|
| 1 | +[CmdletBinding()] |
| 2 | +param( |
| 3 | + [PSCredential] $Credential, |
| 4 | + [Parameter(Mandatory=$False, HelpMessage='Tenant ID (This is a GUID which represents the "Directory ID" of the AzureAD tenant into which you want to create the apps')] |
| 5 | + [string] $tenantId |
| 6 | +) |
| 7 | + |
| 8 | +<# |
| 9 | + This script creates the following artefacts in the Azure AD tenant. |
| 10 | + 1) A number of App roles |
| 11 | + 2) A set of users and assigns them to the app roles. |
| 12 | +
|
| 13 | + Before running this script you need to install the AzureAD cmdlets as an administrator. |
| 14 | + For this: |
| 15 | + 1) Run Powershell as an administrator |
| 16 | + 2) in the PowerShell window, type: Install-Module AzureAD |
| 17 | +
|
| 18 | + There are four ways to run this script. For more information, read the AppCreationScripts.md file in the same folder as this script. |
| 19 | +#> |
| 20 | + |
| 21 | +# Create an application role of given name and description |
| 22 | +Function CreateAppRole([string] $Name, [string] $Description) |
| 23 | +{ |
| 24 | + $appRole = New-Object Microsoft.Open.AzureAD.Model.AppRole |
| 25 | + $appRole.AllowedMemberTypes = New-Object System.Collections.Generic.List[string] |
| 26 | + $appRole.AllowedMemberTypes.Add("User"); |
| 27 | + $appRole.DisplayName = $Name |
| 28 | + $appRole.Id = New-Guid |
| 29 | + $appRole.IsEnabled = $true |
| 30 | + $appRole.Description = $Description |
| 31 | + $appRole.Value = $Name; |
| 32 | + return $appRole |
| 33 | +} |
| 34 | + |
| 35 | +Function CreateUserRepresentingAppRole([string]$appName, $role, [string]$tenantName) |
| 36 | +{ |
| 37 | + $password = "test123456789." |
| 38 | + $displayName = $appName +"-" + $role.Value |
| 39 | + $userEmail = $displayName + "@" + $tenantName |
| 40 | + $nickName = $role.Value |
| 41 | + |
| 42 | + CreateUser -displayName $displayName -nickName $nickName -tenantName $tenantName |
| 43 | +} |
| 44 | + |
| 45 | +Function CreateUser([string]$displayName, [string]$nickName, [string]$tenantName) |
| 46 | +{ |
| 47 | + $password = "test123456789." |
| 48 | + $userEmail = $displayName + "@" + $tenantName |
| 49 | + $passwordProfile = New-Object Microsoft.Open.AzureAD.Model.PasswordProfile($password, $false, $false) |
| 50 | + |
| 51 | + New-AzureADUser -DisplayName $displayName -PasswordProfile $passwordProfile -AccountEnabled $true -MailNickName $nickName -UserPrincipalName $userEmail |
| 52 | +} |
| 53 | + |
| 54 | +Function CreateRolesUsersAndRoleAssignments |
| 55 | +{ |
| 56 | +<#.Description |
| 57 | + This function creates the |
| 58 | +#> |
| 59 | + |
| 60 | + # $tenantId is the Active Directory Tenant. This is a GUID which represents the "Directory ID" of the AzureAD tenant |
| 61 | + # into which you want to create the apps. Look it up in the Azure portal in the "Properties" of the Azure AD. |
| 62 | + |
| 63 | + # Login to Azure PowerShell (interactive if credentials are not already provided: |
| 64 | + # you'll need to sign-in with creds enabling your to create apps in the tenant) |
| 65 | + if (!$Credential -and $TenantId) |
| 66 | + { |
| 67 | + $creds = Connect-AzureAD -TenantId $tenantId |
| 68 | + } |
| 69 | + else |
| 70 | + { |
| 71 | + if (!$TenantId) |
| 72 | + { |
| 73 | + $creds = Connect-AzureAD -Credential $Credential |
| 74 | + } |
| 75 | + else |
| 76 | + { |
| 77 | + $creds = Connect-AzureAD -TenantId $tenantId -Credential $Credential |
| 78 | + } |
| 79 | + } |
| 80 | + |
| 81 | + if (!$tenantId) |
| 82 | + { |
| 83 | + $tenantId = $creds.Tenant.Id |
| 84 | + } |
| 85 | + |
| 86 | + $tenant = Get-AzureADTenantDetail |
| 87 | + $tenantName = ($tenant.VerifiedDomains | Where { $_._Default -eq $True }).Name |
| 88 | + |
| 89 | + # Get the user running the script |
| 90 | + $user = Get-AzureADUser -ObjectId $creds.Account.Id |
| 91 | + |
| 92 | + # Add application Roles |
| 93 | + $directoryViewerRole = CreateAppRole -Name "DirectoryViewers" -Description "Directory viewers can view objects in the whole directory." |
| 94 | + $userreaderRole = CreateAppRole -Name "UserReaders" -Description "User readers can read basic profiles of all users in the directory" |
| 95 | + |
| 96 | + $appRoles = New-Object System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.AppRole] |
| 97 | + $appRoles.Add($directoryViewerRole) |
| 98 | + $appRoles.Add($userreaderRole) |
| 99 | + |
| 100 | + # Add the roles |
| 101 | + Write-Host "Adding app roles to to the app 'WebApp-RolesClaims' in tenant '$tenantName'" |
| 102 | + |
| 103 | + $app=Get-AzureADApplication -Filter "DisplayName eq 'WebApp-RolesClaims'" |
| 104 | + |
| 105 | + if ($app) |
| 106 | + { |
| 107 | + $servicePrincipal = Get-AzureADServicePrincipal -Filter "AppId eq '$($app.AppId)'" |
| 108 | + |
| 109 | + Set-AzureADApplication -ObjectId $app.ObjectId -AppRoles $appRoles |
| 110 | + Write-Host "Successfully added app roles to the app 'WebApp-RolesClaims'." |
| 111 | + |
| 112 | + $appName = $app.DisplayName |
| 113 | + |
| 114 | + Write-Host "Creating users and assigning them to roles." |
| 115 | + |
| 116 | + # Create users |
| 117 | + # ------ |
| 118 | + # Make sure that the user who is running this script is assigned to the Directory viewer role |
| 119 | + Write-Host "Adding '$($user.DisplayName)' as a member of the '$($directoryViewerRole.DisplayName)' role" |
| 120 | + $userAssignment = New-AzureADUserAppRoleAssignment -ObjectId $user.ObjectId -PrincipalId $user.ObjectId -ResourceId $servicePrincipal.ObjectId -Id $directoryViewerRole.Id |
| 121 | + |
| 122 | + # Creating a directory viewer |
| 123 | + Write-Host "Creating a user and assigning to '$($directoryViewerRole.DisplayName)' role" |
| 124 | + $aDirectoryViewer = CreateUserRepresentingAppRole $appName $directoryViewerRole $tenantName |
| 125 | + $userAssignment = New-AzureADUserAppRoleAssignment -ObjectId $aDirectoryViewer.ObjectId -PrincipalId $aDirectoryViewer.ObjectId -ResourceId $servicePrincipal.ObjectId -Id $directoryViewerRole.Id |
| 126 | + Write-Host "Created "($anApprover.UserPrincipalName)" with password 'test123456789.'" |
| 127 | + |
| 128 | + # Creating a users reader |
| 129 | + Write-Host "Creating a user and assigning to '$($userreaderRole.DisplayName)' role" |
| 130 | + $auserreaderRole = CreateUserRepresentingAppRole $appName $userreaderRole $tenantName |
| 131 | + $userAssignment = New-AzureADUserAppRoleAssignment -ObjectId $auserreaderRole.ObjectId -PrincipalId $auserreaderRole.ObjectId -ResourceId $servicePrincipal.ObjectId -Id $userreaderRole.Id |
| 132 | + Write-Host "Created "($auserreaderRole.UserPrincipalName)" with password 'test123456789.'" |
| 133 | + } |
| 134 | + else { |
| 135 | + Write-Host "Failed to add app roles to the app 'WebApp-RolesClaims'." |
| 136 | + } |
| 137 | + |
| 138 | + Write-Host -ForegroundColor Green "Run the ..\CleanupUsersAndRoles.ps1 command to remove users created for this sample's application ." |
| 139 | +} |
| 140 | + |
| 141 | +# Pre-requisites |
| 142 | +if ((Get-Module -ListAvailable -Name "AzureAD") -eq $null) { |
| 143 | + Install-Module "AzureAD" -Scope CurrentUser |
| 144 | +} |
| 145 | +Import-Module AzureAD |
| 146 | +$ErrorActionPreference = 'Stop' |
| 147 | + |
| 148 | +CreateRolesUsersAndRoleAssignments -Credential $Credential -tenantId $TenantId |
0 commit comments