wip

2023-02-19 18:10:54 +01:00 · 2023-02-19 18:10:54 +01:00 · 5fa263050e
--- a/src/Saas.Admin/deployment/build.sh
+++ b/src/Saas.Admin/deployment/build.sh
@ -2,20 +2,18 @@

 force_update=false

-while getopts f flag
-do
+while getopts f flag; do
    case "${flag}" in
-        f) force_update=true;;
-        *) force_update=false;;
+    f) force_update=true ;;
+    *) force_update=false ;;
    esac
 done

-repo_base="$( git rev-parse --show-toplevel )"
-docker_file_folder="${repo_base}/src/Saas.lib/Deployment.Container"
-
+repo_base="$(git rev-parse --show-toplevel)"
+docker_file_folder="${repo_base}/src/Saas.Lib/Deployment.Container"

 # redirect to build.sh in the Deployment.Container folder
-if [[ "${force_update}" == false  ]]; then
+if [[ "${force_update}" == false ]]; then
    "${docker_file_folder}/build.sh"
 else
    "${docker_file_folder}/build.sh" -f
--- a/src/Saas.Admin/deployment/setup.sh
+++ b/src/Saas.Admin/deployment/setup.sh
@ -22,7 +22,7 @@ repo_base="$(git rev-parse --show-toplevel)" ||
        exit 1
    }

-docker_file_folder="${repo_base}/src/Saas.lib/Deployment.Container"
+docker_file_folder="${repo_base}/src/Saas.Lib/Deployment.Container"

 # redirect to build.sh in the Deployment.Container folder
 sudo chmod +x "${docker_file_folder}/build.sh" ||
--- a/src/Saas.Identity/Saas.IdentityProvider/deployment/build.sh
+++ b/src/Saas.Identity/Saas.IdentityProvider/deployment/build.sh
@ -11,7 +11,7 @@ do
 done

 repo_base="$( git rev-parse --show-toplevel )"
-docker_file_folder="${repo_base}/src/Saas.lib/Deployment.Container"
+docker_file_folder="${repo_base}/src/Saas.Lib/Deployment.Container"


 # redirect to build.sh in the Deployment.Container folder
--- a/src/Saas.Identity/Saas.IdentityProvider/deployment/config/config-template.json
+++ b/src/Saas.Identity/Saas.IdentityProvider/deployment/config/config-template.json
@ -163,6 +163,7 @@
      "name": "saas-app",
      "appServiceName": null,
      "certificate": true,
+      "hasSecret": true,
      "redirectUri": null,
      "redirectType": "web",
      "logoutUri": null,
--- a/src/Saas.Identity/Saas.IdentityProvider/deployment/run.sh
+++ b/src/Saas.Identity/Saas.IdentityProvider/deployment/run.sh
@ -1,18 +1,18 @@
 #!/usr/bin/env bash

-repo_base="$( git rev-parse --show-toplevel )"
-git_repo_origin="$( git config --get remote.origin.url )"
-git_org_project_name="$( git config --get remote.origin.url | sed 's/.*\/\([^ ]*\/[^.]*\).*/\1/' )"
-gh_auth_token="$( gh auth token )"
+repo_base="$(git rev-parse --show-toplevel)"
+git_repo_origin="$(git config --get remote.origin.url)"
+git_org_project_name="$(git config --get remote.origin.url | sed 's/.*\/\([^ ]*\/[^.]*\).*/\1/')"
+gh_auth_token="$(gh auth token)"

 if [[ -z "${gh_auth_token}" ]]; then
-    echo "You are not loggged into your GitHub organization. GitHub auth token is not set and/or you haven't installed GitHub Cli." 
+    echo "You are not loggged into your GitHub organization. GitHub auth token is not set and/or you haven't installed GitHub Cli."
    echo "Please make sure that GitHub Cli is installed and then run 'gh auth login', before running this script again."
    echo "See readme.md for more info."
    exit 0
 fi

-# using volumes '--volume' to mount only the needed directories to the container. 
+# using volumes '--volume' to mount only the needed directories to the container.
 # using ':ro' to make scrip directories etc. read-only. Only config and log directories are writable.
 docker run \
    --interactive \
--- a/src/Saas.Identity/Saas.IdentityProvider/deployment/script/b2c-app-registrations.sh
+++ b/src/Saas.Identity/Saas.IdentityProvider/deployment/script/b2c-app-registrations.sh
@ -252,12 +252,16 @@ for app in "${app_reg_array[@]}"; do
        echo "Adding secret for: ${app_name}..." |
            log-output --level info

-        secret_path=$USER/$ASDK_CURRENT_USER/.secret/$app_name.secret
+        secret_dir=$HOME/$ASDK_CURRENT_USER/.secret
+        secret_path=$secret_dir/$app_name.secret
+
+        mkdir -p "${secret_dir}"

        az ad app credential reset \
            --id "${obj_id}" \
            --display-name "${app_name}" \
            --end-date 9999-12-31 \
+            --only-show-errors \
            --query password \
            --output tsv >"${secret_path}" ||
            echo "Failed to add secret to app $app_name, ${app_id}" |
--- a/src/Saas.Identity/Saas.IdentityProvider/deployment/script/b2c-policy-keys.sh
+++ b/src/Saas.Identity/Saas.IdentityProvider/deployment/script/b2c-policy-keys.sh
@ -14,6 +14,7 @@ set -u -e -o pipefail

 b2c_tenant_id="$(get-value ".deployment.azureb2c.tenantId")"
 service_principal_username="$(get-value ".deployment.azureb2c.servicePrincipal.username")"
+set-user-context "${service_principal_username}"

 credentials_path="$(get-user-value "${service_principal_username}" "credentialsPath")"
 app_id="$(get-value ".deployment.azureb2c.servicePrincipal.appId")"
@ -74,13 +75,6 @@ for policy_key in "${policy_key_array[@]}"; do
                    --header "Critical Error" ||
                exit 1

-            # echo "Waiting 10 seconds for key-set to settle..." | echo-color --level info
-            # sleep 10
-
-            # id="$(jq --raw-output '.id' <<<"${policy_key_body}")"
-
-            # generate-policy-key "${id}" "${policy_key_body}"
-
        elif [[ "${options}" == "Manual" ]]; then
            echo "Adding manual policy key" | log-output --level info

@ -101,17 +95,6 @@ for policy_key in "${policy_key_array[@]}"; do
                        --level error \
                        --header "Critical Error" ||
                    exit 1
-
-                # policy_key_body="$(create-policy-key-body "${name}" "${key_type}" "${key_use}" "${options}" "${secret}")"
-
-                # create-policy-key-set "${policy_key_body}"
-
-                # id="$(jq --raw-output '.id' <<<"${policy_key_body}")"
-
-                # echo "Waiting 10 seconds for key-set to settle..." | echo-color --level info
-                # sleep 10
-
-                # upload-policy-secret "${id}" "${policy_key_body}"
            fi
        fi

@ -121,3 +104,6 @@ for policy_key in "${policy_key_array[@]}"; do
        echo "Policy key ${name} already exist." | log-output --level info
    fi
 done
+
+# resetting user context to the default User
+reset-user-context
--- a/src/Saas.Identity/Saas.IdentityProvider/deployment/script/config-b2c.sh
+++ b/src/Saas.Identity/Saas.IdentityProvider/deployment/script/config-b2c.sh
@ -48,9 +48,10 @@ for app in "${app_reg_array[@]}"; do
        app_name=$(jq --raw-output '.name' <<<"${app}")
        secret_path=$(jq --raw-output '.secretPath' <<<"${app}")

-        secret=$(cat "${secret_path}")
+        if [[ -s "${secret_path}" ]]; then
+
+            secret=$(cat "${secret_path}")

-        if [[ -n "${secret}" ]]; then
            echo "Adding secret for ${app_name} to KeyVault" |
                log-output \
                    --level info
@ -76,14 +77,11 @@ for app in "${app_reg_array[@]}"; do
                    --header "Critical Error" ||
                exit 1
        else
-            echo "Secret for ${app_name} is empty" |
+            echo "Secret for ${app_name} is empty. If the secret have already been defined then this is to be expected." |
                log-output \
-                    --level error \
-                    --header "Critical Error" ||
-                exit 1
+                    --level info
        fi
    fi
-    echo
 done

 set-user-context "${b2c_config_usr_name}"
@ -102,10 +100,6 @@ echo "Service principal update/creation completed." |
 # resetting user context to the default User
 reset-user-context

-# set the user context to the service principal to run shell script to configure the Azure B2C policy keys
-service_principal_username="$(get-value ".deployment.azureb2c.servicePrincipal.username")"
-set-user-context "${service_principal_username}"
-
 # run shell script for provisioning the Azure B2C policy keys
 "${SCRIPT_DIR}/b2c-policy-keys.sh" ||
    echo "B2C policy configuration script failed." |
@ -118,5 +112,3 @@ echo "B2C policy configuration script has completed." |
    log-output \
        --level success

-# resetting user context to the default User
-reset-user-context
--- a/src/Saas.Identity/Saas.IdentityProvider/deployment/script/upload-ief-policies.sh
+++ b/src/Saas.Identity/Saas.IdentityProvider/deployment/script/upload-ief-policies.sh
@ -33,6 +33,10 @@ environment="$(get-value ".environment")"
 dependency_sorted_array="$("${SCRIPT_DIR}/get-dependency-sorted-policies.py" \
    "${IDENTITY_EXPERIENCE_FRAMEWORK_POLICY_ENVIRONMENT_DIR}/${environment}")"

+# setting user context to the user that will be used to configure Azure B2C
+service_principal_username="$(get-value ".deployment.azureb2c.servicePrincipal.username")"
+set-user-context "${service_principal_username}"
+
 # iterate over each policy key in policy key array
 readarray -t policy_file_array < <(jq --compact-output '.[]' <<<"${dependency_sorted_array}")

@ -40,10 +44,6 @@ for policy in "${policy_file_array[@]}"; do
    id="$(jq --raw-output '.id' <<<"${policy}")"
    path="$(jq --raw-output '.path' <<<"${policy}")"

-    # removing the BOM from the file or az rest will choke on it.
-    # https://en.wikipedia.org/wiki/Byte_order_mark
-    sed -i '1s/^\xEF\xBB\xBF//' "${path}"
-
    echo "Uploading policy '${id}' from '${path}'" |
        log-output \
            --level info
--- a/src/Saas.Identity/Saas.IdentityProvider/deployment/setup.sh
+++ b/src/Saas.Identity/Saas.IdentityProvider/deployment/setup.sh
@ -22,7 +22,7 @@ repo_base="$(git rev-parse --show-toplevel)" ||
        exit 1
    }

-docker_file_folder="${repo_base}/src/Saas.lib/Deployment.Container"
+docker_file_folder="${repo_base}/src/Saas.Lib/Deployment.Container"

 # redirect to build.sh in the Deployment.Container folder
 sudo chmod +x "${docker_file_folder}/build.sh" ||
--- a/src/Saas.Identity/Saas.IdentityProvider/policies/ClientCredentialsFlow.xml
+++ b/src/Saas.Identity/Saas.IdentityProvider/policies/ClientCredentialsFlow.xml
@ -1,108 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xmlns:xsd="http://www.w3.org/2001/XMLSchema"
-    xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0" TenantId="{Settings:Tenant}" PolicyId="B2C_1A_ClientCredentialsFlow" PublicPolicyUri="http://{Settings:Tenant}/B2C_1A_ClientCredentialsFlow">
-
-    <BasePolicy>
-        <TenantId>{Settings:Tenant}</TenantId>
-        <PolicyId>B2C_1A_TrustFrameworkExtensions</PolicyId>
-    </BasePolicy>
-
-    <BuildingBlocks>
-        <ClaimsSchema>
-            <ClaimType Id="Credentials">
-                <DisplayName>Credentials</DisplayName>
-                <DataType>string</DataType>
-            </ClaimType>
-            <ClaimType Id="RandomValue">
-                <DisplayName>Random value</DisplayName>
-                <DataType>string</DataType>
-            </ClaimType>
-        </ClaimsSchema>
-
-        <ClaimsTransformations>
-            <ClaimsTransformation Id="CreateRandomValue" TransformationMethod="CreateRandomString">
-                <InputParameters>
-                    <InputParameter Id="randomGeneratorType" DataType="string" Value="integer" />
-                </InputParameters>
-                <OutputClaims>
-                    <OutputClaim ClaimTypeReferenceId="RandomValue" TransformationClaimType="outputClaim" />
-                </OutputClaims>
-            </ClaimsTransformation>
-        </ClaimsTransformations>
-    </BuildingBlocks>
-    <ClaimsProviders>
-        <ClaimsProvider>
-            <DisplayName>Token Issuer</DisplayName>
-            <TechnicalProfiles>
-                <TechnicalProfile Id="JwtIssuer">
-                    <Metadata>
-                        <Item Key="ClientCredentialsUserJourneyId">ClientCredentialsJourney</Item>
-                    </Metadata>
-                </TechnicalProfile>
-            </TechnicalProfiles>
-        </ClaimsProvider>
-        <ClaimsProvider>
-            <DisplayName>Client credintial technical profiles</DisplayName>
-            <TechnicalProfiles>
-                <TechnicalProfile Id="ClientCredentials_Setup">
-                    <DisplayName>Trustframework Policy Client Credentials Setup Technical Profile</DisplayName>
-                    <Protocol Name="None" />
-                    <OutputClaims>
-                        <OutputClaim ClaimTypeReferenceId="Credentials" DefaultValue="OAuth 2.0 Client Credentials" AlwaysUseDefaultValue="true" />
-                    </OutputClaims>
-                </TechnicalProfile>
-
-                <TechnicalProfile Id="TokenAugmentation">
-                    <DisplayName>Unlink Facebook</DisplayName>
-                    <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.ClaimsTransformationProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
-                    <OutputClaims>
-                        <OutputClaim ClaimTypeReferenceId="RandomValue" />
-                    </OutputClaims>
-                    <OutputClaimsTransformations>
-                        <OutputClaimsTransformation ReferenceId="CreateRandomValue" />
-                    </OutputClaimsTransformations>
-                    <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
-                </TechnicalProfile>
-            </TechnicalProfiles>
-        </ClaimsProvider>
-    </ClaimsProviders>
-    <UserJourneys>
-        <UserJourney Id="ClientCredentialsJourney">
-            <OrchestrationSteps>
-                <!-- Do the client credentials and emit some claims -->
-                <OrchestrationStep Order="1" Type="ClaimsExchange">
-                    <ClaimsExchanges>
-                        <ClaimsExchange Id="ClientCredSetupExchange" TechnicalProfileReferenceId="ClientCredentials_Setup" />
-                    </ClaimsExchanges>
-                </OrchestrationStep>
-                <!-- Call a REST API or claims transformation -->
-                <OrchestrationStep Order="2" Type="ClaimsExchange">
-                    <ClaimsExchanges>
-                        <ClaimsExchange Id="TokenAugmentation" TechnicalProfileReferenceId="TokenAugmentation" />
-                    </ClaimsExchanges>
-                </OrchestrationStep>
-                <!-- Send the claims -->
-                <OrchestrationStep Order="3" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
-            </OrchestrationSteps>
-        </UserJourney>
-    </UserJourneys>
-    <RelyingParty>
-        <DefaultUserJourney ReferenceId="SignUpOrSignIn" />
-        <TechnicalProfile Id="PolicyProfile">
-            <DisplayName>PolicyProfile</DisplayName>
-            <Protocol Name="OpenIdConnect" />
-            <OutputClaims>
-                <OutputClaim ClaimTypeReferenceId="displayName" DefaultValue="Empty value 2" />
-                <OutputClaim ClaimTypeReferenceId="givenName" />
-                <OutputClaim ClaimTypeReferenceId="surname" />
-                <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" PartnerClaimType="email" />
-                <OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub" />
-                <OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" />
-                <OutputClaim ClaimTypeReferenceId="permissions" DefaultValue=""/>
-                <OutputClaim ClaimTypeReferenceId="roles" DefaultValue=""/>
-            </OutputClaims>
-            <SubjectNamingInfo ClaimType="sub" />
-        </TechnicalProfile>
-    </RelyingParty>
-</TrustFrameworkPolicy>
--- a/src/Saas.Identity/Saas.Permissions/deployment/build.sh
+++ b/src/Saas.Identity/Saas.Permissions/deployment/build.sh
@ -11,7 +11,7 @@ do
 done

 repo_base="$( git rev-parse --show-toplevel )"
-docker_file_folder="${repo_base}/src/Saas.lib/Deployment.Container"
+docker_file_folder="${repo_base}/src/Saas.Lib/Deployment.Container"


 # redirect to build.sh in the Deployment.Container folder
--- a/src/Saas.Identity/Saas.Permissions/deployment/setup.sh
+++ b/src/Saas.Identity/Saas.Permissions/deployment/setup.sh
@ -22,7 +22,7 @@ repo_base="$(git rev-parse --show-toplevel)" ||
        exit 1
    }

-docker_file_folder="${repo_base}/src/Saas.lib/Deployment.Container"
+docker_file_folder="${repo_base}/src/Saas.Lib/Deployment.Container"

 # redirect to build.sh in the Deployment.Container folder
 sudo chmod +x "${docker_file_folder}/build.sh" ||
--- a/src/Saas.Lib/Deployment.Container/Dockerfile
+++ b/src/Saas.Lib/Deployment.Container/Dockerfile
@ -9,6 +9,7 @@ RUN apt-get update && apt-get install -y \
    libicu-dev \
    uuid-runtime \
    zip \
+    dos2unix \
    && curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

 # Install latest GitHub cli (gh)
--- a/src/Saas.Lib/Deployment.Container/Dockerfile.ARM
+++ b/src/Saas.Lib/Deployment.Container/Dockerfile.ARM
@ -9,6 +9,7 @@ RUN apt-get update && apt-get install -y \
    libicu-dev \
    uuid-runtime \
    zip \
+    dos2unix \
    && curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

 # Install latest GitHub cli (gh)
--- a/src/Saas.Lib/Deployment.Container/build.sh
+++ b/src/Saas.Lib/Deployment.Container/build.sh
@ -11,7 +11,7 @@ do
 done

 repo_base="$( git rev-parse --show-toplevel )"
-docker_file_folder="${repo_base}/src/Saas.lib/Deployment.Container"
+docker_file_folder="${repo_base}/src/Saas.Lib/Deployment.Container"

 architecture="$( uname -a )"

--- a/src/Saas.Lib/Deployment.Script.Modules/key-vault-module.sh
+++ b/src/Saas.Lib/Deployment.Script.Modules/key-vault-module.sh
@ -116,7 +116,7 @@ function init-key-vault-certificate-template() {

    # patching certificate policy to our liking, including making the certs none-exportable
    put-certificate-value '.keyProperties.exportable' "true"
-    put-certificate-value '.keyProperties.keySize' "4096"
+    put-certificate-value '.keyProperties.keySize' "2048"
    put-certificate-value '.x509CertificateProperties.subject' "CN=${b2c_name}"
 }

@ -127,7 +127,7 @@ function create-certificate-in-vault() {

    # check if certificate doesn't not exist and create it if not
    if ! certificate-exist "${cert_name}"; then
-        echo "Creating a self-signing certificate called '${cert_name}' for '${cert_name}'..." | log-output
+        echo "Creating a self-signing certificate called '${cert_name}'..." | log-output

        az keyvault certificate create \
            --name "${cert_name}" \
--- a/src/Saas.Lib/Deployment.Script.Modules/policy-module.sh
+++ b/src/Saas.Lib/Deployment.Script.Modules/policy-module.sh
@ -108,14 +108,20 @@ function create-policy-key-set() {
    echo "Waiting 10 seconds for key-set to settle..." | echo-color --level info
    sleep 10

-    generate_uri="https://graph.microsoft.com/beta/trustFramework/keySets/B2C_1A_${name}/generateKey"
+    local generate_uri

-    policy_key_generate_body="$(create-policy-key-body "${name}" "${key_type}" "${key_use}" "${options}" "${secret}")"
+    if [[ "${options}" == "Generate" ]]; then
+        generate_uri="https://graph.microsoft.com/beta/trustFramework/keySets/B2C_1A_${name}/generateKey"
+    elif [[ "${options}" == "Manual" ]]; then
+        generate_uri="https://graph.microsoft.com/beta/trustFramework/keySets/B2C_1A_${name}/uploadSecret"
+    fi

-    echo "Generating policy key for '${name}'." |
+    echo "Generating policy key for '${name}' with option '${options}'." |
        log-output \
            --level info

+    policy_key_generate_body="$(create-policy-key-body "${name}" "${key_type}" "${key_use}" "${options}" "${secret}")"
+
    post-rest-request "${generate_uri}" "${policy_key_generate_body}" "POST"
 }

@ -140,12 +146,25 @@ function post-rest-request() {

 function upload-custom-policy() {
    local id="$1"
-    local policy_xml_file="$2"
+    local policy_xml_path="$2"

    uri="https://graph.microsoft.com/beta/trustFramework/policies/${id}/\$value"
    headers="Content-Type=application/xml"

-    body="$(cat "${policy_xml_file}")"
+    # removing the BOM from the file or az rest will choke on it.
+    # https://en.wikipedia.org/wiki/Byte_order_mark
+    # sed -i '1s/^\xEF\xBB\xBF//' "${policy_xml_file}"
+
+    target_dir="${HOME}/temp"
+    mkdir -p "${target_dir}"
+    target_file="${target_dir}/${policy_xml_path##*/}"
+
+    dos2unix \
+        --quiet \
+        --remove-bom \
+        --newfile "${policy_xml_path}" "${target_file}"
+
+    body="$(cat "${target_file}")"

    az rest \
        --method PUT \
@ -153,7 +172,7 @@ function upload-custom-policy() {
        --headers "${headers}" \
        --body "${body}" \
        --only-show-errors 1>/dev/null ||
-        echo "Failed to upload policy file: ${policy_xml_file} " |
+        echo "Failed to upload policy file: ${policy_xml_path} " |
        log-output \
            --level error \
            --header "Critical Error"
--- a/src/Saas.SignupAdministration/deployment/build.sh
+++ b/src/Saas.SignupAdministration/deployment/build.sh
@ -11,7 +11,7 @@ do
 done

 repo_base="$( git rev-parse --show-toplevel )"
-docker_file_folder="${repo_base}/src/Saas.lib/Deployment.Container"
+docker_file_folder="${repo_base}/src/Saas.Lib/Deployment.Container"


 # redirect to build.sh in the Deployment.Container folder
--- a/src/Saas.SignupAdministration/deployment/setup.sh
+++ b/src/Saas.SignupAdministration/deployment/setup.sh
@ -22,7 +22,7 @@ repo_base="$(git rev-parse --show-toplevel)" ||
        exit 1
    }

-docker_file_folder="${repo_base}/src/Saas.lib/Deployment.Container"
+docker_file_folder="${repo_base}/src/Saas.Lib/Deployment.Container"

 # redirect to build.sh in the Deployment.Container folder
 sudo chmod +x "${docker_file_folder}/build.sh" ||