Skip to content

Commit fd4918d

Browse files
ttorblettorble
authored
Merge pull request #274345 from KimForss/main
Add MSI support sample
2 parents 0447ebd + 7d7e783 commit fd4918d

File tree

2 files changed

+101
-59
lines changed

2 files changed

+101
-59
lines changed

‎articles/sap/automation/extensibility.md

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,6 @@ custom_scs_virtual_hostname: "myscshostname"
145145
custom_ers_virtual_hostname: "myershostname"
146146
custom_db_virtual_hostname: "mydbhostname"
147147
custom_pas_virtual_hostname: "mypashostname"
148-
custom_app_virtual_hostname: "myapphostname"
149148
```
150149

151150
You can use the `configuration_settings` variable to let Terraform add them to sap-parameters.yaml file.
@@ -155,8 +154,8 @@ configuration_settings = {
155154
custom_scs_virtual_hostname = "myscshostname",
156155
custom_ers_virtual_hostname = "myershostname",
157156
custom_db_virtual_hostname = "mydbhostname",
158-
custom_pas_virtual_hostname = "mypashostname",
159-
custom_app_virtual_hostname = "myapphostname"
157+
custom_pas_virtual_hostname = "mypashostname"
158+
160159
}
161160
162161
```

‎articles/sap/automation/get-started.md

Lines changed: 99 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -27,61 +27,11 @@ To get started with SAP Deployment Automation Framework, you need:
2727

2828
Some of the prerequisites might already be installed in your deployment environment. Both Azure Cloud Shell and the deployer come with Terraform and the Azure CLI installed.
2929

30-
### Create a service principal
31-
32-
The SAP automation deployment framework uses service principals for deployment.
33-
34-
When you choose a name for your service principal, make sure that the name is unique within your Azure tenant. Make sure to use an account with service principals creation permissions when running the script.
35-
36-
1. Create the service principal with Contributor permissions.
37-
38-
```cloudshell-interactive
39-
export ARM_SUBSCRIPTION_ID="<subscriptionId>"
40-
export control_plane_env_code="LAB"
41-
42-
az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/$ARM_SUBSCRIPTION_ID" --name="$control_plane_env_code-Deployment-Account"
43-
```
44-
45-
Review the output. For example:
46-
47-
```json
48-
{
49-
"appId": "<AppId>",
50-
"displayName": "<environment>-Deployment-Account ",
51-
"name": "<AppId>",
52-
"password": "<AppSecret>",
53-
"tenant": "<TenantId>"
54-
}
55-
```
56-
57-
1. Copy the output details. Make sure to save the values for `appId`, `password`, and `Tenant`.
58-
59-
The output maps to the following parameters. You use these parameters in later steps, with automation commands.
60-
61-
| Parameter input name | Output name |
62-
|--------------------------|-----------------|
63-
| `spn_id` | `appId` |
64-
| `spn_secret` | `password` |
65-
| `tenant_id` | `tenant` |
66-
67-
1. Optionally, assign the User Access Administrator role to the service principal.
68-
69-
```cloudshell-interactive
70-
export appId="<appId>"
71-
72-
az role assignment create --assignee $appId --role "User Access Administrator" --scope /subscriptions/$ARM_SUBSCRIPTION_ID
73-
```
74-
75-
76-
> [!IMPORTANT]
77-
> If you don't assign the User Access Administrator role to the service principal, you can't assign permissions using the automation framework.
7830

7931
### Create a user assigned Identity
8032

81-
8233
The SAP automation deployment framework can also use a user assigned identity (MSI) for the deployment. Make sure to use an account with permissions to create managed identities when running the script that creates the identity.
8334

84-
8535
1. Create the managed identity.
8636

8737
```cloudshell-interactive
@@ -116,39 +66,132 @@ The SAP automation deployment framework can also use a user assigned identity (M
11666
|--------------------------|-----------------|
11767
| `app_id` | `appId` |
11868
| `msi_id` | `armId` |
69+
| `msi_objectid` | `objectId` |
11970
12071
12172
1. Assign the Contributor role to the identity.
12273
12374
```cloudshell-interactive
12475
export appId="<appId>"
12576
126-
az role assignment create --assignee $appId --role "Contributor" --scope /subscriptions/$ARM_SUBSCRIPTION_ID
77+
az role assignment create --assignee $msi_objectid --role "Contributor" --scope /subscriptions/$ARM_SUBSCRIPTION_ID
12778
```
12879
12980
1. Optionally, assign the User Access Administrator role to the identity.
13081
13182
```cloudshell-interactive
13283
export appId="<appId>"
13384
134-
az role assignment create --assignee $appId --role "User Access Administrator" --scope /subscriptions/$ARM_SUBSCRIPTION_ID
85+
az role assignment create --assignee $msi_objectid --role "User Access Administrator" --scope /subscriptions/$ARM_SUBSCRIPTION_ID
13586
```
13687
13788
13889
> [!IMPORTANT]
13990
> If you don't assign the User Access Administrator role to the managed identity, you can't assign permissions using the automation framework.
14091
92+
### Create an application registration for the web application
93+
94+
The SAP automation deployment framework can leverage an Azure App Service for configuring the tfvars parameter files.
95+
96+
1. Create the application registration.
97+
98+
```powershell
99+
$ApplicationName="<App Registration Name>"
100+
$MSI_objectId="<msi_objectid>"
101+
102+
Write-Host "Creating an App Registration for" $ApplicationName -ForegroundColor Green
103+
104+
if (Test-Path $manifestPath) { Write-Host "Removing manifest.json" ; Remove-Item $manifestPath }
105+
Add-Content -Path manifest.json -Value '[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4683d","type":"Scope"}]}]'
106+
107+
$APP_REGISTRATION_ID = $(az ad app create --display-name $ApplicationName --enable-id-token-issuance true --sign-in-audience AzureADMyOrg --required-resource-access $manifestPath --query "appId" --output tsv)
108+
109+
Write-Host "App Registration created with App ID: $APP_REGISTRATION_ID"
110+
111+
Write-Host "Waiting for the App Registration to be created" -ForegroundColor Green
112+
Start-Sleep -s 20
113+
114+
$ExistingData = $(az ad app list --all --filter "startswith(displayName, '$ApplicationName')" --query "[?displayName=='$ApplicationName']| [0]" --only-show-errors) | ConvertFrom-Json
115+
116+
$APP_REGISTRATION_OBJECTID = $ExistingData.id
117+
118+
if (Test-Path $manifestPath) { Write-Host "Removing manifest.json" ; Remove-Item $manifestPath }
119+
120+
Write-Host "Configuring authentication for the App Registration" -ForegroundColor Green
121+
az rest --method POST --uri "https://graph.microsoft.com/beta/applications/$APP_REGISTRATION_OBJECTID/federatedIdentityCredentials\" --body "{'name': 'ManagedIdentityFederation', 'issuer': 'https://login.microsoftonline.com/$ARM_TENANT_ID/v2.0', 'subject': '$MSI_objectId', 'audiences': [ 'api://AzureADTokenExchange' ]}"
122+
123+
$API_URL="https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/~/ProtectAnAPI/appId/$APP_REGISTRATION_ID/isMSAApp~/false"
124+
125+
Write-Host "The browser will now open, Please Add a new scope, by clicking the '+ Add a new scope link', accept the default name and click 'Save and Continue'"
126+
Write-Host "In the Add a scope page enter the scope name 'user_impersonation'. Choose 'Admins and Users' in the who can consent section, next provide the Admin consent display name 'Access the SDAF web application' and 'Use SDAF' as the Admin consent description, accept the changes by clicking the 'Add scope' button"
127+
128+
Start-Process $API_URL
129+
Read-Host -Prompt "Once you have created and validated the scope, Press any key to continue"
130+
131+
132+
```
133+
134+
135+
136+
### Create a service principal
137+
138+
The SAP automation deployment framework can use service principals for deployment.
139+
140+
When you choose a name for your service principal, make sure that the name is unique within your Azure tenant. Make sure to use an account with service principals creation permissions when running the script.
141+
142+
1. Create the service principal with Contributor permissions.
143+
144+
```cloudshell-interactive
145+
export ARM_SUBSCRIPTION_ID="<subscriptionId>"
146+
export control_plane_env_code="LAB"
147+
148+
az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/$ARM_SUBSCRIPTION_ID" --name="$control_plane_env_code-Deployment-Account"
149+
```
150+
151+
Review the output. For example:
152+
153+
```json
154+
{
155+
"appId": "<AppId>",
156+
"displayName": "<environment>-Deployment-Account ",
157+
"name": "<AppId>",
158+
"password": "<AppSecret>",
159+
"tenant": "<TenantId>"
160+
}
161+
```
162+
163+
1. Copy the output details. Make sure to save the values for `appId`, `password`, and `Tenant`.
164+
165+
The output maps to the following parameters. You use these parameters in later steps, with automation commands.
166+
167+
| Parameter input name | Output name |
168+
|--------------------------|-----------------|
169+
| `spn_id` | `appId` |
170+
| `spn_secret` | `password` |
171+
| `tenant_id` | `tenant` |
172+
173+
1. Optionally, assign the User Access Administrator role to the service principal.
174+
175+
```cloudshell-interactive
176+
export appId="<appId>"
177+
178+
az role assignment create --assignee $appId --role "User Access Administrator" --scope /subscriptions/$ARM_SUBSCRIPTION_ID
179+
```
180+
181+
182+
> [!IMPORTANT]
183+
> If you don't assign the User Access Administrator role to the service principal, you can't assign permissions using the automation framework.
141184
142185
## Pre-flight checks
143186
144187
You can use the following script to perform pre-flight checks. The script performs the following checks and tests:
145188
146189
- Checks if the service principal has the correct permissions to create resources in the subscription.
147190
- Checks if the service principal has user Access Administrator permissions.
148-
- Create a Azure Virtual Network.
149-
- Create a Azure Virtual Key Vault with private end point.
150-
- Create a Azure Files NSF share.
151-
- Create a Azure Virtual Virtual Machine with data disk using Premium Storage v2.
191+
- Create an Azure Virtual Network.
192+
- Create an Azure Virtual Key Vault with private end point.
193+
- Create an Azure Files NSF share.
194+
- Create an Azure Virtual Machine with data disk using Premium Storage v2.
152195
- Check access to the required URLs using the deployed virtual machine.
153196
154197
```powershell

0 commit comments

Comments
 (0)