Skip to content

Commit c5a8fef

Browse files
pamelafoxpamelafox
committed
Formatting
1 parent 4fe5533 commit c5a8fef

File tree

2 files changed

+153
-151
lines changed

2 files changed

+153
-151
lines changed

‎infra/appregistration.bicep‎

Lines changed: 91 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -1,91 +1,91 @@
1-
extension microsoftGraphV1
2-
3-
@description('Specifies the name of cloud environment to run this deployment in.')
4-
param cloudEnvironment string = environment().name
5-
6-
// NOTE: Microsoft Graph Bicep file deployment is only supported in Public Cloud
7-
@description('Audience uris for public and national clouds')
8-
param audiences object = {
9-
AzureCloud: {
10-
uri: 'api://AzureADTokenExchange'
11-
}
12-
AzureUSGovernment: {
13-
uri: 'api://AzureADTokenExchangeUSGov'
14-
}
15-
USNat: {
16-
uri: 'api://AzureADTokenExchangeUSNat'
17-
}
18-
USSec: {
19-
uri: 'api://AzureADTokenExchangeUSSec'
20-
}
21-
AzureChinaCloud: {
22-
uri: 'api://AzureADTokenExchangeChina'
23-
}
24-
}
25-
26-
@description('Specifies the ID of the user-assigned managed identity.')
27-
param webAppIdentityId string
28-
29-
@description('Specifies the unique name for the client application.')
30-
param clientAppName string
31-
32-
@description('Specifies the display name for the client application')
33-
param clientAppDisplayName string
34-
35-
@description('Specifies the scopes that the client application requires.')
36-
param clientAppScopes array = ['User.Read', 'offline_access', 'openid', 'profile']
37-
38-
param serviceManagementReference string = ''
39-
40-
param issuer string
41-
42-
param webAppEndpoint string
43-
44-
// Get the MS Graph Service Principal based on its application ID:
45-
// https://learn.microsoft.com/troubleshoot/entra/entra-id/governance/verify-first-party-apps-sign-in
46-
var msGraphAppId = '00000003-0000-0000-c000-000000000000'
47-
resource msGraphSP 'Microsoft.Graph/[email protected]' existing = {
48-
appId: msGraphAppId
49-
}
50-
51-
var graphScopes = msGraphSP.oauth2PermissionScopes
52-
resource clientApp 'Microsoft.Graph/[email protected]' = {
53-
uniqueName: clientAppName
54-
displayName: clientAppDisplayName
55-
signInAudience: 'AzureADMyOrg'
56-
serviceManagementReference: empty(serviceManagementReference) ? null : serviceManagementReference
57-
web: {
58-
redirectUris: [
59-
'http://localhost:50505/.auth/login/aad/callback'
60-
'${webAppEndpoint}/.auth/login/aad/callback'
61-
]
62-
implicitGrantSettings: { enableIdTokenIssuance: true }
63-
}
64-
requiredResourceAccess: [
65-
{
66-
resourceAppId: msGraphAppId
67-
resourceAccess: [
68-
for (scope, i) in clientAppScopes: {
69-
id: filter(graphScopes, graphScopes => graphScopes.value == scope)[0].id
70-
type: 'Scope'
71-
}
72-
]
73-
}
74-
]
75-
76-
resource clientAppFic '[email protected]' = {
77-
name: '${clientApp.uniqueName}/miAsFic'
78-
audiences: [
79-
audiences[cloudEnvironment].uri
80-
]
81-
issuer: issuer
82-
subject: webAppIdentityId
83-
}
84-
}
85-
86-
resource clientSp 'Microsoft.Graph/[email protected]' = {
87-
appId: clientApp.appId
88-
}
89-
90-
output clientAppId string = clientApp.appId
91-
output clientSpId string = clientSp.id
1+
extension microsoftGraphV1
2+
3+
@description('Specifies the name of cloud environment to run this deployment in.')
4+
param cloudEnvironment string = environment().name
5+
6+
// NOTE: Microsoft Graph Bicep file deployment is only supported in Public Cloud
7+
@description('Audience uris for public and national clouds')
8+
param audiences object = {
9+
AzureCloud: {
10+
uri: 'api://AzureADTokenExchange'
11+
}
12+
AzureUSGovernment: {
13+
uri: 'api://AzureADTokenExchangeUSGov'
14+
}
15+
USNat: {
16+
uri: 'api://AzureADTokenExchangeUSNat'
17+
}
18+
USSec: {
19+
uri: 'api://AzureADTokenExchangeUSSec'
20+
}
21+
AzureChinaCloud: {
22+
uri: 'api://AzureADTokenExchangeChina'
23+
}
24+
}
25+
26+
@description('Specifies the ID of the user-assigned managed identity.')
27+
param webAppIdentityId string
28+
29+
@description('Specifies the unique name for the client application.')
30+
param clientAppName string
31+
32+
@description('Specifies the display name for the client application')
33+
param clientAppDisplayName string
34+
35+
@description('Specifies the scopes that the client application requires.')
36+
param clientAppScopes array = ['User.Read', 'offline_access', 'openid', 'profile']
37+
38+
param serviceManagementReference string = ''
39+
40+
param issuer string
41+
42+
param webAppEndpoint string
43+
44+
// Get the MS Graph Service Principal based on its application ID:
45+
// https://learn.microsoft.com/troubleshoot/entra/entra-id/governance/verify-first-party-apps-sign-in
46+
var msGraphAppId = '00000003-0000-0000-c000-000000000000'
47+
resource msGraphSP 'Microsoft.Graph/[email protected]' existing = {
48+
appId: msGraphAppId
49+
}
50+
51+
var graphScopes = msGraphSP.oauth2PermissionScopes
52+
resource clientApp 'Microsoft.Graph/[email protected]' = {
53+
uniqueName: clientAppName
54+
displayName: clientAppDisplayName
55+
signInAudience: 'AzureADMyOrg'
56+
serviceManagementReference: empty(serviceManagementReference) ? null : serviceManagementReference
57+
web: {
58+
redirectUris: [
59+
'http://localhost:50505/.auth/login/aad/callback'
60+
'${webAppEndpoint}/.auth/login/aad/callback'
61+
]
62+
implicitGrantSettings: { enableIdTokenIssuance: true }
63+
}
64+
requiredResourceAccess: [
65+
{
66+
resourceAppId: msGraphAppId
67+
resourceAccess: [
68+
for (scope, i) in clientAppScopes: {
69+
id: filter(graphScopes, graphScopes => graphScopes.value == scope)[0].id
70+
type: 'Scope'
71+
}
72+
]
73+
}
74+
]
75+
76+
resource clientAppFic '[email protected]' = {
77+
name: '${clientApp.uniqueName}/miAsFic'
78+
audiences: [
79+
audiences[cloudEnvironment].uri
80+
]
81+
issuer: issuer
82+
subject: webAppIdentityId
83+
}
84+
}
85+
86+
resource clientSp 'Microsoft.Graph/[email protected]' = {
87+
appId: clientApp.appId
88+
}
89+
90+
output clientAppId string = clientApp.appId
91+
output clientSpId string = clientSp.id

‎infra/appupdate.bicep‎

Lines changed: 62 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -1,60 +1,62 @@
1-
metadata description = 'Creates an Azure Container Apps Auth Config using Microsoft Entra as Identity Provider.'
2-
3-
@description('The name of the container apps resource within the current resource group scope')
4-
param containerAppName string
5-
6-
@description('The client ID of the Microsoft Entra application.')
7-
param clientId string
8-
9-
param openIdIssuer string
10-
11-
@description('Enable token store for the Container App.')
12-
param includeTokenStore bool = false
13-
14-
@description('The URI of the Azure Blob Storage container to be used for token storage.')
15-
param blobContainerUri string = ''
16-
@description('The resource ID of the managed identity to be used for accessing the Azure Blob Storage.')
17-
param appIdentityResourceId string = ''
18-
19-
resource app 'Microsoft.App/containerApps@2023-05-01' existing = {
20-
name: containerAppName
21-
}
22-
23-
resource auth 'Microsoft.App/containerApps/authConfigs@2024-10-02-preview' = {
24-
parent: app
25-
name: 'current'
26-
properties: {
27-
platform: {
28-
enabled: true
29-
}
30-
globalValidation: {
31-
redirectToProvider: 'azureactivedirectory'
32-
unauthenticatedClientAction: 'RedirectToLoginPage'
33-
}
34-
identityProviders: {
35-
azureActiveDirectory: {
36-
enabled: true
37-
registration: {
38-
clientId: clientId
39-
clientSecretSettingName: 'override-use-mi-fic-assertion-client-id'
40-
openIdIssuer: openIdIssuer
41-
}
42-
validation: {
43-
defaultAuthorizationPolicy: {
44-
allowedApplications: []
45-
}
46-
}
47-
}
48-
}
49-
login: {
50-
// https://learn.microsoft.com/azure/container-apps/token-store
51-
tokenStore: {
52-
enabled: includeTokenStore
53-
azureBlobStorage: includeTokenStore ? {
54-
blobContainerUri: blobContainerUri
55-
managedIdentityResourceId: appIdentityResourceId
56-
} : {}
57-
}
58-
}
59-
}
60-
}
1+
metadata description = 'Creates an Azure Container Apps Auth Config using Microsoft Entra as Identity Provider.'
2+
3+
@description('The name of the container apps resource within the current resource group scope')
4+
param containerAppName string
5+
6+
@description('The client ID of the Microsoft Entra application.')
7+
param clientId string
8+
9+
param openIdIssuer string
10+
11+
@description('Enable token store for the Container App.')
12+
param includeTokenStore bool = false
13+
14+
@description('The URI of the Azure Blob Storage container to be used for token storage.')
15+
param blobContainerUri string = ''
16+
@description('The resource ID of the managed identity to be used for accessing the Azure Blob Storage.')
17+
param appIdentityResourceId string = ''
18+
19+
resource app 'Microsoft.App/containerApps@2023-05-01' existing = {
20+
name: containerAppName
21+
}
22+
23+
resource auth 'Microsoft.App/containerApps/authConfigs@2024-10-02-preview' = {
24+
parent: app
25+
name: 'current'
26+
properties: {
27+
platform: {
28+
enabled: true
29+
}
30+
globalValidation: {
31+
redirectToProvider: 'azureactivedirectory'
32+
unauthenticatedClientAction: 'RedirectToLoginPage'
33+
}
34+
identityProviders: {
35+
azureActiveDirectory: {
36+
enabled: true
37+
registration: {
38+
clientId: clientId
39+
clientSecretSettingName: 'override-use-mi-fic-assertion-client-id'
40+
openIdIssuer: openIdIssuer
41+
}
42+
validation: {
43+
defaultAuthorizationPolicy: {
44+
allowedApplications: []
45+
}
46+
}
47+
}
48+
}
49+
login: {
50+
// https://learn.microsoft.com/azure/container-apps/token-store
51+
tokenStore: {
52+
enabled: includeTokenStore
53+
azureBlobStorage: includeTokenStore
54+
? {
55+
blobContainerUri: blobContainerUri
56+
managedIdentityResourceId: appIdentityResourceId
57+
}
58+
: {}
59+
}
60+
}
61+
}
62+
}

0 commit comments

Comments
 (0)