Changing app creation scripts

Author: abhidnya13

AppCreationScripts/AppCreationScripts.md

@@ -1,4 +1,4 @@
-# Registering the sample apps with Microsoft Identity Platform and updating the configuration files using PowerShell scripts
+# Registering the sample apps with Microsoft identity platform and updating the configuration files using PowerShell scripts
 
 ## Overview
 

AppCreationScripts/Cleanup.ps1

@@ -5,11 +5,11 @@ param(
  [string] $tenantId
 )
 
-if ((Get-Module -ListAvailable -Name "AzureAD") -eq $null) { 
+if ($null -eq (Get-Module -ListAvailable -Name "AzureAD")) { 
  Install-Module "AzureAD" -Scope CurrentUser 
 } 
 Import-Module AzureAD
-$ErrorActionPreference = 'Stop'
+$ErrorActionPreference = "Stop"
 
 Function Cleanup
 {
@@ -44,20 +44,27 @@ This function removes the Azure AD applications for the sample. These applicatio
  $tenantId = $creds.Tenant.Id
  }
  $tenant = Get-AzureADTenantDetail
- $tenantName = ($tenant.VerifiedDomains | Where { $_._Default -eq $True }).Name
+ $tenantName = ($tenant.VerifiedDomains | Where-Object { $_._Default -eq $True }).Name
 
  # Removes the applications
  Write-Host "Cleaning-up applications from tenant '$tenantName'"
 
- Write-Host "Removing 'client' (python-daemon-console) if needed"
- $app=Get-AzureADApplication -Filter "DisplayName eq 'python-daemon-console'" 
+ Write-Host "Removing 'client' (python-devicecode) if needed"
+ Get-AzureADApplication -Filter "DisplayName eq 'python-devicecode'" | ForEach-Object {Remove-AzureADApplication -ObjectId $_.ObjectId }
+ $apps = Get-AzureADApplication -Filter "DisplayName eq 'python-devicecode'"
+ if ($apps)
+ {
+ Remove-AzureADApplication -ObjectId $apps.ObjectId
+ }
 
- if ($app)
+ foreach ($app in $apps) 
  {
  Remove-AzureADApplication -ObjectId $app.ObjectId
- Write-Host "Removed."
+ Write-Host "Removed python-devicecode.."
  }
-
+ # also remove service principals of this app
+ Get-AzureADServicePrincipal -filter "DisplayName eq 'python-devicecode'" | ForEach-Object {Remove-AzureADServicePrincipal -ObjectId $_.Id -Confirm:$false}
+ 
 }
 
-Cleanup -Credential $Credential -tenantId $TenantId
+Cleanup -Credential $Credential -tenantId $TenantId

AppCreationScripts/Configure.ps1

@@ -17,32 +17,6 @@ param(
  There are four ways to run this script. For more information, read the AppCreationScripts.md file in the same folder as this script.
 #>
 
-# Create a password that can be used as an application key
-Function ComputePassword
-{
- $aesManaged = New-Object "System.Security.Cryptography.AesManaged"
- $aesManaged.Mode = [System.Security.Cryptography.CipherMode]::CBC
- $aesManaged.Padding = [System.Security.Cryptography.PaddingMode]::Zeros
- $aesManaged.BlockSize = 128
- $aesManaged.KeySize = 256
- $aesManaged.GenerateKey()
- return [System.Convert]::ToBase64String($aesManaged.Key)
-}
-
-# Create an application key
-# See https://www.sabin.io/blog/adding-an-azure-active-directory-application-and-key-using-powershell/
-Function CreateAppKey([DateTime] $fromDate, [double] $durationInYears, [string]$pw)
-{
- $endDate = $fromDate.AddYears($durationInYears) 
- $keyId = (New-Guid).ToString();
- $key = New-Object Microsoft.Open.AzureAD.Model.PasswordCredential
- $key.StartDate = $fromDate
- $key.EndDate = $endDate
- $key.Value = $pw
- $key.KeyId = $keyId
- return $key
-}
-
 # Adds the requiredAccesses (expressed as a pipe separated string) to the requiredAccess structure
 # The exposed permissions are in the $exposedPermissions collection, and the type of permission (Scope | Role) is 
 # described in $permissionType
@@ -65,7 +39,7 @@ Function AddResourcePermission($requiredAccess, `
 }
 
 #
-# Exemple: GetRequiredPermissions "Microsoft Graph" "Graph.Read|User.Read"
+# Example: GetRequiredPermissions "Microsoft Graph" "Graph.Read|User.Read"
 # See also: http://stackoverflow.com/questions/42164581/how-to-configure-a-new-azure-ad-application-through-powershell
 Function GetRequiredPermissions([string] $applicationDisplayName, [string] $requiredDelegatedPermissions, [string]$requiredApplicationPermissions, $servicePrincipal)
 {
@@ -134,49 +108,18 @@ Function UpdateTextFile([string] $configFilePath, [System.Collections.HashTable]
  Set-Content -Path $configFilePath -Value $lines -Force
 }
 
-Function ReplaceInLine([string] $line, [string] $key, [string] $value)
-{
- $index = $line.IndexOf($key)
- if ($index -ige 0)
- {
- $index2 = $index+$key.Length
- $line = $line.Substring(0, $index) + $value + $line.Substring($index2)
- }
- return $line
-}
-
-Function ReplaceInTextFile([string] $configFilePath, [System.Collections.HashTable] $dictionary)
-{
- $lines = Get-Content $configFilePath
- $index = 0
- while($index -lt $lines.Length)
- {
- $line = $lines[$index]
- foreach($key in $dictionary.Keys)
- {
- if ($line.Contains($key))
- {
- $lines[$index] = ReplaceInLine $line $key $dictionary[$key]
- }
- }
- $index++
- }
-
- Set-Content -Path $configFilePath -Value $lines -Force
-}
-
-
 Set-Content -Value "<html><body><table>" -Path createdApps.html
 Add-Content -Value "<thead><tr><th>Application</th><th>AppId</th><th>Url in the Azure portal</th></tr></thead><tbody>" -Path createdApps.html
 
+$ErrorActionPreference = "Stop"
+
 Function ConfigureApplications
 {
 <#.Description
  This function creates the Azure AD applications for the sample in the provided Azure AD tenant and updates the
  configuration files in the client and service project of the visual studio solution (App.Config and Web.Config)
  so that they are consistent with the Applications parameters
 #> 
-
  $commonendpoint = "common"
 
  # $tenantId is the Active Directory Tenant. This is a GUID which represents the "Directory ID" of the AzureAD tenant
@@ -208,18 +151,18 @@ Function ConfigureApplications
  $tenant = Get-AzureADTenantDetail
  $tenantName = ($tenant.VerifiedDomains | Where { $_._Default -eq $True }).Name
 
- # Get the user running the script
+ # Get the user running the script to add the user as the app owner
  $user = Get-AzureADUser -ObjectId $creds.Account.Id
 
  # Create the client AAD application
- Write-Host "Creating the AAD application (python-daemon-console)"
-
- $clientAadApplication = New-AzureADApplication -DisplayName "python-device-flow" `
- -ReplyUrls "https://device" `
- -IdentifierUris "https://$tenantName/python-device-flow" `
- -PasswordCredentials $key `
- -PublicClient $False
-
+ Write-Host "Creating the AAD application (python-devicecode)"
+ # create the application 
+ $clientAadApplication = New-AzureADApplication -DisplayName "python-devicecode" `
+ -ReplyUrls "https://login.microsoftonline.com/common/oauth2/nativeclient" `
+ -AvailableToOtherTenants $True `
+ -PublicClient $True
+
+ # create the service principal of the newly created application 
  $currentAppId = $clientAadApplication.AppId
  $clientServicePrincipal = New-AzureADServicePrincipal -AppId $currentAppId -Tags {WindowsAzureActiveDirectoryIntegratedApp}
 
@@ -232,19 +175,19 @@ Function ConfigureApplications
  }
 
 
- Write-Host "Done creating the client application (python-device-flow)"
+ Write-Host "Done creating the client application (python-devicecode)"
 
  # URL of the AAD application in the Azure portal
  # Future? $clientPortalUrl = "https://portal.azure.com/#@"+$tenantName+"/blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/Overview/appId/"+$clientAadApplication.AppId+"/objectId/"+$clientAadApplication.ObjectId+"/isMSAApp/"
  $clientPortalUrl = "https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/CallAnAPI/appId/"+$clientAadApplication.AppId+"/objectId/"+$clientAadApplication.ObjectId+"/isMSAApp/"
- Add-Content -Value "<tr><td>client</td><td>$currentAppId</td><td><a href='$clientPortalUrl'>python-device-flow</a></td></tr>" -Path createdApps.html
+ Add-Content -Value "<tr><td>client</td><td>$currentAppId</td><td><a href='$clientPortalUrl'>python-devicecode</a></td></tr>" -Path createdApps.html
 
  $requiredResourcesAccess = New-Object System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.RequiredResourceAccess]
 
  # Add Required Resources Access (from 'client' to 'Microsoft Graph')
  Write-Host "Getting access from 'client' to 'Microsoft Graph'"
  $requiredPermissions = GetRequiredPermissions -applicationDisplayName "Microsoft Graph" `
- -requiredApplicationPermissions "User.Read.All" `
+ -requiredDelegatedPermissions "User.Read" `
 
  $requiredResourcesAccess.Add($requiredPermissions)
 
@@ -255,31 +198,18 @@ Function ConfigureApplications
  # Update config file for 'client'
  $configFile = $pwd.Path + "\..\parameters.json"
  Write-Host "Updating the sample code ($configFile)"
- $dictionary = @{ "client_id" = $clientAadApplication.AppId;};
+ $dictionary = @{ "client_id" = $clientAadApplication.AppId };
  UpdateTextFile -configFilePath $configFile -dictionary $dictionary
-
- # Update config file for 'client'
- $configFile = $pwd.Path + "\..\parameters.json"
- Write-Host "Updating the sample code ($configFile)"
- $dictionary = @{ "organizations" = $tenantName };
- ReplaceInTextFile -configFilePath $configFile -dictionary $dictionary
- Write-Host ""
- Write-Host -ForegroundColor Green "------------------------------------------------------------------------------------------------" 
- Write-Host "IMPORTANT: Please follow the instructions below to complete a few manual step(s) in the Azure portal":
- Write-Host "- For 'client'"
- Write-Host " - Navigate to '$clientPortalUrl'"
- Write-Host " - Navigate to the API permissions page and click on 'Grant admin consent for {tenant}'" -ForegroundColor Red 
-
- Write-Host -ForegroundColor Green "------------------------------------------------------------------------------------------------" 
- 
+ 
  Add-Content -Value "</tbody></table></body></html>" -Path createdApps.html 
 }
 
 # Pre-requisites
 if ((Get-Module -ListAvailable -Name "AzureAD") -eq $null) { 
  Install-Module "AzureAD" -Scope CurrentUser 
-} 
+}
+
 Import-Module AzureAD
 
 # Run interactively (will ask you for the tenant ID)
-ConfigureApplications -Credential $Credential -tenantId $TenantId
+ConfigureApplications -Credential $Credential -tenantId $TenantId

AppCreationScripts/sample.json

@@ -17,16 +17,12 @@
  "Name": "python-devicecode",
  "Kind": "Desktop",
  "Audience": "AzureADMultipleOrgs",
+ "IsPublicClient": true,
  "UsesROPCOrIWA": false,
  "RequiredResourcesAccess": [
  {
  "Resource": "Microsoft Graph",
- "ApplicationPermissions": [ "User.Read.All" ]
- }
- ],
- "ManualSteps": [
- {
- "Comment" : "Navigate to the API permissions page and click on 'Grant admin consent for {tenant}'"
+ "DelegatedPermissions": ["User.Read"]
  }
  ]
  }