Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for Service Principal with certificate (no password) #32

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Support for Service Principal with certificate (no password) #32

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
eb25c70
Support for Service Principal with certificate (no password)
zioproto Mar 4, 2024
6c5b65d
Improve bash comment
zioproto Mar 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .devcontainer/devcontainer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "Terraform AzureCLI and Kubectl",
"postAttachCommand": "bash .devcontainer/script.sh",
"postAttachCommand": "source .devcontainer/script.sh",
"customizations": {
"vscode": {
"extensions": [
Expand All @@ -25,4 +25,4 @@
"ghcr.io/dhoeric/features/stern:1": {},
"ghcr.io/devcontainers-contrib/features/kubectx-kubens:1": {}
}
}
}
20 changes: 16 additions & 4 deletions .devcontainer/script.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ if [ -z "$ARM_CLIENT_ID" ]; then
exit 0
fi

# Check if $ARM_CLIENT_SECRET exists
if [ -z "$ARM_CLIENT_SECRET" ]; then
echo "ARM_CLIENT_SECRET is not set"
# Check if both $ARM_CLIENT_SECRET and $ARM_CLIENT_CERTIFICATE are empty
if [ -z "$ARM_CLIENT_SECRET" ] && [ -z "$ARM_CLIENT_CERTIFICATE" ]; then
zioproto marked this conversation as resolved.
Show resolved Hide resolved
echo "Either ARM_CLIENT_SECRET or ARM_CLIENT_CERTIFICATE should be set"
exit 0
fi

Expand All @@ -23,4 +23,16 @@ if [ -z "$ARM_SUBSCRIPTION_ID" ]; then
exit 0
fi

az login --service-principal -u $ARM_CLIENT_ID -p $ARM_CLIENT_SECRET --tenant $ARM_TENANT_ID
# If ARM_CLIENT_CERTIFICATE is set, decode it and save to a temp file
if [ -n "$ARM_CLIENT_CERTIFICATE" ]; then
echo "$ARM_CLIENT_CERTIFICATE" | base64 -d > /tmp/certfile.pem
export ARM_CLIENT_CERTIFICATE_PATH="/tmp/certfile.pfx"
export ARM_CLIENT_CERTIFICATE_PASSWORD=$(date '+%s')
echo "$ARM_CLIENT_CERTIFICATE" | base64 -d | openssl pkcs12 -export -password pass:"${ARM_CLIENT_CERTIFICATE_PASSWORD}" -out $ARM_CLIENT_CERTIFICATE_PATH
zioproto marked this conversation as resolved.
Show resolved Hide resolved
unset ARM_CLIENT_CERTIFICATE
az login --service-principal -u $ARM_CLIENT_ID --tenant $ARM_TENANT_ID -p /tmp/certfile.pem

else
# Otherwise, use ARM_CLIENT_SECRET
az login --service-principal -u $ARM_CLIENT_ID -p $ARM_CLIENT_SECRET --tenant $ARM_TENANT_ID
fi
8 changes: 8 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,12 @@ The easiest way to run this sample is to run it creating a new [GitHub Codespace
az ad sp create-for-rbac --role="Owner" --scopes="/subscriptions/<SUBSCRIPTION_ID>" -o json
```

Note: If your organization has a policy prohibiting Service Principals with passwords on the tenant, create a Service Principal with a certificate:

```
az ad sp create-for-rbac --role="Owner" --scopes="/subscriptions/<SUBSCRIPTION_ID>" --create-cert -o json


- In your github account go to Codespaces and Create a new Codespace with "Azure-Sample/azure-openai-terraform-deployment-sample" repository and select the main branch.

![codespace_create](./images/codespace-create.png)
Expand All @@ -32,6 +38,8 @@ The easiest way to run this sample is to run it creating a new [GitHub Codespace

![codespace_secrets](./images/codespace_secrets.png)

Note: if using Service Principal certificate set `ARM_CLIENT_CERTIFICATE` as `ARM_CLIENT_CERTIFICATE=$(cat cert-and-private-key.pem| base64)`

- Follow this link to create a new [GitHub Codespace](https://codespaces.new/Azure-Samples/azure-openai-terraform-deployment-sample).

[![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/Azure-Samples/azure-openai-terraform-deployment-sample)
Expand Down