Last active
March 26, 2017 10:48
-
-
Save karabasosman/cfe8ee9b4fdf3827fd1b827536e71be8 to your computer and use it in GitHub Desktop.
Creating SPN for VSTS/TFS
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
param | |
( | |
[Parameter(Mandatory=$true, HelpMessage="Enter Azure Subscription id. You need to be Subscription Admin to execute the script")] | |
[string] $subscriptionId, | |
[Parameter(Mandatory=$true, HelpMessage="Provide a password for SPN application that you would create")] | |
[securestring] $passwordparam, | |
[Parameter(Mandatory=$false, HelpMessage="Provide a SPN role definition")] | |
[string] $spnRole = "owner" | |
) | |
#Initialize | |
$ErrorActionPreference = "Stop" | |
$VerbosePreference = "SilentlyContinue" | |
$userName = $env:USERNAME | |
$newguid = [guid]::NewGuid() | |
$displayName = [String]::Format("VSO.{0}.{1}", $userName, $newguid) | |
$homePage = "http://" + $displayName | |
$identifierUri = $homePage | |
#Initialize subscription | |
$isAzureModulePresent = Get-Module -Name AzureRM* -ListAvailable | |
if ([String]::IsNullOrEmpty($isAzureModulePresent) -eq $true) | |
{ | |
Write-Output "Script requires AzureRM modules to be present. Obtain AzureRM from https://github.com/Azure/azure-powershell/releases. Please refer https://github.com/Microsoft/vsts-tasks/blob/master/Tasks/DeployAzureResourceGroup/README.md for recommended AzureRM versions." -Verbose | |
return | |
} | |
Import-Module -Name AzureRM.Profile | |
Write-Output "Provide your credentials to access Azure subscription $subscriptionId" -Verbose | |
Login-AzureRmAccount -SubscriptionId $subscriptionId | |
$azureSubscription = Get-AzureRmSubscription -SubscriptionId $subscriptionId | |
$connectionName = $azureSubscription.SubscriptionName | |
$tenantId = $azureSubscription.TenantId | |
$id = $azureSubscription.SubscriptionId | |
$PasswordPointer = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($passwordparam) | |
$password = [Runtime.InteropServices.Marshal]::PtrToStringAuto($PasswordPointer) | |
[Runtime.InteropServices.Marshal]::ZeroFreeBSTR($PasswordPointer) | |
#Create a new AD Application | |
Write-Output "Creating a new Application in AAD (App URI - $identifierUri)" -Verbose | |
$azureAdApplication = New-AzureRmADApplication -DisplayName $displayName -HomePage $homePage -IdentifierUris $identifierUri -Password $password -Verbose | |
$appId = $azureAdApplication.ApplicationId | |
Write-Output "Azure AAD Application creation completed successfully (Application Id: $appId)" -Verbose | |
#Create new SPN | |
Write-Output "Creating a new SPN" -Verbose | |
$spn = New-AzureRmADServicePrincipal -ApplicationId $appId | |
$spnName = $spn.ServicePrincipalName | |
Write-Output "SPN creation completed successfully (SPN Name: $spnName)" -Verbose | |
#Assign role to SPN | |
Write-Output "Waiting for SPN creation to reflect in Directory before Role assignment" | |
Start-Sleep 30 | |
Write-Output "Assigning role ($spnRole) to SPN App ($appId)" -Verbose | |
New-AzureRmRoleAssignment -RoleDefinitionName $spnRole -ServicePrincipalName $appId | |
Write-Output "SPN role assignment completed successfully" -Verbose | |
#Print the values | |
Write-Output "`nCopy and Paste below values for Service Connection" -Verbose | |
Write-Output "***************************************************************************" | |
Write-Output "Connection Name: $connectionName(SPN)" | |
Write-Output "Subscription Id: $id" | |
Write-Output "Subscription Name: $connectionName" | |
Write-Output "Service Principal Id: $appId" | |
Write-Output "Service Principal key: <Password that you typed in>" | |
Write-Output "Tenant Id: $tenantId" | |
Write-Output "***************************************************************************" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment