Skip to content

Commit ecf1cd0

Browse files
geekztergeekzter
authored
Add script to re-enable a service connection (#69)
1 parent cf688fe commit ecf1cd0

File tree

3 files changed

+125
-0
lines changed

3 files changed

+125
-0
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ This repo contains a few [PowerShell](https://github.com/PowerShell/PowerShell)
3030
- List identities for Azure DevOps Service Connections in Entra ID pertaining to Azure DevOps organization and (optionally) project: [list_service_connection_identities.ps1](scripts/azure-devops/list_service_connection_identities.ps1)
3131
- List Azure DevOps Service Connections in an Azure DevOps organization and project: [list_service_connections.ps1](scripts/azure-devops/list_service_connections.ps1)
3232
- 'Pretty-name' Entra ID applications created for Service Connections, so the Service Connection name is included in the application display name: [rename_service_connection_applications.ps1](scripts/azure-devops/rename_service_connection_applications.ps1)
33+
- Enable a disabled Service Connection with [enable_service_connection.ps1](scripts/azure-devops/enable_service_connection.ps1)
3334

3435
### Terraform-managed Azure Service Connection
3536

‎scripts/azure-devops/azure-pipelines.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,18 @@ jobs:
6868
vmImage: ubuntu-latest
6969

7070
steps:
71+
- task: AzureCLI@2
72+
displayName: 'enable_service_connection.ps1'
73+
inputs:
74+
azureSubscription: '$(azureConnectionWIF)'
75+
scriptType: pscore
76+
scriptLocation: inlineScript
77+
inlineScript: |
78+
Write-Host "`nSimulating enabling currently used service connection"
79+
./enable_service_connection.ps1 -ServiceConnectionId $env:AZURESUBSCRIPTION_SERVICE_CONNECTION_ID
80+
failOnStandardError: true
81+
workingDirectory: '$(scriptDirectory)'
82+
7183
- task: AzureCLI@2
7284
displayName: 'rename_service_connection_applications.ps1'
7385
inputs:

‎scripts/azure-devops/enable_service_connection.ps1‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
#!/usr/bin/env pwsh
2+
#Requires -Version 7.2
3+
4+
[CmdletBinding(DefaultParameterSetName = 'name')]
5+
param (
6+
[parameter(Mandatory=$false,ParameterSetName="id",HelpMessage="Id of the Service Connection")]
7+
[guid]
8+
$ServiceConnectionId,
9+
10+
[parameter(Mandatory=$false,ParameterSetName="name",HelpMessage="Name of the Service Connection")]
11+
[string]
12+
$ServiceConnectionName,
13+
14+
[parameter(Mandatory=$false,HelpMessage="Name of the Azure DevOps Project")]
15+
[string]
16+
[ValidateNotNullOrEmpty()]
17+
$Project=$env:SYSTEM_TEAMPROJECT,
18+
19+
[parameter(Mandatory=$false,HelpMessage="Url of the Azure DevOps Organization")]
20+
[uri]
21+
[ValidateNotNullOrEmpty()]
22+
$OrganizationUrl=($env:AZDO_ORG_SERVICE_URL ?? $env:SYSTEM_COLLECTIONURI)
23+
)
24+
Write-Verbose $MyInvocation.line
25+
. (Join-Path $PSScriptRoot .. functions.ps1)
26+
$apiVersion = "7.1"
27+
28+
#-----------------------------------------------------------
29+
# Log in to Azure
30+
if (-not (Get-Command az -ErrorAction SilentlyContinue)) {
31+
Write-Error "Azure CLI is not installed. You can get it here: http://aka.ms/azure-cli"
32+
exit 1
33+
}
34+
az account show -o json 2>$null | ConvertFrom-Json | Set-Variable account
35+
if (!$account) {
36+
az login --allow-no-subscriptions -o json | ConvertFrom-Json | Set-Variable account
37+
}
38+
# Log in to Azure & Azure DevOps
39+
$OrganizationUrl = $OrganizationUrl.ToString().Trim('/')
40+
az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 `
41+
--query "accessToken" `
42+
--output tsv `
43+
| Set-Variable accessToken
44+
if (!$accessToken) {
45+
Write-Error "$(account.user.name) failed to get access token for Azure DevOps"
46+
exit 1
47+
}
48+
if (!(az extension list --query "[?name=='azure-devops'].version" -o tsv)) {
49+
Write-Host "Adding Azure CLI extension 'azure-devops'..."
50+
az extension add -n azure-devops -y -o none
51+
}
52+
if ($lastexitcode -ne 0) {
53+
Write-Error "$($account.user.name) failed to log in to Azure DevOps organization '${OrganizationUrl}'"
54+
exit $lastexitcode
55+
}
56+
57+
#-----------------------------------------------------------
58+
# Check parameters
59+
az devops project show --project "${Project}" --organization $OrganizationUrl --query id -o tsv | Set-Variable projectId
60+
if (!$projectId) {
61+
Write-Error "Project '${Project}' not found in organization '${OrganizationUrl}"
62+
exit 1
63+
}
64+
65+
#-----------------------------------------------------------
66+
# Retrieve the service connection
67+
$baseEndpointUrl = "${OrganizationUrl}/${projectId}/_apis/serviceendpoint/endpoints"
68+
if ($ServiceConnectionId) {
69+
$getApiUrl = "${baseEndpointUrl}/${ServiceConnectionId}?includeDetails=true&api-version=${apiVersion}"
70+
} elseif ($ServiceConnectionName) {
71+
$getApiUrl = "${baseEndpointUrl}?endpointNames=${ServiceConnectionName}&type=azurerm&includeFailed=false&includeDetails=true&api-version=${apiVersion}"
72+
} else {
73+
$getApiUrl = "${baseEndpointUrl}?authSchemes=ServicePrincipal&type=azurerm&includeFailed=false&includeDetails=true&api-version=${apiVersion}"
74+
}
75+
Write-Debug "GET $getApiUrl"
76+
Invoke-RestMethod -Uri $getApiUrl `
77+
-Method GET `
78+
-ContentType 'application/json' `
79+
-Authentication Bearer `
80+
-Token (ConvertTo-SecureString $accessToken -AsPlainText) `
81+
-StatusCodeVariable httpStatusCode `
82+
| Set-Variable serviceEndpointResponse
83+
if ($ServiceConnectionId) {
84+
$serviceEndpoint = $serviceEndpointResponse
85+
} else {
86+
$serviceEndpointResponse | Select-Object -ExpandProperty value -First 1 `
87+
| Set-Variable serviceEndpoint
88+
}
89+
$serviceEndpoint | ConvertTo-Json -Depth 4 | Write-Debug
90+
if (!$serviceEndpoint.isDisabled) {
91+
Write-Host "Service Connection '$($serviceEndpoint.name)' ($($serviceEndpoint.id)) is already enabled"
92+
exit 0
93+
}
94+
95+
#-----------------------------------------------------------
96+
# Enable the service connection
97+
$serviceEndpoint.isDisabled = $false
98+
$serviceEndpoint | ConvertTo-Json -Depth 4 -Compress | Set-Variable serviceEndpointRequest
99+
$putApiUrl = "${baseEndpointUrl}/$($serviceEndpoint.id)?api-version=${apiVersion}"
100+
Write-Debug "PUT $putApiUrl"
101+
102+
Invoke-RestMethod -Uri $putApiUrl `
103+
-Method PUT `
104+
-Body $serviceEndpointRequest `
105+
-ContentType 'application/json' `
106+
-Authentication Bearer `
107+
-Token (ConvertTo-SecureString $accessToken -AsPlainText) `
108+
-StatusCodeVariable httpStatusCode `
109+
| Set-Variable serviceEndpoint
110+
111+
$serviceEndpoint | ConvertTo-Json -Depth 4 | Write-Debug
112+
$serviceEndpoint | Format-List

0 commit comments

Comments
 (0)