Skip to content
This repository was archived by the owner on May 17, 2024. It is now read-only.

Commit a0bb7eb

Browse files
derisenderisen
authored
Merge pull request #298 from Azure-Samples/update-config-scripts
Update config scripts in all projects
2 parents bda4f78 + 73bb364 commit a0bb7eb

File tree

32 files changed

+1300
-764
lines changed

32 files changed

+1300
-764
lines changed

‎1-Authentication/1-sign-in/AppCreationScripts/AppCreationScripts.md

Lines changed: 37 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,28 @@
1-
# Registering the sample apps with the Microsoft identity platform and updating the configuration files using PowerShell
1+
# Registering sample apps with the Microsoft identity platform and updating configuration files using PowerShell
22

33
## Overview
44

55
### Quick summary
66

7-
1. On Windows run PowerShell as **Administrator** and navigate to the root of the cloned directory
8-
1. In PowerShell run:
9-
10-
```PowerShell
11-
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process -Force
12-
```
13-
14-
1. Run the script to create your Azure AD application and configure the code of the sample application accordingly. (Other ways of running the scripts are described below)
7+
1. Run the script to create your Azure AD application and configure the code of the sample application accordingly.
158

169
```PowerShell
1710
cd .\AppCreationScripts\
18-
.\Configure.ps1
11+
.\Configure.ps1 -TenantId "your test tenant's id" -AzureEnvironmentName "[Optional] - Azure environment, defaults to 'Global'"
1912
```
2013

21-
1. Open the Visual Studio solution and click start
22-
2314
### More details
2415

25-
The following paragraphs:
26-
27-
- [Registering the sample apps with the Microsoft identity platform and updating the configuration files using PowerShell](#Registering-the-sample-apps-with-the-Microsoft-identity-platform-and-updating-the-configuration-files-using-PowerShell)
28-
- [Overview](#Overview)
29-
- [Quick summary](#Quick-summary)
30-
- [More details](#More-details)
31-
- [Goal of the provided scripts](#Goal-of-the-provided-scripts)
32-
- [Presentation of the scripts](#Presentation-of-the-scripts)
33-
- [Usage pattern for tests and DevOps scenarios](#Usage-pattern-for-tests-and-DevOps-scenarios)
34-
- [How to use the app creation scripts?](#How-to-use-the-app-creation-scripts)
35-
- [Pre-requisites](#Pre-requisites)
36-
- [Run the script and start running](#Run-the-script-and-start-running)
37-
- [Four ways to run the script](#Four-ways-to-run-the-script)
38-
- [Option 1 (interactive)](#Option-1-interactive)
39-
- [Option 2 (non-interactive)](#Option-2-non-interactive)
40-
- [Option 3 (Interactive, but create apps in a specified tenant)](#Option-3-Interactive-but-create-apps-in-a-specified-tenant)
41-
- [Option 4 (non-interactive, and create apps in a specified tenant)](#Option-4-non-interactive-and-create-apps-in-a-specified-tenant)
42-
- [Running the script on Azure Sovereign clouds](#Running-the-script-on-Azure-Sovereign-clouds)
16+
- [Goal of the provided scripts](#goal-of-the-provided-scripts)
17+
- [Presentation of the scripts](#presentation-of-the-scripts)
18+
- [Usage pattern for tests and DevOps scenarios](#usage-pattern-for-tests-and-DevOps-scenarios)
19+
- [How to use the app creation scripts?](#how-to-use-the-app-creation-scripts)
20+
- [Pre-requisites](#pre-requisites)
21+
- [Run the script and start running](#run-the-script-and-start-running)
22+
- [Four ways to run the script](#four-ways-to-run-the-script)
23+
- [Option 1 (interactive)](#option-1-interactive)
24+
- [Option 2 (Interactive, but create apps in a specified tenant)](#option-3-Interactive-but-create-apps-in-a-specified-tenant)
25+
- [Running the script on Azure Sovereign clouds](#running-the-script-on-Azure-Sovereign-clouds)
4326

4427
## Goal of the provided scripts
4528

@@ -50,14 +33,16 @@ This sample comes with two PowerShell scripts, which automate the creation of th
5033
These scripts are:
5134

5235
- `Configure.ps1` which:
53-
- creates Azure AD applications and their related objects (permissions, dependencies, secrets),
54-
- changes the configuration files in the C# and JavaScript projects.
36+
- creates Azure AD applications and their related objects (permissions, dependencies, secrets, app roles),
37+
- changes the configuration files in the sample projects.
5538
- creates a summary file named `createdApps.html` in the folder from which you ran the script, and containing, for each Azure AD application it created:
5639
- the identifier of the application
5740
- the AppId of the application
5841
- the url of its registration in the [Azure portal](https://portal.azure.com).
5942

60-
- `Cleanup.ps1` which cleans-up the Azure AD objects created by `Configure.ps1`. Note that this script does not revert the changes done in the configuration files, though. You will need to undo the change from source control (from Visual Studio, or from the command line using, for instance, git reset).
43+
- `Cleanup.ps1` which cleans-up the Azure AD objects created by `Configure.ps1`. Note that this script does not revert the changes done in the configuration files, though. You will need to undo the change from source control (from Visual Studio, or from the command line using, for instance, `git reset`).
44+
45+
> :information_source: If the sample supports using certificates instead of client secrets, this folder will contain an additional set of scripts: `Configure-WithCertificates.ps1` and `Cleanup-WithCertificates.ps1`. You can use them in the same way to register app(s) that use certificates instead of client secrets.
6146
6247
### Usage pattern for tests and DevOps scenarios
6348

@@ -67,31 +52,26 @@ The `Configure.ps1` will stop if it tries to create an Azure AD application whic
6752

6853
### Pre-requisites
6954

55+
1. PowerShell 7 or later (see: [installing PowerShell](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell))
7056
1. Open PowerShell (On Windows, press `Windows-R` and type `PowerShell` in the search window)
71-
1. Navigate to the root directory of the project.
72-
1. Until you change it, the default [Execution Policy](https:/go.microsoft.com/fwlink/?LinkID=135170) for scripts is usually `Restricted`. In order to run the PowerShell script you need to set the Execution Policy to `RemoteSigned`. You can set this just for the current PowerShell process by running the command:
7357

74-
```PowerShell
75-
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process
76-
```
77-
78-
### (Optionally) install AzureAD PowerShell modules
58+
### (Optionally) install Microsoft.Graph.Applications PowerShell modules
7959

80-
The scripts install the required PowerShell module (AzureAD) for the current user if needed. However, if you want to install if for all users on the machine, you can follow the following steps:
60+
The scripts install the required PowerShell module (Microsoft.Graph.Applications) for the current user if needed. However, if you want to install if for all users on the machine, you can follow the following steps:
8161

82-
1. If you have never done it already, in the PowerShell window, install the AzureAD PowerShell modules. For this:
62+
1. If you have never done it already, in the PowerShell window, install the Microsoft.Graph.Applications PowerShell modules. For this:
8363

84-
1. Open PowerShell as admin (On Windows, Search Powershell in the search bar, right click on it and select Run as administrator).
64+
1. Open PowerShell
8565
2. Type:
86-
66+
8767
```PowerShell
88-
Install-Module AzureAD
68+
Install-Module Microsoft.Graph.Applications
8969
```
9070
91-
or if you cannot be administrator on your machine, run:
92-
71+
or if you want the modules to be installed for the current user only, run:
72+
9373
```PowerShell
94-
Install-Module AzureAD -Scope CurrentUser
74+
Install-Module Microsoft.Graph.Applications -Scope CurrentUser
9575
```
9676
9777
### Run the script and start running
@@ -106,44 +86,29 @@ The scripts install the required PowerShell module (AzureAD) for the current use
10686
1. Open the Visual Studio solution, and in the solution's context menu, choose **Set Startup Projects**.
10787
1. select **Start** for the projects
10888
109-
You're done. this just works!
89+
You're done!
11090
111-
### Four ways to run the script
91+
### Two ways to run the script
11292
11393
We advise four ways of running the script:
11494
11595
- Interactive: you will be prompted for credentials, and the scripts decide in which tenant to create the objects,
116-
- non-interactive: you will provide credentials, and the scripts decide in which tenant to create the objects,
117-
- Interactive in specific tenant: you will provide the tenant in which you want to create the objects and then you will be prompted for credentials, and the scripts will create the objects,
118-
- non-interactive in specific tenant: you will provide tenant in which you want to create the objects and credentials, and the scripts will create the objects.
96+
- Interactive in specific tenant: you will provide the tenant in which you want to create the objects and then you will be prompted for credentials, and the scripts will create the objects,
11997
12098
Here are the details on how to do this.
12199
122100
#### Option 1 (interactive)
123101
124-
- Just run ``. .\Configure.ps1``, and you will be prompted to sign-in (email address, password, and if needed MFA).
102+
- Just run ``.\Configure.ps1``, and you will be prompted to sign-in (email address, password, and if needed MFA).
125103
- The script will be run as the signed-in user and will use the tenant in which the user is defined.
126104
127105
Note that the script will choose the tenant in which to create the applications, based on the user. Also to run the `Cleanup.ps1` script, you will need to re-sign-in.
128106
129-
#### Option 2 (non-interactive)
130-
131-
When you know the identity and credentials of the user in the name of whom you want to create the applications, you can use the non-interactive approach. It's more adapted to DevOps. Here is an example of script you'd want to run in a PowerShell Window
132-
133-
```PowerShell
134-
$secpasswd = ConvertTo-SecureString "[Password here]" -AsPlainText -Force
135-
$mycreds = New-Object System.Management.Automation.PSCredential ("[login@tenantName here]", $secpasswd)
136-
. .\Cleanup.ps1 -Credential $mycreds
137-
. .\Configure.ps1 -Credential $mycreds
138-
```
139-
140-
Of course, in real life, you might already get the password as a `SecureString`. You might also want to get the password from KeyVault.
141-
142-
#### Option 3 (Interactive, but create apps in a specified tenant)
107+
#### Option 2 (Interactive, but create apps in a specified tenant)
143108
144109
if you want to create the apps in a particular tenant, you can use the following option:
145110
146-
- open the [Azure portal](https://portal.azure.com)
111+
- Open the [Azure portal](https://portal.azure.com)
147112
- Select the Azure Active directory you are interested in (in the combo-box below your name on the top right of the browser window)
148113
- Find the "Active Directory" object in this tenant
149114
- Go to **Properties** and copy the content of the **Directory Id** property
@@ -155,32 +120,19 @@ $tenantId = "yourTenantIdGuid"
155120
. .\Configure.ps1 -TenantId $tenantId
156121
```
157122

158-
#### Option 4 (non-interactive, and create apps in a specified tenant)
159-
160-
This option combines option 2 and option 3: it creates the application in a specific tenant. See option 3 for the way to get the tenant Id. Then run:
161-
162-
```PowerShell
163-
$secpasswd = ConvertTo-SecureString "[Password here]" -AsPlainText -Force
164-
$mycreds = New-Object System.Management.Automation.PSCredential ("[login@tenantName here]", $secpasswd)
165-
$tenantId = "yourTenantIdGuid"
166-
. .\Cleanup.ps1 -Credential $mycreds -TenantId $tenantId
167-
. .\Configure.ps1 -Credential $mycreds -TenantId $tenantId
168-
```
169-
170123
### Running the script on Azure Sovereign clouds
171124

172-
All the four options listed above, can be used on any Azure Sovereign clouds. By default, the script targets `AzureCloud`, but it can be changed using the parameter `-AzureEnvironmentName`.
125+
All the four options listed above can be used on any Azure Sovereign clouds. By default, the script targets `AzureCloud`, but it can be changed using the parameter `-AzureEnvironmentName`.
173126

174127
The acceptable values for this parameter are:
175128

176129
- AzureCloud
177130
- AzureChinaCloud
178131
- AzureUSGovernment
179-
- AzureGermanyCloud
180132

181133
Example:
182134

183135
```PowerShell
184-
. .\Cleanup.ps1 -AzureEnvironmentName "AzureGermanyCloud"
185-
. .\Configure.ps1 -AzureEnvironmentName "AzureGermanyCloud"
136+
. .\Cleanup.ps1 -AzureEnvironmentName "AzureUSGovernment"
137+
. .\Configure.ps1 -AzureEnvironmentName "AzureUSGovernment"
186138
```

‎1-Authentication/1-sign-in/AppCreationScripts/Cleanup.ps1

Lines changed: 110 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,19 @@
1+
#Requires -Version 7
2+
13
[CmdletBinding()]
24
param(
3-
[PSCredential] $Credential,
45
[Parameter(Mandatory=$False, HelpMessage='Tenant ID (This is a GUID which represents the "Directory ID" of the AzureAD tenant into which you want to create the apps')]
56
[string] $tenantId,
6-
[Parameter(Mandatory=$False, HelpMessage='Azure environment to use while running the script (it defaults to AzureCloud)')]
7+
[Parameter(Mandatory=$False, HelpMessage='Azure environment to use while running the script. Default = Global')]
78
[string] $azureEnvironmentName
89
)
910

10-
#Requires -Modules AzureAD -RunAsAdministrator
11-
12-
13-
if ($null -eq (Get-Module -ListAvailable -Name "AzureAD")) {
14-
Install-Module "AzureAD" -Scope CurrentUser
15-
}
16-
Import-Module AzureAD
17-
$ErrorActionPreference = "Stop"
1811

1912
Function Cleanup
2013
{
2114
if (!$azureEnvironmentName)
2215
{
23-
$azureEnvironmentName = "AzureCloud"
16+
$azureEnvironmentName = "Global"
2417
}
2518

2619
<#
@@ -31,50 +24,129 @@ Function Cleanup
3124
# $tenantId is the Active Directory Tenant. This is a GUID which represents the "Directory ID" of the AzureAD tenant
3225
# into which you want to create the apps. Look it up in the Azure portal in the "Properties" of the Azure AD.
3326

34-
# Login to Azure PowerShell (interactive if credentials are not already provided:
35-
# you'll need to sign-in with creds enabling your to create apps in the tenant)
36-
if (!$Credential -and $TenantId)
27+
# Connect to the Microsoft Graph API
28+
Write-Host "Connecting to Microsoft Graph"
29+
30+
31+
if ($tenantId -eq "")
3732
{
38-
$creds = Connect-AzureAD -TenantId $tenantId -AzureEnvironmentName $azureEnvironmentName
33+
Connect-MgGraph -Scopes "User.Read.All Organization.Read.All Application.ReadWrite.All" -Environment $azureEnvironmentName
3934
}
40-
else
35+
else
4136
{
42-
if (!$TenantId)
43-
{
44-
$creds = Connect-AzureAD -Credential $Credential -AzureEnvironmentName $azureEnvironmentName
45-
}
46-
else
47-
{
48-
$creds = Connect-AzureAD -TenantId $tenantId -Credential $Credential -AzureEnvironmentName $azureEnvironmentName
49-
}
37+
Connect-MgGraph -TenantId $tenantId -Scopes "User.Read.All Organization.Read.All Application.ReadWrite.All" -Environment $azureEnvironmentName
5038
}
39+
40+
$context = Get-MgContext
41+
$tenantId = $context.TenantId
5142

52-
if (!$tenantId)
53-
{
54-
$tenantId = $creds.Tenant.Id
55-
}
56-
$tenant = Get-AzureADTenantDetail
57-
$tenantName = ($tenant.VerifiedDomains | Where-Object { $_._Default -eq $True }).Name
43+
# Get the user running the script
44+
$currentUserPrincipalName = $context.Account
45+
$user = Get-MgUser -Filter "UserPrincipalName eq '$($context.Account)'"
46+
47+
# get the tenant we signed in to
48+
$Tenant = Get-MgOrganization
49+
$tenantName = $Tenant.DisplayName
5850

51+
$verifiedDomain = $Tenant.VerifiedDomains | where {$_.Isdefault -eq $true}
52+
$verifiedDomainName = $verifiedDomain.Name
53+
$tenantId = $Tenant.Id
54+
55+
Write-Host ("Connected to Tenant {0} ({1}) as account '{2}'. Domain is '{3}'" -f $Tenant.DisplayName, $Tenant.Id, $currentUserPrincipalName, $verifiedDomainName)
56+
5957
# Removes the applications
60-
Write-Host "Cleaning-up applications from tenant '$tenantName'"
58+
Write-Host "Cleaning-up applications from tenant '$tenantId'"
6159

6260
Write-Host "Removing 'spa' (msal-angular-spa) if needed"
63-
Get-AzureADApplication -Filter "DisplayName eq 'msal-angular-spa'" | ForEach-Object {Remove-AzureADApplication -ObjectId $_.ObjectId }
64-
$apps = Get-AzureADApplication -Filter "DisplayName eq 'msal-angular-spa'"
61+
try
62+
{
63+
Get-MgApplication -Filter "DisplayName eq 'msal-angular-spa'" | ForEach-Object {Remove-MgApplication -ApplicationId $_.Id }
64+
}
65+
catch
66+
{
67+
$message = $_
68+
Write-Warning $Error[0]
69+
Write-Host "Unable to remove the application 'msal-angular-spa'. Error is $message. Try deleting manually." -ForegroundColor White -BackgroundColor Red
70+
}
71+
72+
Write-Host "Making sure there are no more (msal-angular-spa) applications found, will remove if needed..."
73+
$apps = Get-MgApplication -Filter "DisplayName eq 'msal-angular-spa'" | Format-List Id, DisplayName, AppId, SignInAudience, PublisherDomain
74+
6575
if ($apps)
6676
{
67-
Remove-AzureADApplication -ObjectId $apps.ObjectId
77+
Remove-MgApplication -ApplicationId $apps.Id
6878
}
6979

7080
foreach ($app in $apps)
7181
{
72-
Remove-AzureADApplication -ObjectId $app.ObjectId
82+
Remove-MgApplication -ApplicationId $app.Id
7383
Write-Host "Removed msal-angular-spa.."
7484
}
85+
7586
# also remove service principals of this app
76-
Get-AzureADServicePrincipal -filter "DisplayName eq 'msal-angular-spa'" | ForEach-Object {Remove-AzureADServicePrincipal -ObjectId $_.Id -Confirm:$false}
77-
87+
try
88+
{
89+
Get-MgServicePrincipal -filter "DisplayName eq 'msal-angular-spa'" | ForEach-Object {Remove-MgServicePrincipal -ServicePrincipalId $_.Id -Confirm:$false}
90+
}
91+
catch
92+
{
93+
$message = $_
94+
Write-Warning $Error[0]
95+
Write-Host "Unable to remove ServicePrincipal 'msal-angular-spa'. Error is $message. Try deleting manually from Enterprise applications." -ForegroundColor White -BackgroundColor Red
96+
}
97+
}
98+
99+
# Pre-requisites
100+
if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph")) {
101+
Install-Module "Microsoft.Graph" -Scope CurrentUser
102+
}
103+
104+
#Import-Module Microsoft.Graph
105+
106+
if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Authentication")) {
107+
Install-Module "Microsoft.Graph.Authentication" -Scope CurrentUser
108+
}
109+
110+
Import-Module Microsoft.Graph.Authentication
111+
112+
if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Identity.DirectoryManagement")) {
113+
Install-Module "Microsoft.Graph.Identity.DirectoryManagement" -Scope CurrentUser
114+
}
115+
116+
Import-Module Microsoft.Graph.Identity.DirectoryManagement
117+
118+
if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Applications")) {
119+
Install-Module "Microsoft.Graph.Applications" -Scope CurrentUser
120+
}
121+
122+
Import-Module Microsoft.Graph.Applications
123+
124+
if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Groups")) {
125+
Install-Module "Microsoft.Graph.Groups" -Scope CurrentUser
126+
}
127+
128+
Import-Module Microsoft.Graph.Groups
129+
130+
if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Users")) {
131+
Install-Module "Microsoft.Graph.Users" -Scope CurrentUser
132+
}
133+
134+
Import-Module Microsoft.Graph.Users
135+
136+
$ErrorActionPreference = "Stop"
137+
138+
139+
try
140+
{
141+
Cleanup -tenantId $tenantId -environment $azureEnvironmentName
142+
}
143+
catch
144+
{
145+
$_.Exception.ToString() | out-host
146+
$message = $_
147+
Write-Warning $Error[0]
148+
Write-Host "Unable to register apps. Error is $message." -ForegroundColor White -BackgroundColor Red
78149
}
79150

80-
Cleanup -Credential $Credential -tenantId $TenantId
151+
Write-Host "Disconnecting from tenant"
152+
Disconnect-MgGraph

0 commit comments

Comments
 (0)