_spp_password"></a> [idp\_lookup\_spp\_password](#output\_idp\_lookup\_spp\_password) | Password for IDP Lookup Service Principal. |
4952
| <a name="output_kraken_spp"></a> [kraken\_spp](#output\_kraken\_spp) | Kraken Service Principal. |

‎modules/meshcloud-idp-lookup-spp/README.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,20 +20,22 @@ No modules.
2020

2121
| Name | Type |
2222
|------|------|
23+
| [azuread_app_role_assignment.meshcloud_idp_lookup](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/resources/app_role_assignment) | resource |
2324
| [azuread_application.meshcloud_idp_lookup](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/resources/application) | resource |
2425
| [azuread_service_principal.meshcloud_idp_lookup](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/resources/service_principal) | resource |
26+
| [azuread_service_principal.msgraph](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/resources/service_principal) | resource |
2527
| [azuread_service_principal_password.spp_pw](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/resources/service_principal_password) | resource |
28+
| [azuread_application_published_app_ids.well_known](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/data-sources/application_published_app_ids) | data source |
2629

2730
## Inputs
2831

2932
| Name | Description | Type | Default | Required |
3033
|------|-------------|------|---------|:--------:|
31-
| <a name="input_scope"></a> [scope](#input\_scope) | The scope to which SPP permissions should be assigned to. Usually this is a management group that sits atop the subscriptions. | `string` | n/a | yes |
3234
| <a name="input_spp_name_suffix"></a> [spp\_name\_suffix](#input\_spp\_name\_suffix) | Service principal name suffix. | `string` | n/a | yes |
3335

3436
## Outputs
3537

3638
| Name | Description |
3739
|------|-------------|
38-
| <a name="output_service_principal"></a> [service\_principal](#output\_service\_principal) | n/a |
40+
| <a name="output_service_principal"></a> [service\_principal](#output\_service\_principal) | Service Principal application id and object id |
3941
| <a name="output_service_principal_password"></a> [service\_principal\_password](#output\_service\_principal\_password) | Password for the Service Principal. |

‎modules/meshcloud-kraken-spp/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,5 +39,5 @@ No modules.
3939

4040
| Name | Description |
4141
|------|-------------|
42-
| <a name="output_service_principal"></a> [service\_principal](#output\_service\_principal) | n/a |
42+
| <a name="output_service_principal"></a> [service\_principal](#output\_service\_principal) | Service Principal application id and object id |
4343
| <a name="output_service_principal_password"></a> [service\_principal\_password](#output\_service\_principal\_password) | Password for the Service Principal. |

‎modules/meshcloud-replicator-spp/README.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,16 @@ No modules.
2121

2222
| Name | Type |
2323
|------|------|
24+
| [azuread_app_role_assignment.meshcloud_replicator-directory](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/resources/app_role_assignment) | resource |
25+
| [azuread_app_role_assignment.meshcloud_replicator-group](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/resources/app_role_assignment) | resource |
26+
| [azuread_app_role_assignment.meshcloud_replicator-user](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/resources/app_role_assignment) | resource |
2427
| [azuread_application.meshcloud_replicator](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/resources/application) | resource |
2528
| [azuread_service_principal.meshcloud_replicator](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/resources/service_principal) | resource |
29+
| [azuread_service_principal.msgraph](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/resources/service_principal) | resource |
2630
| [azuread_service_principal_password.spp_pw](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/resources/service_principal_password) | resource |
2731
| [azurerm_role_assignment.meshcloud_replicator](https://registry.terraform.io/providers/hashicorp/azurerm/2.97.0/docs/resources/role_assignment) | resource |
2832
| [azurerm_role_definition.meshcloud_replicator](https://registry.terraform.io/providers/hashicorp/azurerm/2.97.0/docs/resources/role_definition) | resource |
33+
| [azuread_application_published_app_ids.well_known](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/data-sources/application_published_app_ids) | data source |
2934

3035
## Inputs
3136

@@ -40,5 +45,5 @@ No modules.
4045

4146
| Name | Description |
4247
|------|-------------|
43-
| <a name="output_service_principal"></a> [service\_principal](#output\_service\_principal) | n/a |
48+
| <a name="output_service_principal"></a> [service\_principal](#output\_service\_principal) | Service Principal application id and object id |
4449
| <a name="output_service_principal_password"></a> [service\_principal\_password](#output\_service\_principal\_password) | Password for the Service Principal. |

‎modules/meshcloud-sso/README.md

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
## Requirements
2+
3+
| Name | Version |
4+
|------|---------|
5+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
6+
| <a name="requirement_azuread"></a> [azuread](#requirement\_azuread) | 2.18.0 |
7+
| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | 2.97.0 |
8+
9+
## Providers
10+
11+
| Name | Version |
12+
|------|---------|
13+
| <a name="provider_azuread"></a> [azuread](#provider\_azuread) | 2.18.0 |
14+
15+
## Modules
16+
17+
No modules.
18+
19+
## Resources
20+
21+
| Name | Type |
22+
|------|------|
23+
| [azuread_application.meshcloud_sso](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/resources/application) | resource |
24+
| [azuread_application_password.meshcloud_sso](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/resources/application_password) | resource |
25+
| [azuread_service_principal.msgraph](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/resources/service_principal) | resource |
26+
| [azuread_application_published_app_ids.well_known](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/data-sources/application_published_app_ids) | data source |
27+
28+
## Inputs
29+
30+
| Name | Description | Type | Default | Required |
31+
|------|-------------|------|---------|:--------:|
32+
| <a name="input_meshstack_redirect_uri"></a> [meshstack\_redirect\_uri](#input\_meshstack\_redirect\_uri) | Redirect URI that will be provided by meshcloud. It is individual per meshStack. | `string` | n/a | yes |
33+
| <a name="input_spp_name_suffix"></a> [spp\_name\_suffix](#input\_spp\_name\_suffix) | Service principal name suffix. | `string` | n/a | yes |
34+
35+
## Outputs
36+
37+
| Name | Description |
38+
|------|-------------|
39+
| <a name="output_app_registration"></a> [app\_registration](#output\_app\_registration) | Application registration application id and object id |
40+
| <a name="output_app_registration_client_secret"></a> [app\_registration\_client\_secret](#output\_app\_registration\_client\_secret) | Password for the application registration. |

‎modules/meshcloud-sso/module.tf

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
terraform {
2+
required_version = ">= 0.13"
3+
required_providers {
4+
azurerm = {
5+
source = "hashicorp/azurerm"
6+
version = "2.97.0"
7+
}
8+
azuread = {
9+
source = "hashicorp/azuread"
10+
version = "2.18.0"
11+
}
12+
}
13+
}
14+
15+
data "azuread_application_published_app_ids" "well_known" {}
16+
17+
resource "azuread_service_principal" "msgraph" {
18+
application_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph
19+
use_existing = true
20+
}
21+
22+
resource "azuread_application" "meshcloud_sso" {
23+
display_name = "sso.${var.spp_name_suffix}"
24+
25+
required_resource_access {
26+
resource_app_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph
27+
28+
resource_access {
29+
id = azuread_service_principal.msgraph.app_role_ids["User.Read"]
30+
type = "Scope"
31+
}
32+
33+
# As far as we know it is not possible to automate the "Grant admin consent button" for app registrations
34+
# You have to grant admin consent manually
35+
lifecycle {
36+
ignore_changes = [
37+
app_role
38+
]
39+
}
40+
}
41+
42+
web {
43+
redirect_uris = [var.meshstack_redirect_uri]
44+
}
45+
}
46+
47+
resource "azuread_application_password" "meshcloud_sso" {
48+
application_object_id = azuread_application.meshcloud_sso.object_id
49+
}

‎modules/meshcloud-sso/outputs.tf

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
output "app_registration" {
2+
description = "Application registration application id and object id"
3+
value = {
4+
object_id = azuread_service_principal.meshcloud_sso.id
5+
app_id = azuread_service_principal.meshcloud_sso.application_id
6+
}
7+
}
8+
9+
output "app_registration_client_secret" {
10+
description = "Password for the application registration."
11+
value = azuread_application_password.meshcloud_sso.value
12+
sensitive = true
13+
}

‎modules/meshcloud-sso/variables.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
variable "spp_name_suffix" {
2+
type = string
3+
description = "Service principal name suffix."
4+
}
5+
6+
variable "meshstack_redirect_uri" {
7+
type = string
8+
description = "Redirect URI that will be provided by meshcloud. It is individual per meshStack."
9+
}

0 commit comments

Comments
 (0)