example

command
v10.8.0+incompatible Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: May 1, 2018 License: Apache-2.0 Imports: 13 Imported by: 0

README

autorest azure example

Usage (device mode)

This shows how to use the example for device auth.

  1. Execute this. It will save your token to /tmp/azure-example-token:

    ./example -tenantId "13de0a15-b5db-44b9-b682-b4ba82afbd29" -subscriptionId "aff271ee-e9be-4441-b9bb-42f5af4cbaeb" -mode "device" -tokenCachePath "/tmp/azure-example-token"
    
  2. Execute it again, it will load the token from cache and not prompt for auth again.

Usage (certificate mode)

This example covers how to make an authenticated call to the Azure Resource Manager APIs, using certificate-based authentication.

  1. Export some required variables

    export SUBSCRIPTION_ID="aff271ee-e9be-4441-b9bb-42f5af4cbaeb"
    export TENANT_ID="13de0a15-b5db-44b9-b682-b4ba82afbd29"
    export RESOURCE_GROUP="someresourcegroup"
    
    • replace both values with your own
  2. Create a private key

    openssl genrsa -out "example.key" 2048
    
  3. Create the certificate

    openssl req -new -key "example.key" -subj "/CN=example" -out "example.csr"
    
    openssl x509 -req -in "example.csr" -signkey "example.key" -out "example.crt" -days 10000
    
  4. Create the PKCS12 version of the certificate (with no password)

    openssl pkcs12 -export -out "example.pfx" -inkey "example.key" -in "example.crt" -passout pass:
    
  5. Register a new Azure AD Application with the certificate contents

    certificateContents="$(tail -n+2 "example.key" | head -n-1)"
    
    azure ad app create \
        --name "example-azuread-app" \
        --home-page="http://example-azuread-app/home" \
        --identifier-uris "http://example-azuread-app/app" \
        --key-usage "Verify" \
        --end-date "2020-01-01" \
        --key-value "${certificateContents}"
    
  6. Create a new service principal using the "Application Id" from the previous step

    azure ad sp create "APPLICATION_ID"
    
    • Replace APPLICATION_ID with the "Application Id" returned in step 4
  7. Grant your service principal necessary permissions

    azure role assignment create \
        --resource-group "${RESOURCE_GROUP}" \
        --roleName "Contributor" \
        --subscription "${SUBSCRIPTION_ID}" \
        --spn "http://example-azuread-app/app"
    
    • Replace SUBSCRIPTION_ID with your subscription id
    • Replace RESOURCE_GROUP with the resource group for the assignment
    • Ensure that the spn parameter matches an identifier-url from Step 4
  8. Run this example app to see your resource groups

    go run main.go \
        --tenantId="${TENANT_ID}" \
        --subscriptionId="${SUBSCRIPTION_ID}" \
        --applicationId="http://example-azuread-app/app" \
        --certificatePath="certificate.pfx"
    

You should see something like this as output:

2015/11/08 18:28:39 Using these settings:
2015/11/08 18:28:39 * certificatePath: certificate.pfx
2015/11/08 18:28:39 * applicationID: http://example-azuread-app/app
2015/11/08 18:28:39 * tenantID: 13de0a15-b5db-44b9-b682-b4ba82afbd29
2015/11/08 18:28:39 * subscriptionID: aff271ee-e9be-4441-b9bb-42f5af4cbaeb
2015/11/08 18:28:39 loading certificate... 
2015/11/08 18:28:39 retrieve oauth token... 
2015/11/08 18:28:39 querying the list of resource groups... 
2015/11/08 18:28:50 
2015/11/08 18:28:50 Groups: {"value":[{"id":"/subscriptions/aff271ee-e9be-4441-b9bb-42f5af4cbaeb/resourceGroups/kube-66f30810","name":"kube-66f30810","location":"westus","tags":{},"properties":{"provisioningState":"Succeeded"}}]}

Notes

You may need to wait sometime between executing step 4, step 5 and step 6. If you issue those requests too quickly, you might hit an AD server that is not consistent with the server where the resource was created.

Documentation

The Go Gopher

There is no documentation for this package.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL