Add Support for seqcli create user type=Entra

[Mike-E-angelo]

Reference discussion:
#2067

For automation purposes, it would be super valuable to be able to create a new Entra ID user and assign it as the administrator of the new server instance. Currently the only way this can be done is with user/pass which at this point in time seems a little ol'-fashioned. 😁

Thank you for any consideration. 🙏

[nblumhardt]

Hi Michael,

I think this will/should be possible with Seq 2024.1 and its corresponding seqcli.

The basic workflow will be:

• Set a username and password on first run, i.e. with SEQ_FIRSTRUN_*, as per the normal container deployment process
  • The username should be your AAD one, e.g. example@microsoftonline.com or similar
• Use those credentials with seqcli to create an API key with admin permissions
• Use the seqcli setting set command to configure values for the AAD provider (but don't enable it yet)
  • AzureADAuthority (I think this should be https://login.microsoftonline.com IIRC)
  • AzureADClientId
  • AzureADClientKey
  • AzureADTenantId
• Finally, set AuthenticationProvider to `"Azure Active Directory"

This should be enough to get things going, though I can't check through right now.

(Guess we'll need to create some Entra* aliases for all of these sometime soon 😅 )

HTH!

[Mike-E-angelo]

SUCCESS! :D WOOHOO! That is awesome. Everything works! This is what I ended up using:

seqcli setting set -n=AzureADAuthority -v="login.microsoftonline.com" -s $Address --apikey=$system
seqcli setting set -n=AzureADClientId -v="$application" -s $Address --apikey=$system
seqcli setting set -n=AzureADClientKey -v="$secret" -s $Address --apikey=$system
seqcli setting set -n=AzureADTenantId -v="$TenantId" -s $Address --apikey=$system
seqcli setting set -n=AuthenticationProvider -v="Azure Active Directory" -s $Address --apikey=$system

Note that AzureADAuthority does not contain https://. 👍

There is one minor issue in that I am not able to delete the administrative API key after this because of the AuthenticationProvider mode. I have to delete it from the dashboard upon login. All things considered this is a minor nit as everything else works perfectly now, but if there's any thought you could lend towards allowing this to be deleted via automation it would be appreciated.

Thank you again for all your help! This is truly wonderful. 🙏

[mloskot]

First, thanks for the detailed discussion which seems to be reproducible for any non-interactive Seq deployment with Entra ID authentication.

Am I correct seeing that these AzureAD* settings are not documented anywhere at https://datalust.co/docs/ ?

[Mike-E-angelo]

Ah indeed, @mloskot, to add to the churn and fun, AzureAD* has since been replaced with EntraID*. From my current script:

        seqcli setting set -n=EntraIDAuthority -v="login.microsoftonline.com" -s $Address --apikey=$system
        seqcli setting set -n=EntraIDClientId -v="$application" -s $Address --apikey=$system
        seqcli setting set -n=EntraIDClientKey -v="$secret" -s $Address --apikey=$system
        seqcli setting set -n=EntraIDTenantId -v="$TenantId" -s $Address --apikey=$system
        seqcli setting set -n=AuthenticationProvider -v="Microsoft Entra ID" -s $Address --apikey=$system

[nblumhardt]

Thanks for the nudge RE the documentation gap! Until we fix that, although coverage isn't quite 100%, you can find the bulk of these settings described in:

https://github.com/datalust/seq-api/blob/dev/src/Seq.Api/Model/Settings/SettingName.cs#L27

[mloskot]

@nblumhardt That will help too, thank you!