|
| 1 | + |
| 2 | +# Creating a ServicePrincipal for scripting scenarios |
| 3 | +One does not want to login interactively all the time. Azure provides service principal authentication as a secure way for silent login. |
| 4 | + |
| 5 | +## Via Portal |
| 6 | +[This article](https://azure.microsoft.com/en-us/documentation/articles/resource-group-create-service-principal-portal/) provides detailed steps on creating a service principal via portal. |
| 7 | + |
| 8 | +## Via XplatCLI |
| 9 | +Pre-requisite: |
| 10 | +- Install the latest version of cli from the [latest github release](https://github.com/Azure/azure-xplat-cli/releases) or from [npm](https://npmjs.com/package/azure-cli). |
| 11 | + |
| 12 | +```bash |
| 13 | +npm uninstall azure-cli -g |
| 14 | +npm cache clear -g |
| 15 | +npm install azure-cli -g |
| 16 | +``` |
| 17 | +- Login to the azure-cli via azure login command to create a service principal for future use. |
| 18 | + - For 2FA enabled user accounts `azure login` |
| 19 | + - For non 2FA enabled user accounts `azure login -u [email protected]` |
| 20 | + |
| 21 | +After successful login, please follow the steps mentioned below to create a serviceprincipal: |
| 22 | + |
| 23 | +#### Step 1. Create an aplication |
| 24 | + |
| 25 | +Let us create an application with a password. The default start-date witll be the day of application creation and the default end-date will be 1 year from the day of creation. |
| 26 | +``` |
| 27 | +D:\sdk>azure ad app create -n testap908 home-page http://www.bing.com --identifier-uris https://testap674.com/home -p P@ssw0rd |
| 28 | +info: Executing command ad app create |
| 29 | ++ Creating application testap674 |
| 30 | +data: AppId: 56894bd4-0fde-41d8-a0d7-5bsslccety2 |
| 31 | +data: ObjectId: g565675e8-7c30-908t-8548-87r98ew7rej |
| 32 | +data: DisplayName: testap674 |
| 33 | +data: IdentifierUris: 0=https://testap674.com/home |
| 34 | +data: ReplyUrls: |
| 35 | +data: AvailableToOtherTenants: False |
| 36 | +data: AppPermissions: |
| 37 | +data: claimValue: user_impersonation |
| 38 | +data: description: Allow the application to access testap674 on behalf of the signed-in user. |
| 39 | +data: directAccessGrantTypes: |
| 40 | +data: displayName: Access testap674 |
| 41 | +data: impersonationAccessGrantTypes: impersonated=User, impersonator=Application |
| 42 | +data: isDisabled: |
| 43 | +data: origin: Application |
| 44 | +data: permissionId: 12345698ui-fa71-4ab0-b647-fdajfhdakfh789 |
| 45 | +data: resourceScopeType: Personal |
| 46 | +data: userConsentDescription: Allow the application to access testap674 on your behalf. |
| 47 | +data: userConsentDisplayName: Access testap674 |
| 48 | +data: lang: |
| 49 | +info: ad app create command OK |
| 50 | +``` |
| 51 | + |
| 52 | +#### Step 2. Create a ServicePrincipal with the applicationId |
| 53 | + |
| 54 | +Let us create a serviceprincipal using the applicationId from the previous step. |
| 55 | +``` |
| 56 | +D:\sdk>azure ad sp create --aplicationId 56894bd4-0fde-41d8-a0d7-5bsslccety2 |
| 57 | +info: Executing command ad sp create |
| 58 | ++ Creating service principal for application 56894bd4-0fde-41d8-a0d7-5bsslccety2 |
| 59 | +data: Object Id: weewrerer-e329-4e9b-98c6-7878787 |
| 60 | +data: Display Name: testap674 |
| 61 | +data: Service Principal Names: |
| 62 | +data: 56894bd4-0fde-41d8-a0d7-5bsslccety2 |
| 63 | +data: https://testap674.com/home |
| 64 | +info: ad sp create command OK |
| 65 | +``` |
| 66 | + |
| 67 | +#### Step 3. Assigning a role to a ServicePrincipal by using the spn |
| 68 | + |
| 69 | +- You can get a list of available roles by ```azure role list``` |
| 70 | +- In this example we are creating the serviceprincipal as a Contributor at the subscription level. |
| 71 | + - Definition of a Contributor |
| 72 | +``` |
| 73 | +data: Name : Contributor |
| 74 | +data: Actions : 0=* |
| 75 | +data: NotActions : 0=Microsoft.Authorization/*/Delete, 1=Microsoft.Authorization/*/Write |
| 76 | +data: IsCustom : false |
| 77 | +``` |
| 78 | +This will associate the serviceprincipal to your current subscription |
| 79 | +``` |
| 80 | +D:\sdk>azure role assignment create --spn 56894bd4-0fde-41d8-a0d7-5bsslccety2 -o Contributor |
| 81 | +info: Executing command role assignment create |
| 82 | ++ Finding role with specified name |
| 83 | +/data: RoleAssignmentId : /subscriptions/abcdefgh-1234-4cc9-89b5-12345678/providers/Microsoft.Authorization/roleAssignments/987654-ea85-40a5-80c2-abcdferghtt |
| 84 | +data: RoleDefinitionName : Contributor |
| 85 | +data: RoleDefinitionId : jhfskjf-6180-42a0-ab88-5656eiu677e23e |
| 86 | +data: Scope : /subscriptions/abcdefgh-1234-4cc9-89b5-12345678 |
| 87 | +data: Display Name : testap674 |
| 88 | +data: SignInName : |
| 89 | +data: ObjectId : weewrerer-e329-4e9b-98c6-7878787 |
| 90 | +data: ObjectType : ServicePrincipal |
| 91 | +data: |
| 92 | ++ |
| 93 | +info: role assignment create command OK |
| 94 | +``` |
| 95 | + |
| 96 | +#### Step 4. Login as a serviceprincipal |
| 97 | +``` |
| 98 | +D:\sdk>azure login -u 56894bd4-0fde-41d8-a0d7-5bsslccety2 -p P@ssw0rd --tenant <a guid OR your domain(contosocorp.com) --service-principal |
| 99 | +info: Executing command login |
| 100 | +\info: Added subscription TestSubscription |
| 101 | ++ |
| 102 | +info: login command OK |
| 103 | +``` |
| 104 | + |
| 105 | +## Using serviceprincipal authentication in your node.js script |
| 106 | +```javascript |
| 107 | + var msrestAzure = require('ms-rest-azure'); |
| 108 | + //service principal authentication |
| 109 | + 'your-client-id' - is the spn ('56894bd4-0fde-41d8-a0d7-5bsslccety2') |
| 110 | + 'your-domain' - is the tenant id (a guid) or the part **after @** in your username (user1@**contosocorp.com**) ('contosocorp.com') |
| 111 | + 'your-secret' - is the password you created for the serviceprincipal ('P@ssw0rd') |
| 112 | + var credentials = new msRestAzure.ApplicationTokenCredentials('your-client-id', 'your-domain', 'your-secret'); |
| 113 | + ``` |
| 114 | + |
| 115 | +## Using user authentitcation in your node.js script |
| 116 | +Currently, the node sdk only supports users with org-id (organizational account) and have 2FA disabled. |
| 117 | + ```javascript |
| 118 | + var msrestAzure = require('ms-rest-azure'); |
| 119 | + //user authentication |
| 120 | + 'your-client-id' - is the id provided by Azure Active Directory for your application |
| 121 | + 'your-domain' - is the tenant id (a guid) or the part **after @** in your username (user1@**contosocorp.com**) ('contosocorp.com') |
| 122 | + 'your-username' - is your username ( '[email protected]') |
| 123 | + 'your-password' - password associated with the username |
| 124 | + 'your-redirect-uri' - is the redirect uri for your application. Providing 'http://localhost:8080' should also be fine. |
| 125 | + var credentials = new msRestAzure.UserTokenCredentials('your-client-id', 'your-domain', 'your-username', 'your-password', 'your-redirect-uri'); |
| 126 | + ``` |
0 commit comments