azure-credentials 0.1.0 → 0.1.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +3 -0
- data/README.md +200 -1
- data/lib/azure/utility/credentials.rb +2 -0
- metadata +3 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: d015636105219fe395b34b8c497d2a54b420318c
|
|
4
|
+
data.tar.gz: 992ef3a04c449291c20a7913216a28975e0a925a
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: a4f507fe2986ff3a3eb1d61e33474e7d8a13bf3928b11470da768b4ea7aca9497c4065b062a626d92958d382d3f7eaa2d90b53663cd217fa6cdc96281d5b9c43
|
|
7
|
+
data.tar.gz: 32b0be55e10178dcd02efb71695f4e0e260b7e6f4a35c42dd22ffe8593a17044396cb54aca4e662486a1411d6a06911b4350fe8ba9525f02cb4e95951af0c971
|
data/CHANGELOG.md
ADDED
data/README.md
CHANGED
|
@@ -1,4 +1,203 @@
|
|
|
1
1
|
# azure-credentials
|
|
2
2
|
|
|
3
|
-
A
|
|
3
|
+
A tool to provide assistance for those struggling to create Applications, Service Principals and perform Role Assignments in Azure Resource Manager.
|
|
4
|
+
Generate your credentials file/helper for Chef, Puppet, Terraform and others!
|
|
4
5
|
|
|
6
|
+
## Background
|
|
7
|
+
|
|
8
|
+
Automated access to Azure Resource Manager usually requires PowerShell or the Azure-CLI and to follow the (many) manual steps in [create and authenticate a service principal](https://azure.microsoft.com/en-us/documentation/articles/resource-group-authenticate-service-principal/#authenticate-service-principal-with-password---azure-cli) to allow you to eventually retrieve 4 pieces of information:
|
|
9
|
+
|
|
10
|
+
1. **Subscription ID**
|
|
11
|
+
2. **Client ID**
|
|
12
|
+
3. **Client Secret/Password**
|
|
13
|
+
4. **Tenant ID**
|
|
14
|
+
|
|
15
|
+
... you then use this information to configure your provisioning system. This tool (created in Ruby) requires only the credentials of the user with global administrator privilege and does the rest of the work for you, making it easier and quicker to get started with the various provisioning and testing toolsets out there.
|
|
16
|
+
|
|
17
|
+
## Installation
|
|
18
|
+
|
|
19
|
+
The tool is distributed as a [Ruby Gem](https://rubygems.org/gems/azure-credentials). To install it, run:
|
|
20
|
+
|
|
21
|
+
```gem install azure-credentials```
|
|
22
|
+
|
|
23
|
+
## Usage
|
|
24
|
+
|
|
25
|
+
```
|
|
26
|
+
Usage: azure-credentials (options)
|
|
27
|
+
-l, --log_level LEVEL Set the log level (debug, info, warn, error, fatal)
|
|
28
|
+
-v, --verbose Display the credentials in STDOUT after creation? (warning: will contain secrets)
|
|
29
|
+
-o, --output FILENAME Enter the filename to save the credentials to
|
|
30
|
+
-p, --password PASSWORD Enter the password for the Azure AD user
|
|
31
|
+
-r, --role ROLENAME Enter the built-in Azure role to add the service principal to on your subscription (default: Contributor)
|
|
32
|
+
-s, --subscription ID Enter the Subscription ID to work against (default: process all subscriptions within the Azure tenant)
|
|
33
|
+
-t, --type OUTPUTTYPE Set the output type (default: chef)
|
|
34
|
+
-u, --username USERNAME Enter the username (must be an Azure AD user)
|
|
35
|
+
-h, --help Show this message
|
|
36
|
+
```
|
|
37
|
+
|
|
38
|
+
## Default behaviour
|
|
39
|
+
|
|
40
|
+
By default (providing no options), the utility will prompt for your Azure AD username and password interactively, connect to Azure, retrieve details of all the subscriptions in your tenant, create an Application/Service Principal for each subscription then create you a credentials file with the relevant details that you can start to use with other tools immediately.
|
|
41
|
+
|
|
42
|
+
### Example output *(nb: ```chef exec``` typically is only required on Windows systems with ChefDK and no Ruby in their system path)*
|
|
43
|
+
|
|
44
|
+
```
|
|
45
|
+
PS C:\Users\StuartPreston\azure-credentials> chef exec azure-credentials
|
|
46
|
+
Enter your Azure AD username (user@domain.com): stuart@pendrica.com
|
|
47
|
+
Enter your password:
|
|
48
|
+
INFO [2016-03-28 15:29:37] Authenticating to Azure Active Directory
|
|
49
|
+
INFO [2016-03-28 15:29:39] Retrieving tenant info
|
|
50
|
+
INFO [2016-03-28 15:29:40] Retrieving subscriptions info
|
|
51
|
+
INFO [2016-03-28 15:29:41] Creating application azure_6b3a_b6e7eee9-e4cd-41ae-8432-03ab624df016 in tenant 9c117323-1f20-444d-82a9-9ee430723ba3
|
|
52
|
+
INFO [2016-03-28 15:29:41] Creating service principal for application
|
|
53
|
+
INFO [2016-03-28 15:29:43] Waiting for service principal to be available in directory (retry 1)
|
|
54
|
+
INFO [2016-03-28 15:29:45] Attempting to assign service principal to role
|
|
55
|
+
INFO [2016-03-28 15:29:45] Waiting for service principal to be available in directory (retry 2)
|
|
56
|
+
INFO [2016-03-28 15:29:47] Attempting to assign service principal to role
|
|
57
|
+
INFO [2016-03-28 15:29:48] Waiting for service principal to be available in directory (retry 3)
|
|
58
|
+
INFO [2016-03-28 15:29:50] Attempting to assign service principal to role
|
|
59
|
+
INFO [2016-03-28 15:29:52] Assigned service principal to role Contributor in subscription b6e7eee9-e4cd-41ae-8432-03ab624df016
|
|
60
|
+
INFO [2016-03-28 15:29:52] Creating application azure_6b3a_bcf669fc-98b4-4e51-8ab0-e2d1f9f4b1c3 in tenant 9c117323-1f20-444d-82a9-9ee430723ba3
|
|
61
|
+
INFO [2016-03-28 15:29:53] Creating service principal for application
|
|
62
|
+
INFO [2016-03-28 15:29:54] Waiting for service principal to be available in directory (retry 1)
|
|
63
|
+
INFO [2016-03-28 15:29:56] Attempting to assign service principal to role
|
|
64
|
+
INFO [2016-03-28 15:29:56] Waiting for service principal to be available in directory (retry 2)
|
|
65
|
+
INFO [2016-03-28 15:29:58] Attempting to assign service principal to role
|
|
66
|
+
INFO [2016-03-28 15:29:58] Waiting for service principal to be available in directory (retry 3)
|
|
67
|
+
INFO [2016-03-28 15:30:00] Attempting to assign service principal to role
|
|
68
|
+
INFO [2016-03-28 15:30:04] Assigned service principal to role Contributor in subscription bcf669fc-98b4-4e51-8ab0-e2d1f9f4b1c3
|
|
69
|
+
INFO [2016-03-28 15:30:04] Creating credentials file at C:/Users/StuartPreston/azure-credentials/credentials
|
|
70
|
+
INFO [2016-03-28 15:30:04] Done!
|
|
71
|
+
```
|
|
72
|
+
|
|
73
|
+
You'll be able to see the output in the created credentials file (don't worry you can change the location using the -o switch)
|
|
74
|
+
|
|
75
|
+
```
|
|
76
|
+
PS C:\Users\StuartPreston\azure-credentials> cat ./credentials
|
|
77
|
+
[b6e7eee9-e4cd-41ae-8432-03ab624df016]
|
|
78
|
+
client_id = "5a8758f2-a2b2-4eab-8203-28c0840ccd7f"
|
|
79
|
+
client_secret = "ZSNdI5hQ9toavJNVgRjMjA=="
|
|
80
|
+
tenant_id = "9c117323-1f20-444d-82a9-9ee430723ba3"
|
|
81
|
+
|
|
82
|
+
[bcf669fc-98b4-4e51-8ab0-e2d1f9f4b1c3]
|
|
83
|
+
client_id = "2205cbcd-84dc-4b4a-9fcf-4a27d773a56d"
|
|
84
|
+
client_secret = "KboMQ86BvMGR6vO7_fUd1A=="
|
|
85
|
+
tenant_id = "9c117323-1f20-444d-82a9-9ee430723ba3"
|
|
86
|
+
```
|
|
87
|
+
|
|
88
|
+
(don't worry these accounts don't exist any more!)
|
|
89
|
+
|
|
90
|
+
If you look in the Azure Service Management portal and navigate to Active Directory > [directory name] > Applications (Show: Applications my company owns) you will see Applications created with the **azure_** prefix. New identifiers are generated each time so there will be no overlap with existing accounts:
|
|
91
|
+
|
|
92
|
+
|
|
93
|
+
|
|
94
|
+
You will also see the role assignment when looking in the Azure Resource Manager portal > Subscriptions, selecting one and viewing the users:
|
|
95
|
+
|
|
96
|
+
|
|
97
|
+
|
|
98
|
+
## Some more advanced examples
|
|
99
|
+
|
|
100
|
+
### Chef quick config!
|
|
101
|
+
|
|
102
|
+
```azure-credentials -u username@domain.onmicrosoft.com -p "yourpassword" -o ~/.azure/credentials```
|
|
103
|
+
|
|
104
|
+
### Puppet-style output (note ```-v``` displays the file on screen after creation)
|
|
105
|
+
|
|
106
|
+
```azure-credentials -u username@domain.onmicrosoft.com -p "yourpassword" -o ./azure.conf -t puppet -v ```
|
|
107
|
+
|
|
108
|
+
```
|
|
109
|
+
PS C:\Users\StuartPreston\azure-credentials> chef exec azure-credentials -u stuart@pendrica.com -p "mypassword" -o ./azure.conf -t puppet -v
|
|
110
|
+
INFO [2016-03-28 16:01:58] Authenticating to Azure Active Directory
|
|
111
|
+
INFO [2016-03-28 16:02:00] Retrieving tenant info
|
|
112
|
+
INFO [2016-03-28 16:02:01] Retrieving subscriptions info
|
|
113
|
+
INFO [2016-03-28 16:02:01] Creating application azure_5291_b6e7eee9-e4cd-41ae-8432-03ab624df016 in tenant 9c117323-1f20-444d-82a9-9ee430723ba3
|
|
114
|
+
INFO [2016-03-28 16:02:02] Creating service principal for application
|
|
115
|
+
INFO [2016-03-28 16:02:03] Waiting for service principal to be available in directory (retry 1)
|
|
116
|
+
INFO [2016-03-28 16:02:05] Attempting to assign service principal to role
|
|
117
|
+
INFO [2016-03-28 16:02:05] Waiting for service principal to be available in directory (retry 2)
|
|
118
|
+
INFO [2016-03-28 16:02:07] Attempting to assign service principal to role
|
|
119
|
+
INFO [2016-03-28 16:02:08] Waiting for service principal to be available in directory (retry 3)
|
|
120
|
+
INFO [2016-03-28 16:02:10] Attempting to assign service principal to role
|
|
121
|
+
INFO [2016-03-28 16:02:10] Waiting for service principal to be available in directory (retry 4)
|
|
122
|
+
INFO [2016-03-28 16:02:12] Attempting to assign service principal to role
|
|
123
|
+
INFO [2016-03-28 16:02:16] Assigned service principal to role Contributor in subscription b6e7eee9-e4cd-41ae-8432-03ab624df016
|
|
124
|
+
INFO [2016-03-28 16:02:16] Creating application azure_5291_bcf669fc-98b4-4e51-8ab0-e2d1f9f4b1c3 in tenant 9c117323-1f20-444d-82a9-9ee430723ba3
|
|
125
|
+
INFO [2016-03-28 16:02:17] Creating service principal for application
|
|
126
|
+
INFO [2016-03-28 16:02:17] Waiting for service principal to be available in directory (retry 1)
|
|
127
|
+
INFO [2016-03-28 16:02:19] Attempting to assign service principal to role
|
|
128
|
+
INFO [2016-03-28 16:02:20] Waiting for service principal to be available in directory (retry 2)
|
|
129
|
+
INFO [2016-03-28 16:02:22] Attempting to assign service principal to role
|
|
130
|
+
INFO [2016-03-28 16:02:22] Waiting for service principal to be available in directory (retry 3)
|
|
131
|
+
INFO [2016-03-28 16:02:24] Attempting to assign service principal to role
|
|
132
|
+
INFO [2016-03-28 16:02:26] Assigned service principal to role Contributor in subscription bcf669fc-98b4-4e51-8ab0-e2d1f9f4b1c3
|
|
133
|
+
INFO [2016-03-28 16:02:26] Creating credentials file at C:/Users/StuartPreston/azure-credentials/azure.conf
|
|
134
|
+
azure: {
|
|
135
|
+
subscription_id: "b6e7eee9-e4cd-41ae-8432-03ab624df016"
|
|
136
|
+
tenant_id: '9c117323-1f20-444d-82a9-9ee430723ba3'
|
|
137
|
+
client_id: '8dfab0fc-65c5-46d0-be1d-d5d301b3cbc9'
|
|
138
|
+
client_secret: 'm_nh57rEZpGe5GFL8-Iceg=='
|
|
139
|
+
}
|
|
140
|
+
|
|
141
|
+
azure: {
|
|
142
|
+
subscription_id: "bcf669fc-98b4-4e51-8ab0-e2d1f9f4b1c3"
|
|
143
|
+
tenant_id: '9c117323-1f20-444d-82a9-9ee430723ba3'
|
|
144
|
+
client_id: '951eab1c-7e77-4931-bb68-15ca2d05e69e'
|
|
145
|
+
client_secret: 'vzl0haDXU51OukanIiRwJQ=='
|
|
146
|
+
}
|
|
147
|
+
|
|
148
|
+
INFO [2016-03-28 16:02:26] Done!
|
|
149
|
+
```
|
|
150
|
+
|
|
151
|
+
### Terraform-style output (note ```-v``` displays the file on screen after creation)
|
|
152
|
+
|
|
153
|
+
```azure-credentials -u username@domain.onmicrosoft.com -p "yourpassword" -o ./tf.creds -t terraform -v ```
|
|
154
|
+
|
|
155
|
+
```
|
|
156
|
+
PS C:\Users\StuartPreston\azure-credentials> chef exec azure-credentials -u stuart@pendrica.com -p "mypassword" -o ./tf.creds -t terraform -v
|
|
157
|
+
INFO [2016-03-28 16:04:32] Authenticating to Azure Active Directory
|
|
158
|
+
INFO [2016-03-28 16:04:34] Retrieving tenant info
|
|
159
|
+
INFO [2016-03-28 16:04:34] Retrieving subscriptions info
|
|
160
|
+
INFO [2016-03-28 16:04:34] Creating application azure_c346_b6e7eee9-e4cd-41ae-8432-03ab624df016 in tenant 9c117323-1f20-444d-82a9-9ee430723ba3
|
|
161
|
+
INFO [2016-03-28 16:04:35] Creating service principal for application
|
|
162
|
+
INFO [2016-03-28 16:04:36] Waiting for service principal to be available in directory (retry 1)
|
|
163
|
+
INFO [2016-03-28 16:04:38] Attempting to assign service principal to role
|
|
164
|
+
INFO [2016-03-28 16:04:42] Assigned service principal to role Contributor in subscription b6e7eee9-e4cd-41ae-8432-03ab624df016
|
|
165
|
+
INFO [2016-03-28 16:04:42] Creating application azure_c346_bcf669fc-98b4-4e51-8ab0-e2d1f9f4b1c3 in tenant 9c117323-1f20-444d-82a9-9ee430723ba3
|
|
166
|
+
INFO [2016-03-28 16:04:42] Creating service principal for application
|
|
167
|
+
INFO [2016-03-28 16:04:43] Waiting for service principal to be available in directory (retry 1)
|
|
168
|
+
INFO [2016-03-28 16:04:45] Attempting to assign service principal to role
|
|
169
|
+
INFO [2016-03-28 16:04:45] Waiting for service principal to be available in directory (retry 2)
|
|
170
|
+
INFO [2016-03-28 16:04:47] Attempting to assign service principal to role
|
|
171
|
+
INFO [2016-03-28 16:04:52] Assigned service principal to role Contributor in subscription bcf669fc-98b4-4e51-8ab0-e2d1f9f4b1c3
|
|
172
|
+
INFO [2016-03-28 16:04:52] Creating credentials file at C:/Users/StuartPreston/azure-credentials/tf.creds
|
|
173
|
+
provider "azurerm" {
|
|
174
|
+
subscription_id = "b6e7eee9-e4cd-41ae-8432-03ab624df016"
|
|
175
|
+
client_id = "8a5b76c7-721f-4710-b491-8d657c9a7497"
|
|
176
|
+
client_secret = "rGRLfflNSFo7O4t2vBU7pg=="
|
|
177
|
+
tenant_id = "9c117323-1f20-444d-82a9-9ee430723ba3"
|
|
178
|
+
}
|
|
179
|
+
|
|
180
|
+
provider "azurerm" {
|
|
181
|
+
subscription_id = "bcf669fc-98b4-4e51-8ab0-e2d1f9f4b1c3"
|
|
182
|
+
client_id = "0af58eee-25ce-467a-8e7c-05a35783385f"
|
|
183
|
+
client_secret = "UvB-HJPoiOpujufeJjp5Ag=="
|
|
184
|
+
tenant_id = "9c117323-1f20-444d-82a9-9ee430723ba3"
|
|
185
|
+
}
|
|
186
|
+
|
|
187
|
+
INFO [2016-03-28 16:04:52] Done!
|
|
188
|
+
```
|
|
189
|
+
|
|
190
|
+
## Not supported
|
|
191
|
+
|
|
192
|
+
1. Currently this tool does not support certificate-based authentication.
|
|
193
|
+
2. This tool will not work if MFA (multi-factor authentication) is set to **required** for administration of the Azure Active Directory domain.
|
|
194
|
+
|
|
195
|
+
## Contributing
|
|
196
|
+
|
|
197
|
+
I'm sure many improvements can be made to this tool! Contributions to the project are welcome via submitting Pull Requests.
|
|
198
|
+
|
|
199
|
+
1. Fork it ( https://github.com/pendrica/azure-credentials/fork )
|
|
200
|
+
2. Create your feature branch (`git checkout -b my-new-feature`)
|
|
201
|
+
3. Commit your changes (`git commit -am 'Add some feature'`)
|
|
202
|
+
4. Push to the branch (`git push origin my-new-feature`)
|
|
203
|
+
5. Create a new Pull Request
|
|
@@ -336,8 +336,10 @@ azure_client_secret = "#{s[:client_secret]}"
|
|
|
336
336
|
response = nil
|
|
337
337
|
Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|
|
|
338
338
|
request = Net::HTTP::Post.new uri
|
|
339
|
+
CustomLogger.log.debug "Request: #{request.uri} (#{request.method}) #{data}"
|
|
339
340
|
request.body = data
|
|
340
341
|
response = http.request request
|
|
342
|
+
CustomLogger.log.debug "Response: #{response.body}"
|
|
341
343
|
end
|
|
342
344
|
response
|
|
343
345
|
end
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: azure-credentials
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.1.
|
|
4
|
+
version: 0.1.1
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Stuart Preston
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2016-03-
|
|
11
|
+
date: 2016-03-31 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: json
|
|
@@ -115,6 +115,7 @@ executables:
|
|
|
115
115
|
extensions: []
|
|
116
116
|
extra_rdoc_files: []
|
|
117
117
|
files:
|
|
118
|
+
- CHANGELOG.md
|
|
118
119
|
- LICENSE
|
|
119
120
|
- README.md
|
|
120
121
|
- bin/azure-credentials
|