biganimal-csp-setup

#!/usr/bin/env bash
#
# Copyright 2021,2022 EnterpriseDB Corporation
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# This script is used to create a SPN(Service Principal Name) with enough
# permissions in your Azure subscription for handling the BigAnimal managed
# service, or update SPN with MS Graph API permissions.
#
# What it does:
#   - assume you have already login to your Azure AD(Active Directory) directory by Azure CLI
#   - set your Azure CLI context to the given subscription
#   - create a custom role with resource permissions documented in ./biganimal-poweruser-template.json
#   - create a new client app or update client app in the Azure AD directory
#   - grant the custom role to the client app 
#
# it finally outputs the:
#   - client app Id
#   - client app secret
#   - your Azure subscription Id
# These outputs will be used in the BigAnimal Signup submission form.
#
# For more details, please refer to
#  https://www.enterprisedb.com/docs/edbcloud/latest/getting_started/02_connect_cloud_account
#
set -e

display_name=""
subscription=""
years=""
client_id=""

spn=""
spn_role=""
app_id=""
role_id=""

CURRENT_PATH=$(pwd)
TMPDIR=$(mktemp -d)
function cleanup {
  rm -rf "${TMPDIR}"
}
trap cleanup EXIT
pushd "${TMPDIR}" >/dev/null || exit

show_help()
{
  echo "Required permissions:"
  echo "  Microsoft.Authorization/roleAssignments/write"
  echo "Required tools:"
  echo "  jq"
  echo "Usage:"
  echo "  $0 -d NAME -s SUBSCRIPTION_ID [-i CLIENT_ID] [options]"
  echo ""
  echo "Options:"
  echo "  -d, --display-name: The name of Azure AD App."
  echo "  -s, --subscription: The Azure Subscription ID used by BigAnimal."
  echo "  -t, --tenant:       [Optional] The Azure AD Tenant ID used by BigAnimal."
  echo "  -y, --years:        [Optional] The Number of years for which the credentials will be valid. Only accept positive integer value. Default: 1 year."
  echo "  -i, --id:           [Optional] The Application (client) ID of Service Principal will be updated."
  echo "  -h, --help:         Show this help."
  echo ""
}

check()
{
  # jq is required
  hash jq > /dev/null 2>&1 || { show_help; suggest "Error: please install jq on the system" alert; }
  check_az_version
  check_display_name
  check_subscription
  if [[ -n "${client_id}" && -z "${tenant}" ]]; then
    suggest "When specifiying the Azure AD Service Principal application ${client_id} you need to specify also the Azure AD tenant with -t|--tenant!" alert
    exit 1
  fi
}

suggest()
{
    local what=$1
    local highlight=$2

    RED='\033[0;31m'
    GREEN='\033[0;32m'
    NC='\033[0m'
    if [ "$highlight" = 'alert' ]; then
        echo -e "${RED}${what}${NC}"
    else
        echo -e "${GREEN}${what}${NC}"
    fi
}

# refer from
# https://stackoverflow.com/questions/4023830/how-to-compare-two-strings-in-dot-separated-version-format-in-bash
vercomp () {
    if [[ $1 == $2 ]]
    then
        return 0
    fi
    local IFS=.
    local i ver1=($1) ver2=($2)
    # fill empty fields in ver1 with zeros
    for ((i=${#ver1[@]}; i<${#ver2[@]}; i++))
    do
        ver1[i]=0
    done
    for ((i=0; i<${#ver1[@]}; i++))
    do
        if [[ -z ${ver2[i]} ]]
        then
            # fill empty fields in ver2 with zeros
            ver2[i]=0
        fi
        if ((10#${ver1[i]} > 10#${ver2[i]}))
        then
            return 1
        fi
        if ((10#${ver1[i]} < 10#${ver2[i]}))
        then
            return 2
        fi
    done
    return 0
}

#### Check Azure CLI version
function check_az_version {
  set +e
  version=$(az version --query \"azure-cli\" -o tsv)
  if command -v clouddrive &> /dev/null; then
    echo "Run Azure CSP setup with azure-cli ${version} in Azure Cloud shell"
  else
    # only support azure-cli >= 2.31.0
    vercomp "${version}" 2.31.0
    if [ $? -eq 2 ]; then
      suggest "Error: this script only supports azure-cli >= 2.31.0" alert
      exit 1
    fi
    echo "Run Azure CSP setup with azure-cli ${version}"
  fi

  # check if we are running azure-cli >= 2.37.0
  msgraphapi=true
  vercomp "${version}" 2.37.0
  if [ $? -eq 2 ]; then
    msgraphapi=false
  fi
  set -e
}

check_display_name()
{
  if [[ "${display_name}" == "" ]]; then
    show_help
    suggest "Error: missing -d, --display-name to specify Azure AD App name" alert
    exit 1
  fi
}

check_subscription()
{
  if [[ "${subscription}" == "" ]]; then
    show_help
    suggest "Error: missing -s, --subscription to specify Azure Subscription" alert
    exit 1
  fi
}

check_tenant()
{
  if [[ "${tenant}" == "" ]]; then
    show_help
    suggest "Error: missing -t, --tenant to specify Azure Tenant" alert
    exit 1
  fi
}

check_years()
{
  if [[ "${years}" == "" ]]; then
    show_help
    suggest "Error: -y, --years should have a value" alert
    exit 1
  fi
}

check_id()
{
  if [[ -n "${client_id}" ]]; then
    display_name=$(az ad app show --id "${client_id}" -o tsv --query displayName --only-show-errors)
  fi
}

download_dependencies()
{
  # a shell func to download all the dependencies of this script before starting to execute
  # Download the latest biganimal role template or overwrite it
  template_file=biganimal-poweruser-template.json
  curl https://raw.githubusercontent.com/EnterpriseDB/cloud-utilities/main/azure/${template_file} -o "${CURRENT_PATH}"/${template_file}
  if [[ -s "${CURRENT_PATH}/${template_file}" ]]; then
    echo "Downloaded ${CURRENT_PATH}/${template_file}"
  else
    echo "Error: failed to download ${CURRENT_PATH}/${template_file}"
    exit 1
  fi
}

retry ()
{
  local attempts=5
  local count=0
  until "$@"; do
    # shellcheck disable=SC2004
    wait=$((5 ** $count))
    # shellcheck disable=SC2004
    count=$(($count + 1))
    if [ $count -lt $attempts ]; then
      echo "Retrying in $wait seconds..."
      sleep $wait
    else
      echo "Retried $count attempts with failure, the command/function that has failed is:"
      echo "$@"
      return 0
    fi
  done
  return 0
}

while [[ $# -gt 0 ]]; do
  key="$1"

  case $key in
    -h|--help)
      show_help
      exit 0
      ;;
    -i|--id)
      client_id="$2"
      check_id
      shift 2
      ;;
    -d|--display-name)
      display_name="$2"
      check_display_name
      shift 2
      ;;
    -s|--subscription)
      subscription="$2"
      check_subscription
      shift 2
      ;;
    -t|--tenant)
      tenant="$2"
      check_tenant
      shift 2
      ;;
    -y|--years)
      years="$2"
      check_years
      shift 2
      ;;
    *)
      shift
      ;;
  esac
done

set_subscription()
{
  echo "Change to use Azure Subscription ${subscription}..."
  az account set --subscription "${subscription}"
}

show_account()
{
  az account show
}

create_or_update_custom_role()
{
  # get custom role id
  echo "Create or update custom role"
  role_name="biganimal-poweruser-${subscription}"
  roleScope="/subscriptions/${subscription}"
  role_id=$(az role definition list --only-show-errors --query "[?roleName=='${role_name}'].id" -o tsv)
  jq --arg rolename "$role_name" --arg scope "$roleScope" '(.Name) |= $rolename | (.assignableScopes[]) |= $scope' \
    "${CURRENT_PATH}"/biganimal-poweruser-template.json > "${CURRENT_PATH}"/biganimal-poweruser.json
  if [[ -z "${role_id}" ]]; then
    echo "Did not find the custom role, creating it..."
    create_custom_role
  else
    echo "Fetched role is ${role_id}"
    retry update_custom_role
  fi
}

wait_for_custom_role()
{
  role_name="biganimal-poweruser-${subscription}"
  role_id=$(az role definition list --only-show-errors --query "[?roleName=='${role_name}'].id" -o tsv)
  if [[ -z "${role_id}" ]]; then
    echo "Did not find the custom role, checking again in a while..."
    return 1
  else
    echo "Custom role exists with ID ${role_id}, proceeding..."
    return 0
  fi
}

check_custom_role()
{
  # check for custom role existance
  # sometimes Azure AD requires time to propagate it as staten here
  # https://learn.microsoft.com/en-us/azure/role-based-access-control/troubleshooting?source=recommendations&tabs=bicep#symptom---assigning-a-role-to-a-new-principal-sometimes-fails
  retry wait_for_custom_role
  if [[ -z "${role_id}" ]]; then
    suggest "The Azure AD Custom Role creation/replication has not completed successfully! Please retry in a few minutes..." alert
    exit 1
  fi
}

wait_for_spn()
{
  spn_exist=$(az ad sp list --spn "${app_id}" | jq -r 'length')
  if (( spn_exist > 0 )); then
    echo "Updating Azure AD Service Principal application ${app_id} and configuring its access to Azure resources in subscription ${subscription}..."
    spn_role=$(az role assignment create --assignee "${app_id}" --role "${role_name}" --scope /subscriptions/"${subscription}" --only-show-errors)
    if [[ -z "${spn_role}" ]]; then
      echo "Did not find the role, Azure may need some time to replicate the role, checking again in a while..."
      return 1
    fi
    return 0
  else
    echo "Did not find the SPN, checking again in a while..."
    return 1
  fi
}

create_ad_sp()
{
  echo "rolename: ${role_name}"
  # create or update SPN using azure-cli
  years="${years:-1}"
  if [[ -z "${client_id}" ]]; then
    echo "Creating Azure AD Service Principal in subscription ${subscription}..."
    spn=$(az ad sp create-for-rbac -o json -n "${display_name}" --only-show-errors --years "${years}")
    app_id=$(echo "${spn}" | jq -r .appId)
    retry wait_for_spn
    if [[ -z "${spn_role}" ]]; then
      suggest "cannot find the role ${role_name}, Azure may need more minutes to replicate the role" alert
      suggest "please wait for the role ${role_name} replication, clean up the SPN ${display_name} and retry later" alert
      exit 1
    fi
  else
    echo "Checking if Azure AD Service Principal application ${client_id} already exists in subscription ${subscription} and tenant ${tenant}..."
    spn_exist=$(az ad sp list --spn "${client_id}" | jq -r 'length')
    if (( spn_exist > 0 )); then
      echo "Updating Azure AD Service Principal application ${client_id} in subscription ${subscription} and tenant ${tenant}..."
      spn=$(az ad sp credential reset --id "${client_id}" --display-name "${display_name}" --append --years "${years}" --only-show-errors)
      spn_role=$(az role assignment create --assignee "${client_id}" --role "${role_name}" --scope /subscriptions/"${subscription}" --only-show-errors)
    else
      suggest "Azure AD Service Principal application ${client_id} does NOT exists in subscription ${subscription} and tenant ${tenant}!" alert
      exit 1
    fi
  fi
}

add_spn_owners()
{
  # add current user and spn to the SPN owner list
  if [[ -z "${client_id}" ]]; then
    client_id=$(echo "${spn}" | jq -r .appId)
  else
    skip_addowners="true"
  fi
  # The following checks changes starting from Azure CLI 2.37 due to the usage of MS Graph APIs
  # refers to https://github.com/Azure/azure-cli/issues/22580
  if [ "$msgraphapi" = "false" ]; then
    sp_object_id=$(az ad sp show --id "${client_id}" -o tsv --query objectId --only-show-errors)
    user_object_id=$(az ad signed-in-user show -o tsv --query objectId --only-show-errors)
  else
    sp_object_id=$(az ad sp show --id "${client_id}" -o tsv --query id --only-show-errors)
    user_object_id=$(az ad signed-in-user show -o tsv --query id --only-show-errors)
  fi

  echo "Add Azure AD Service Principal Owners..."
  # To add owners to application
  az ad app owner add --id "${client_id}" --owner-object-id "${sp_object_id}" --only-show-errors
  az ad app owner add --id "${client_id}" --owner-object-id "${user_object_id}" --only-show-errors

  # To add owners to service principal
  # this doesn't need to be done while updating an existing SPN, and if done it fails with
  # One or more added object references already exist for the following modified properties: 'owners'
  if [[ -z "${skip_addowners}" ]]; then
    retry az rest -m POST -u https://graph.microsoft.com/beta/servicePrincipals/"${sp_object_id}"/owners/\$ref \
      --headers Content-Type=application/json --output none \
      -b "{\"@odata.id\": \"https://graph.microsoft.com/beta/servicePrincipals/${sp_object_id}\"}"
  fi
}

create_custom_role()
{
  # create custom role for the SPN
  echo "Creating custom role for Azure AD Service Principal..."
  az role definition create --subscription "${subscription}" --role-definition "${CURRENT_PATH}"/biganimal-poweruser.json \
    --only-show-errors
}

update_custom_role()
{
  # update custom role for the SPN
  echo "update custom role for Azure AD Service Principal..."
  az role definition update --subscription "${subscription}" --role-definition "${CURRENT_PATH}"/biganimal-poweruser.json \
    --only-show-errors
}

grant_api_permissions()
{
  # Add graph API permissions to the SPN, and grant admin consent
  if [ "$msgraphapi" = "false" ]; then
    sp_object_id=$(az ad sp show --id "${client_id}" -o tsv --query objectId --only-show-errors)
  else
    sp_object_id=$(az ad sp show --id "${client_id}" -o tsv --query id --only-show-errors)
  fi
  # Microsoft Graph Application ID: 00000003-0000-0000-c000-000000000000
  # retrieve Application.ReadWrite.OwnedBy appId: 18a4783c-866b-4cc7-a460-3d5e5662c884
  # az ad sp show --id 00000003-0000-0000-c000-000000000000 \
  #   --query "appRoles[?value=='Application.ReadWrite.OwnedBy']"
  # retrieve Directory.Read.All appId: 7ab1d382-f21e-4acd-a863-ba3e13f7da61
  # az ad sp show --id 00000003-0000-0000-c000-000000000000 \
  #  --query "appRoles[?value=='Directory.Read.All']"
  # To add API permissions
  # Application.ReadWrite.OwnedBy
  az ad app permission add --id "${client_id}" --only-show-errors \
    --api 00000003-0000-0000-c000-000000000000 \
    --api-permissions 18a4783c-866b-4cc7-a460-3d5e5662c884=Role

  # Directory.Read.All
  az ad app permission add --id "${client_id}" --only-show-errors \
    --api 00000003-0000-0000-c000-000000000000 \
    --api-permissions 7ab1d382-f21e-4acd-a863-ba3e13f7da61=Role

  # To grant admin
  if [ "$msgraphapi" = "false" ]; then
    resourceId=$(az ad sp show --id 00000003-0000-0000-c000-000000000000 --query "objectId" --output tsv --only-show-errors)
  else
    resourceId=$(az ad sp show --id 00000003-0000-0000-c000-000000000000 --query "id" --output tsv --only-show-errors)
  fi
  az rest --method POST \
    --uri https://graph.microsoft.com/v1.0/servicePrincipals/"${sp_object_id}"/appRoleAssignments \
    --headers Content-Type=application/json --output none \
    --body "{
      \"principalId\": \"${sp_object_id}\",
      \"resourceId\": \"${resourceId}\",
      \"appRoleId\": \"18a4783c-866b-4cc7-a460-3d5e5662c884\"}" 2>${TMPDIR}/OUTPUT || true
  az rest --method POST \
    --uri https://graph.microsoft.com/v1.0/servicePrincipals/"${sp_object_id}"/appRoleAssignments \
    --headers Content-Type=application/json --output none \
    --body "{
      \"principalId\": \"${sp_object_id}\",
      \"resourceId\": \"${resourceId}\",
      \"appRoleId\": \"7ab1d382-f21e-4acd-a863-ba3e13f7da61\"}" 2>>${TMPDIR}/OUTPUT || true
  # catch Authorization_RequestDenied exception messages
  [[ $(cat ${TMPDIR}/OUTPUT) == *"Authorization_RequestDenied"* ]] && echo -e "\033[0;31mError: Please request Azure AD Global Administrator or Privileged Role Administrator to grant admin consent permissions for Service Principal ${display_name}(${client_id})\033[0m" && exit 1
  return 0
}

print_and_save_result()
{
  local client_secret="N/A"
  [[ -n "${spn}" ]] && client_secret=$(echo "${spn}" | jq -r .password)
  tenant=$(az account show -s "${subscription}" -o json | jq -r .tenantId)
  jq --null-input \
    --arg client_id "${client_id}" \
    --arg client_secret "REDACTED" \
    --arg subscription "${subscription}" \
    --arg tenant "${tenant}" \
    '{"client_id":$client_id,"client_secret":$client_secret,"subscription_id":$subscription,"tenant_id":$tenant}'
  # exporting JSON "ba-passport.json" that will be used by BigAnimal CLI
  echo "{\"client_id\":\"${client_id}\",\"client_secret\":\"${client_secret}\",\"subscription_id\":\"${subscription}\",\"tenant_id\":\"${tenant}\"}" > "$CURRENT_PATH"/ba-passport.json
}

check
download_dependencies
set_subscription
show_account
create_or_update_custom_role
check_custom_role
create_ad_sp
add_spn_owners
grant_api_permissions
print_and_save_result