You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
1. Update the application's group membership claims:
56
+
1. To grant "Sign in and read user profile" API permissions to the server application. Copy this JSON and save it in a file called oauth2-permissions.json:
55
57
56
-
```azurecli
57
-
az ad app update --id "${SERVER_APP_ID}" --set groupMembershipClaims=All
58
+
```json
59
+
{
60
+
"oauth2PermissionScopes": [
61
+
{
62
+
"adminConsentDescription": "Sign in and read user profile",
63
+
"adminConsentDisplayName": "Sign in and read user profile",
64
+
"id": "<unique_guid>",
65
+
"isEnabled": true,
66
+
"type": "User",
67
+
"userConsentDescription": "Sign in and read user profile",
68
+
"userConsentDisplayName": "Sign in and read user profile",
69
+
"value": "User.Read"
70
+
}
71
+
]
72
+
}
73
+
```
74
+
75
+
1. Update the application's group membership claims. Run the commands in the same directory as `oauth2-permissions.json` file. RBAC for Azure Arc-enabled Kubernetes requires [`signInAudience` to be set to **AzureADMyOrg**](/azure/active-directory/develop/supported-accounts-validation):
76
+
77
+
```azurecli
78
+
az ad app update --id "${SERVER_APP_ID}" --set groupMembershipClaims=All
1. Create a service principal and get its `password` field value. This value is required later as `serverApplicationSecret` when you're enabling this feature on the cluster. Please note that this secret is valid for 1 year by default and will need to be [rotated after that](./azure-rbac.md#refresh-the-secret-of-the-server-application). Please refer to [this](/cli/azure/ad/sp/credential?view=azure-cli-latest&preserve-view=true#az-ad-sp-credential-reset) to set a custom expiry duration.
1. Grant "Sign in and read user profile" API permissions to the application:
93
+
1. Grant "Sign in and read user profile" API permissions to the application. [Additional information](/cli/azure/ad/app/permission?view=azure-cli-latest#az-ad-app-permission-add-examples):
68
94
69
95
```azurecli
70
-
az ad app permission add --id "${SERVER_APP_ID}" --api 00000003-0000-0000-c000-000000000000 --api-permissions e1fe6dd8-ba31-4d61-89e7-88639da4683d=Scope
71
-
az ad app permission grant --id "${SERVER_APP_ID}" --api 00000003-0000-0000-c000-000000000000
96
+
az ad app permission add --id "${SERVER_APP_ID}" --api 00000003-0000-0000-c000-000000000000 --api-permissions e1fe6dd8-ba31-4d61-89e7-88639da4683d=Scope
97
+
az ad app permission grant --id "${SERVER_APP_ID}" --api 00000003-0000-0000-c000-000000000000 --scope User.Read
98
+
```
99
+
100
+
> [!NOTE]
101
+
> An Azure tenant administrator has to run this step.
102
+
>
103
+
> For usage of this feature in production, we recommend that you create a different server application for every cluster.
104
+
105
+
#### Create a client application
106
+
107
+
1. Create a new Azure AD application and get its `appId` value. This value is used in later steps as `clientApplicationId`.
2. Create a service principal for this client application:
117
+
118
+
```azurecli
119
+
az ad sp create --id "${CLIENT_APP_ID}"
120
+
```
121
+
122
+
3. Get the `oAuthPermissionId` value for the server application:
123
+
124
+
```azurecli
125
+
az ad app show --id "${SERVER_APP_ID}" --query "api.oauth2PermissionScopes[0].id" -o tsv
126
+
```
127
+
128
+
4. Grant the required permissions for the client application. RBAC for Azure Arc-enabled Kubernetes requires [`signInAudience` to be set to **AzureADMyOrg**](/azure/active-directory/develop/supported-accounts-validation):
129
+
130
+
```azurecli
131
+
az ad app permission add --id "${CLIENT_APP_ID}" --api "${SERVER_APP_ID}" --api-permissions <oAuthPermissionId>=Scope
132
+
RESOURCE_APP_ID=$(az ad app show --id "${CLIENT_APP_ID}" --query "requiredResourceAccess[0].resourceAppId" -o tsv)
133
+
az ad app permission grant --id "${CLIENT_APP_ID}" --api "${RESOURCE_APP_ID}" --scope User.Read
134
+
az ad app update --id ${CLIENT_APP_ID} --set signInAudience=AzureADMyOrg
135
+
CLIENT_OBJECT_ID=$(az ad app show --id "${CLIENT_APP_ID}" --query "id" -o tsv)
1. Update the application's group membership claims:
153
+
```azurecli
154
+
az ad app update --id "${SERVER_APP_ID}" --set groupMembershipClaims=All
155
+
```
156
+
157
+
1. Create a service principal and get its `password` field value. This value is required later as `serverApplicationSecret` when you're enabling this feature on the cluster. This secret is valid for one year by default and will need to be [rotated after that](./azure-rbac.md#refresh-the-secret-of-the-server-application). You can also [set a custom expiration duration](/cli/azure/ad/sp/credential?view=azure-cli-latest&preserve-view=true#az-ad-sp-credential-reset).
1. Grant "Sign in and read user profile" API permissions to the application. [Additional information](/cli/azure/ad/app/permission?view=azure-cli-latest#az-ad-app-permission-add-examples):
165
+
166
+
```azurecli
167
+
az ad app permission add --id "${SERVER_APP_ID}" --api 00000003-0000-0000-c000-000000000000 --api-permissions e1fe6dd8-ba31-4d61-89e7-88639da4683d=Scope
168
+
az ad app permission grant --id "${SERVER_APP_ID}" --api 00000003-0000-0000-c000-000000000000
72
169
```
73
170
74
171
> [!NOTE]
75
172
> An Azure tenant administrator has to run this step.
76
173
>
77
174
> For usage of this feature in production, we recommend that you create a different server application for every cluster.
78
175
79
-
### Create a client application
176
+
#### Create a client application
80
177
81
178
1. Create a new Azure AD application and get its `appId` value. This value is used in later steps as `clientApplicationId`.
1. The `azure-arc-guard-manifests` secret in the `kube-system` namespace contains two files `guard-authn-webhook.yaml` and `guard-authz-webhook.yaml`. Copy these files to the `/etc/guard` directory of the node.
0 commit comments