|
| 1 | +--- |
| 2 | +title: Azure PowerShell - Secure WebHook delivery with Azure AD Application in Azure Event Grid |
| 3 | +description: Describes how to deliver events to HTTPS endpoints protected by Azure AD Application using Azure Event Grid |
| 4 | +ms.devlang: powershell |
| 5 | +ms.topic: sample |
| 6 | +ms.date: 09/29/2021 |
| 7 | +--- |
| 8 | + |
| 9 | +# Secure WebHook delivery with Azure AD Application in Azure Event Grid |
| 10 | + |
| 11 | +This script provides the configuration to deliver events to HTTPS endpoints protected by Azure AD Application using Azure Event Grid. |
| 12 | + |
| 13 | +## Sample script - stable |
| 14 | + |
| 15 | +```azurepowershell |
| 16 | +# NOTE: Before run this script ensure you are logged in Azure by using "az login" command. |
| 17 | +
|
| 18 | +$webhookAppObjectId = "[REPLACE_WITH_YOUR_ID]" |
| 19 | +$eventSubscriptionWriterAppId = "[REPLACE_WITH_YOUR_ID]" |
| 20 | +
|
| 21 | +# Start execution |
| 22 | +try { |
| 23 | +
|
| 24 | + # Creates an application role of given name and description |
| 25 | +
|
| 26 | + Function CreateAppRole([string] $Name, [string] $Description) |
| 27 | + { |
| 28 | + $appRole = New-Object Microsoft.Open.AzureAD.Model.AppRole |
| 29 | + $appRole.AllowedMemberTypes = New-Object System.Collections.Generic.List[string] |
| 30 | + $appRole.AllowedMemberTypes.Add("Application"); |
| 31 | + $appRole.AllowedMemberTypes.Add("User"); |
| 32 | + $appRole.DisplayName = $Name |
| 33 | + $appRole.Id = New-Guid |
| 34 | + $appRole.IsEnabled = $true |
| 35 | + $appRole.Description = $Description |
| 36 | + $appRole.Value = $Name; |
| 37 | +
|
| 38 | + return $appRole |
| 39 | + } |
| 40 | +
|
| 41 | + # Creates Azure Event Grid Azure AD Application if not exists |
| 42 | +
|
| 43 | + $eventGridAppId = "4962773b-9cdb-44cf-a8bf-237846a00ab7" # You don't need to modify this id |
| 44 | + $eventGridRoleName = "AzureEventGridSecureWebhookSubscriber" # You don't need to modify this role name |
| 45 | + $eventGridSP = Get-AzureADServicePrincipal -Filter ("appId eq '" + $eventGridAppId + "'") |
| 46 | + if ($eventGridSP -match "Microsoft.EventGrid") |
| 47 | + { |
| 48 | + Write-Host "The Azure AD Application is already defined.`n" |
| 49 | + } else { |
| 50 | + Write-Host "Creating the Azure Event Grid Azure AD Application" |
| 51 | + $eventGridSP = New-AzureADServicePrincipal -AppId $eventGridAppId |
| 52 | + } |
| 53 | +
|
| 54 | + # Creates the Azure app role for the webhook Azure AD application |
| 55 | +
|
| 56 | + $app = Get-AzureADApplication -ObjectId $webhookAppObjectId |
| 57 | + $appRoles = $app.AppRoles |
| 58 | +
|
| 59 | + Write-Host "Azure AD App roles before addition of the new role..." |
| 60 | + Write-Host $appRoles |
| 61 | + |
| 62 | + if ($appRoles -match $eventGridRoleName) |
| 63 | + { |
| 64 | + Write-Host "The Azure Event Grid role is already defined.`n" |
| 65 | + } else { |
| 66 | + Write-Host "Creating the Azure Event Grid role in Azure AD Application: " $webhookAppObjectId |
| 67 | + $newRole = CreateAppRole -Name $eventGridRoleName -Description "Azure Event Grid Role" |
| 68 | + $appRoles.Add($newRole) |
| 69 | + Set-AzureADApplication -ObjectId $app.ObjectId -AppRoles $appRoles |
| 70 | + } |
| 71 | +
|
| 72 | + Write-Host "Azure AD App roles after addition of the new role..." |
| 73 | + Write-Host $appRoles |
| 74 | +
|
| 75 | + # Creates the user role assignment for the app that will create event subscription |
| 76 | +
|
| 77 | + $servicePrincipal = Get-AzureADServicePrincipal -Filter ("appId eq '" + $app.AppId + "'") |
| 78 | + $eventSubscriptionWriterSP = Get-AzureADServicePrincipal -Filter ("appId eq '" + $eventSubscriptionWriterAppId + "'") |
| 79 | +
|
| 80 | + if ($null -eq $eventSubscriptionWriterSP) |
| 81 | + { |
| 82 | + Write-Host "Create new Azure AD Application" |
| 83 | + $eventSubscriptionWriterSP = New-AzureADServicePrincipal -AppId $eventSubscriptionWriterAppId |
| 84 | + } |
| 85 | +
|
| 86 | + try |
| 87 | + { |
| 88 | + Write-Host "Creating the Azure AD Application role assignment: " $eventSubscriptionWriterAppId |
| 89 | + $eventGridAppRole = $app.AppRoles | Where-Object -Property "DisplayName" -eq -Value $eventGridRoleName |
| 90 | + New-AzureADServiceAppRoleAssignment -Id $eventGridAppRole.Id -ResourceId $servicePrincipal.ObjectId -ObjectId $eventSubscriptionWriterSP.ObjectId -PrincipalId $eventSubscriptionWriterSP.ObjectId |
| 91 | + } |
| 92 | + catch |
| 93 | + { |
| 94 | + if( $_.Exception.Message -like '*Permission being assigned already exists on the object*') |
| 95 | + { |
| 96 | + Write-Host "The Azure AD Application role is already defined.`n" |
| 97 | + } |
| 98 | + else |
| 99 | + { |
| 100 | + Write-Error $_.Exception.Message |
| 101 | + } |
| 102 | + Break |
| 103 | + } |
| 104 | +
|
| 105 | + # Creates the service app role assignment for Event Grid Azure AD Application |
| 106 | +
|
| 107 | + $eventGridAppRole = $app.AppRoles | Where-Object -Property "DisplayName" -eq -Value $eventGridRoleName |
| 108 | + New-AzureADServiceAppRoleAssignment -Id $eventGridAppRole.Id -ResourceId $servicePrincipal.ObjectId -ObjectId $eventGridSP.ObjectId -PrincipalId $eventGridSP.ObjectId |
| 109 | + |
| 110 | + # Print output references for backup |
| 111 | +
|
| 112 | + Write-Host ">> Webhook's Azure AD Application Id: $($app.AppId)" |
| 113 | + Write-Host ">> Webhook's Azure AD Application ObjectId Id: $($app.ObjectId)" |
| 114 | +} |
| 115 | +catch { |
| 116 | + Write-Host ">> Exception:" |
| 117 | + Write-Host $_ |
| 118 | + Write-Host ">> StackTrace:" |
| 119 | + Write-Host $_.ScriptStackTrace |
| 120 | +} |
| 121 | +``` |
| 122 | + |
| 123 | +## Script explanation |
| 124 | + |
| 125 | +For more details refer to [Secure WebHook delivery with Azure AD in Azure Event Grid](../secure-webhook-delivery.md) |
0 commit comments