Skip to content

Commit 4755663

Browse files
authored
Merge pull request #174361 from robece/master
Added new version of secure webhook delivery document
2 parents 1970fbd + 0db439b commit 4755663

7 files changed

+400
-141
lines changed
18.7 KB
Loading
15.4 KB
Loading
Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
---
2+
title: Azure PowerShell - Secure WebHook delivery with Azure AD Application in Azure Event Grid
3+
description: Describes how to deliver events to HTTPS endpoints protected by Azure AD Application using Azure Event Grid
4+
ms.devlang: powershell
5+
ms.topic: sample
6+
ms.date: 09/29/2021
7+
---
8+
9+
# Secure WebHook delivery with Azure AD Application in Azure Event Grid
10+
11+
This script provides the configuration to deliver events to HTTPS endpoints protected by Azure AD Application using Azure Event Grid.
12+
13+
## Sample script - stable
14+
15+
```azurepowershell
16+
# NOTE: Before run this script ensure you are logged in Azure by using "az login" command.
17+
18+
$webhookAppObjectId = "[REPLACE_WITH_YOUR_ID]"
19+
$eventSubscriptionWriterAppId = "[REPLACE_WITH_YOUR_ID]"
20+
21+
# Start execution
22+
try {
23+
24+
# Creates an application role of given name and description
25+
26+
Function CreateAppRole([string] $Name, [string] $Description)
27+
{
28+
$appRole = New-Object Microsoft.Open.AzureAD.Model.AppRole
29+
$appRole.AllowedMemberTypes = New-Object System.Collections.Generic.List[string]
30+
$appRole.AllowedMemberTypes.Add("Application");
31+
$appRole.AllowedMemberTypes.Add("User");
32+
$appRole.DisplayName = $Name
33+
$appRole.Id = New-Guid
34+
$appRole.IsEnabled = $true
35+
$appRole.Description = $Description
36+
$appRole.Value = $Name;
37+
38+
return $appRole
39+
}
40+
41+
# Creates Azure Event Grid Azure AD Application if not exists
42+
43+
$eventGridAppId = "4962773b-9cdb-44cf-a8bf-237846a00ab7" # You don't need to modify this id
44+
$eventGridRoleName = "AzureEventGridSecureWebhookSubscriber" # You don't need to modify this role name
45+
$eventGridSP = Get-AzureADServicePrincipal -Filter ("appId eq '" + $eventGridAppId + "'")
46+
if ($eventGridSP -match "Microsoft.EventGrid")
47+
{
48+
Write-Host "The Azure AD Application is already defined.`n"
49+
} else {
50+
Write-Host "Creating the Azure Event Grid Azure AD Application"
51+
$eventGridSP = New-AzureADServicePrincipal -AppId $eventGridAppId
52+
}
53+
54+
# Creates the Azure app role for the webhook Azure AD application
55+
56+
$app = Get-AzureADApplication -ObjectId $webhookAppObjectId
57+
$appRoles = $app.AppRoles
58+
59+
Write-Host "Azure AD App roles before addition of the new role..."
60+
Write-Host $appRoles
61+
62+
if ($appRoles -match $eventGridRoleName)
63+
{
64+
Write-Host "The Azure Event Grid role is already defined.`n"
65+
} else {
66+
Write-Host "Creating the Azure Event Grid role in Azure AD Application: " $webhookAppObjectId
67+
$newRole = CreateAppRole -Name $eventGridRoleName -Description "Azure Event Grid Role"
68+
$appRoles.Add($newRole)
69+
Set-AzureADApplication -ObjectId $app.ObjectId -AppRoles $appRoles
70+
}
71+
72+
Write-Host "Azure AD App roles after addition of the new role..."
73+
Write-Host $appRoles
74+
75+
# Creates the user role assignment for the app that will create event subscription
76+
77+
$servicePrincipal = Get-AzureADServicePrincipal -Filter ("appId eq '" + $app.AppId + "'")
78+
$eventSubscriptionWriterSP = Get-AzureADServicePrincipal -Filter ("appId eq '" + $eventSubscriptionWriterAppId + "'")
79+
80+
if ($null -eq $eventSubscriptionWriterSP)
81+
{
82+
Write-Host "Create new Azure AD Application"
83+
$eventSubscriptionWriterSP = New-AzureADServicePrincipal -AppId $eventSubscriptionWriterAppId
84+
}
85+
86+
try
87+
{
88+
Write-Host "Creating the Azure AD Application role assignment: " $eventSubscriptionWriterAppId
89+
$eventGridAppRole = $app.AppRoles | Where-Object -Property "DisplayName" -eq -Value $eventGridRoleName
90+
New-AzureADServiceAppRoleAssignment -Id $eventGridAppRole.Id -ResourceId $servicePrincipal.ObjectId -ObjectId $eventSubscriptionWriterSP.ObjectId -PrincipalId $eventSubscriptionWriterSP.ObjectId
91+
}
92+
catch
93+
{
94+
if( $_.Exception.Message -like '*Permission being assigned already exists on the object*')
95+
{
96+
Write-Host "The Azure AD Application role is already defined.`n"
97+
}
98+
else
99+
{
100+
Write-Error $_.Exception.Message
101+
}
102+
Break
103+
}
104+
105+
# Creates the service app role assignment for Event Grid Azure AD Application
106+
107+
$eventGridAppRole = $app.AppRoles | Where-Object -Property "DisplayName" -eq -Value $eventGridRoleName
108+
New-AzureADServiceAppRoleAssignment -Id $eventGridAppRole.Id -ResourceId $servicePrincipal.ObjectId -ObjectId $eventGridSP.ObjectId -PrincipalId $eventGridSP.ObjectId
109+
110+
# Print output references for backup
111+
112+
Write-Host ">> Webhook's Azure AD Application Id: $($app.AppId)"
113+
Write-Host ">> Webhook's Azure AD Application ObjectId Id: $($app.ObjectId)"
114+
}
115+
catch {
116+
Write-Host ">> Exception:"
117+
Write-Host $_
118+
Write-Host ">> StackTrace:"
119+
Write-Host $_.ScriptStackTrace
120+
}
121+
```
122+
123+
## Script explanation
124+
125+
For more details refer to [Secure WebHook delivery with Azure AD in Azure Event Grid](../secure-webhook-delivery.md)
Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
---
2+
title: Azure PowerShell - Secure WebHook delivery with Azure AD User in Azure Event Grid
3+
description: Describes how to deliver events to HTTPS endpoints protected by Azure AD User using Azure Event Grid
4+
ms.devlang: powershell
5+
ms.topic: sample
6+
ms.date: 09/29/2021
7+
---
8+
9+
# Secure WebHook delivery with Azure AD User in Azure Event Grid
10+
11+
This script provides the configuration to deliver events to HTTPS endpoints protected by Azure AD User using Azure Event Grid.
12+
13+
## Sample script - stable
14+
15+
```azurepowershell
16+
# NOTE: Before run this script ensure you are logged in Azure by using "az login" command.
17+
18+
$webhookAppObjectId = "[REPLACE_WITH_YOUR_ID]"
19+
$eventSubscriptionWriterUserPrincipalName = "[REPLACE_WITH_USER_PRINCIPAL_NAME_OF_THE_USER_WHO_WILL_CREATE_THE_SUBSCRIPTION]"
20+
21+
# Start execution
22+
try {
23+
24+
# Creates an application role of given name and description
25+
26+
Function CreateAppRole([string] $Name, [string] $Description)
27+
{
28+
$appRole = New-Object Microsoft.Open.AzureAD.Model.AppRole
29+
$appRole.AllowedMemberTypes = New-Object System.Collections.Generic.List[string]
30+
$appRole.AllowedMemberTypes.Add("Application");
31+
$appRole.AllowedMemberTypes.Add("User");
32+
$appRole.DisplayName = $Name
33+
$appRole.Id = New-Guid
34+
$appRole.IsEnabled = $true
35+
$appRole.Description = $Description
36+
$appRole.Value = $Name;
37+
38+
return $appRole
39+
}
40+
41+
# Creates Azure Event Grid Azure AD Application if not exists
42+
43+
$eventGridAppId = "4962773b-9cdb-44cf-a8bf-237846a00ab7" # You don't need to modify this id
44+
$eventGridRoleName = "AzureEventGridSecureWebhookSubscriber" # You don't need to modify this role name
45+
$eventGridSP = Get-AzureADServicePrincipal -Filter ("appId eq '" + $eventGridAppId + "'")
46+
if ($eventGridSP -match "Microsoft.EventGrid")
47+
{
48+
Write-Host "The Azure AD Application is already defined.`n"
49+
} else {
50+
Write-Host "Creating the Azure Event Grid Azure AD Application"
51+
$eventGridSP = New-AzureADServicePrincipal -AppId $eventGridAppId
52+
}
53+
54+
# Creates the Azure app role for the webhook Azure AD application
55+
56+
$app = Get-AzureADApplication -ObjectId $webhookAppObjectId
57+
$appRoles = $app.AppRoles
58+
59+
Write-Host "Azure AD App roles before addition of the new role..."
60+
Write-Host $appRoles
61+
62+
if ($appRoles -match $eventGridRoleName)
63+
{
64+
Write-Host "The Azure Event Grid role is already defined.`n"
65+
} else {
66+
Write-Host "Creating the Azure Event Grid role in Azure AD Application: " $webhookAppObjectId
67+
$newRole = CreateAppRole -Name $eventGridRoleName -Description "Azure Event Grid Role"
68+
$appRoles.Add($newRole)
69+
Set-AzureADApplication -ObjectId $app.ObjectId -AppRoles $appRoles
70+
}
71+
72+
Write-Host "Azure AD App roles after addition of the new role..."
73+
Write-Host $appRoles
74+
75+
# Creates the user role assignment for the user who will create event subscription
76+
77+
$servicePrincipal = Get-AzureADServicePrincipal -Filter ("appId eq '" + $app.AppId + "'")
78+
79+
try
80+
{
81+
Write-Host "Creating the Azure Ad App Role assignment for user: " $eventSubscriptionWriterUserPrincipalName
82+
$eventSubscriptionWriterUser = Get-AzureAdUser -ObjectId $eventSubscriptionWriterUserPrincipalName
83+
$eventGridAppRole = $app.AppRoles | Where-Object -Property "DisplayName" -eq -Value $eventGridRoleName
84+
New-AzureADUserAppRoleAssignment -Id $eventGridAppRole.Id -ResourceId $servicePrincipal.ObjectId -ObjectId $eventSubscriptionWriterUser.ObjectId -PrincipalId $eventSubscriptionWriterUser.ObjectId
85+
}
86+
catch
87+
{
88+
if( $_.Exception.Message -like '*Permission being assigned already exists on the object*')
89+
{
90+
Write-Host "The Azure AD User Application role is already defined.`n"
91+
}
92+
else
93+
{
94+
Write-Error $_.Exception.Message
95+
}
96+
Break
97+
}
98+
99+
# Creates the service app role assignment for Event Grid Azure AD Application
100+
101+
$eventGridAppRole = $app.AppRoles | Where-Object -Property "DisplayName" -eq -Value $eventGridRoleName
102+
New-AzureADServiceAppRoleAssignment -Id $eventGridAppRole.Id -ResourceId $servicePrincipal.ObjectId -ObjectId $eventGridSP.ObjectId -PrincipalId $eventGridSP.ObjectId
103+
104+
# Print output references for backup
105+
106+
Write-Host ">> Webhook's Azure AD Application Id: $($app.AppId)"
107+
Write-Host ">> Webhook's Azure AD Application ObjectId Id: $($app.ObjectId)"
108+
}
109+
catch {
110+
Write-Host ">> Exception:"
111+
Write-Host $_
112+
Write-Host ">> StackTrace:"
113+
Write-Host $_.ScriptStackTrace
114+
}
115+
```
116+
117+
## Script explanation
118+
119+
For more details refer to [Secure WebHook delivery with Azure AD in Azure Event Grid](../secure-webhook-delivery.md)

0 commit comments

Comments
 (0)