-
Notifications
You must be signed in to change notification settings - Fork 524
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Created PowerShell module for AAD registrations (#59)
There is now a powershell module for AAD registrations and deployment instructions have been updated accordingly. Closes #55
- Loading branch information
1 parent
1528b10
commit 674b8dd
Showing
8 changed files
with
243 additions
and
99 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,6 +4,10 @@ A .NET Core implementation of health storage based on the FHIR standard. | |
|
|
||
| [](https://microsofthealthoss.visualstudio.com/FhirServer/_releases2) | ||
|
|
||
| ## Deployment | ||
|
|
||
| Please see the [deployment instructions](docs/DefaultDeployment.md) for detailed instructions. | ||
|
|
||
| ## Contributing | ||
|
|
||
| This project welcomes contributions and suggestions. Most contributions require you to agree to a | ||
|
|
@@ -16,4 +20,4 @@ provided by the bot. You will only need to do this once across all repos using o | |
|
|
||
| This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). | ||
| For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or | ||
| contact [[email protected]](mailto:[email protected]) with any additional questions or comments. | ||
| contact [[email protected]](mailto:[email protected]) with any additional questions or comments. | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| # | ||
| # Module manifest for module 'FhirServer' | ||
| # | ||
| @{ | ||
| RootModule = 'FhirServer.psm1' | ||
| ModuleVersion = '0.0.1' | ||
| GUID = '8d82e68c-0121-478c-9e81-62bced8d2a68' | ||
| Author = 'Microsoft Healthcare NExT' | ||
| CompanyName = 'https://microsoft.com' | ||
| Description = 'PowerShell Module for managing Azure Active Directory registrations and users for Microsoft FHIR Server.' | ||
| PowerShellVersion = '3.0' | ||
| FunctionsToExport = 'Remove-FhirServerApplicationRegistration', 'New-FhirServerClientApplicationRegistration', 'New-FhirServerApiApplicationRegistration' | ||
| CmdletsToExport = @() | ||
| AliasesToExport = @() | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| $Public = @( Get-ChildItem -Path "$PSScriptRoot\Public\*.ps1" ) | ||
| $Private = @( Get-ChildItem -Path "$PSScriptRoot\Private\*.ps1" ) | ||
|
|
||
| @($Public + $Private) | ForEach-Object { | ||
| Try { | ||
| . $_.FullName | ||
| } Catch { | ||
| Write-Error -Message "Failed to import function $($_.FullName): $_" | ||
| } | ||
| } |
Empty file.
59 changes: 59 additions & 0 deletions
59
samples/scripts/PowerShell/FhirServer/Public/New-FhirServerApiApplicationRegistration.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| function New-FhirServerApiApplicationRegistration { | ||
| <# | ||
| .SYNOPSIS | ||
| Create an AAD Application registration for a FHIR server instance. | ||
| .DESCRIPTION | ||
| Create a new AAD Application registration for a FHIR server instance. | ||
| A FhirServiceName or FhirServiceAudience must be supplied. | ||
| .EXAMPLE | ||
| New-FhirServerApiApplicationRegistration -FhirServiceName "myfhiservice" | ||
| .EXAMPLE | ||
| New-FhirServerApiApplicationRegistration -FhirServiceAudience "https://myfhirservice.azurewebsites.net" | ||
| .PARAMETER FhirServiceName | ||
| Name of the FHIR service instance. | ||
| .PARAMETER FhirServiceAudience | ||
| Full URL of the FHIR service. | ||
| .PARAMETER WebAppSuffix | ||
| Will be appended to FHIR service name to form the FhirServiceAudience if one is not supplied, | ||
| e.g., azurewebsites.net or azurewebsites.us (for US Government cloud) | ||
| #> | ||
| [CmdletBinding(DefaultParameterSetName='ByFhirServiceName')] | ||
| param( | ||
| [Parameter(Mandatory = $true, ParameterSetName = 'ByFhirServiceName' )] | ||
| [string]$FhirServiceName, | ||
|
|
||
| [Parameter(Mandatory = $true, ParameterSetName = 'ByFhirServiceAudience' )] | ||
| [string]$FhirServiceAudience, | ||
|
|
||
| [Parameter(Mandatory = $false, ParameterSetName = 'ByFhirServiceName' )] | ||
| [String]$WebAppSuffix = "azurewebsites.net" | ||
| ) | ||
|
|
||
| # Get current AzureAd context | ||
| try { | ||
| $session = Get-AzureADCurrentSessionInfo -ErrorAction Stop | ||
| } | ||
| catch { | ||
| Write-Host "Please log in to Azure AD with Connect-AzureAD cmdlet before proceeding" | ||
| Break | ||
| } | ||
|
|
||
| if ([string]::IsNullOrEmpty($FhirServiceAudience)) { | ||
| $FhirServiceAudience = "https://${FhirServiceName}.${WebAppSuffix}" | ||
| } | ||
|
|
||
| # Create the App Registration | ||
| $apiAppReg = New-AzureADApplication -DisplayName $FhirServiceAudience -IdentifierUris $FhirServiceAudience | ||
| $ignored = New-AzureAdServicePrincipal -AppId $apiAppReg.AppId | ||
|
|
||
| $aadEndpoint = (Get-AzureADCurrentSessionInfo).Environment.Endpoints["ActiveDirectory"] | ||
| $aadTenantId = (Get-AzureADCurrentSessionInfo).Tenant.Id.ToString() | ||
|
|
||
| #Return Object | ||
| @{ | ||
| AppId = $apiAppReg.AppId; | ||
| TenantId = $aadTenantId; | ||
| Authority = "${aadEndpoint}${aadTenantId}"; | ||
| Audience = $FhirServiceAudience; | ||
| } | ||
| } |
82 changes: 82 additions & 0 deletions
82
samples/scripts/PowerShell/FhirServer/Public/New-FhirServerClientApplicationRegistration.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| function New-FhirServerClientApplicationRegistration { | ||
| <# | ||
| .SYNOPSIS | ||
| Create an AAD Application registration for a client application. | ||
| .DESCRIPTION | ||
| Create a new AAD Application registration for a client application that consumes an API. | ||
| .EXAMPLE | ||
| New-FhirServerClientApplicationRegistration -DisplayName "clientapplication" -ApiAppId 9125e524-1509-XXXX-XXXX-74137cc75422 | ||
| .PARAMETER ApiAppId | ||
| API AAD Application registration Id | ||
| .PARAMETER DisplayName | ||
| Display name for the client AAD Application registration | ||
| .PARAMETER ReplyUrl | ||
| Reply URL for the client AAD Application registration | ||
| .PARAMETER IdentifierUri | ||
| Identifier URI for the client AAD Application registration | ||
| #> | ||
| param( | ||
| [Parameter(Mandatory = $true)] | ||
| [string]$ApiAppId, | ||
|
|
||
| [Parameter(Mandatory = $true)] | ||
| [string]$DisplayName, | ||
|
|
||
| [Parameter(Mandatory = $false)] | ||
| [string]$ReplyUrl = "https://www.getpostman.com/oauth2/callback", | ||
|
|
||
| [Parameter(Mandatory = $false)] | ||
| [string]$IdentifierUri = "https://${DisplayName}" | ||
| ) | ||
|
|
||
| # Get current AzureAd context | ||
| try { | ||
| $session = Get-AzureADCurrentSessionInfo -ErrorAction Stop | ||
| } | ||
| catch { | ||
| Write-Host "Please log in to Azure AD with Connect-AzureAD cmdlet before proceeding" | ||
| Break | ||
| } | ||
|
|
||
| $apiAppReg = Get-AzureADApplication -Filter "AppId eq '${ApiAppId}'" | ||
|
|
||
| # Some GUID values for Azure Active Directory | ||
| # https://blogs.msdn.microsoft.com/aaddevsup/2018/06/06/guid-table-for-windows-azure-active-directory-permissions/ | ||
| # Windows AAD Resource ID: | ||
| $windowsAadResourceId = "00000002-0000-0000-c000-000000000000" | ||
| # 'Sign in and read user profile' permission (scope) | ||
| $signInScope = "311a71cc-e848-46a1-bdf8-97ff7156d8e6" | ||
|
|
||
| # Required App permission for Azure AD sign-in | ||
| $reqAad = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess" | ||
| $reqAad.ResourceAppId = $windowsAadResourceId | ||
| $reqAad.ResourceAccess = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList $signInScope, "Scope" | ||
|
|
||
| # Required App Permission for the API application registration. | ||
| $reqApi = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess" | ||
| $reqApi.ResourceAppId = $apiAppReg.AppId #From API App registration above | ||
|
|
||
| # Just add the first scope (user impersonation) | ||
| $reqApi.ResourceAccess = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList $apiAppReg.Oauth2Permissions[0].id, "Scope" | ||
|
|
||
| $clientAppReg = New-AzureADApplication -DisplayName $DisplayName -IdentifierUris $IdentifierUri -RequiredResourceAccess $reqAad, $reqApi -ReplyUrls $ReplyUrl | ||
|
|
||
| # Create a client secret | ||
| $clientAppPassword = New-AzureADApplicationPasswordCredential -ObjectId $clientAppReg.ObjectId | ||
|
|
||
| # Create Service Principal | ||
| $ignored = New-AzureAdServicePrincipal -AppId $clientAppReg.AppId | ||
|
|
||
| $securityAuthenticationAudience = $apiAppReg.IdentifierUris[0] | ||
| $aadEndpoint = (Get-AzureADCurrentSessionInfo).Environment.Endpoints["ActiveDirectory"] | ||
| $aadTenantId = (Get-AzureADCurrentSessionInfo).Tenant.Id.ToString() | ||
| $securityAuthenticationAuthority = "${aadEndpoint}${aadTenantId}" | ||
|
|
||
| @{ | ||
| AppId = $clientAppReg.AppId; | ||
| AppSecret = $clientAppPassword.Value; | ||
| ReplyUrl = $clientAppReg.ReplyUrls[0] | ||
| AuthUrl = "${securityAuthenticationAuthority}/oauth2/authorize?resource=${securityAuthenticationAudience}" | ||
| TokenUrl = "${securityAuthenticationAuthority}/oauth2/token" | ||
| } | ||
| } |
Oops, something went wrong.